Podivné mizení složek a souborů

[viky]

Vlož log z HJT:
viewtopic.php?f=70&t=5119
do sekce HiJackThis.

Ahoj, posílám logy ze dvou PC.

První PC: vymazaný adresář z c:\Program Files konkrétně Adobe Reader. Dále z původně nainstalovaného skeneru F2710 c:\Program Files\HP kde zbyla pouze složka HP Software Update a v ní soubor hpwuSchd2.exe.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:35:38, on 18.10.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Microsoft Activation Assistant\FGUPM.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Micos\SpravceClient\mcsspravcesrv.exe
C:\Program Files\Micos\SpravceClient\mcsspravce.exe
C:\Program Files\OA10\rcClient.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Program Files\OA10\oaServerNt.exe
C:\Program Files\OA10\oaServerNt.exe
C:\Program Files\OA10\WorkSpApUia.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.seznam.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: Re§im ECHO je zapnut.
O1 - Hosts: 127.0.0.2 http://www.facebook.com
O1 - Hosts: 127.0.0.2 facebook.com
O1 - Hosts: 127.0.0.2 static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 login.facebook.com
O1 - Hosts: 127.0.0.2 http://www.login.facebook.com
O1 - Hosts: 127.0.0.2 fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.fbcdn.net
O1 - Hosts: 127.0.0.2 fbcdn.com
O1 - Hosts: 127.0.0.2 http://www.fbcdn.com
O1 - Hosts: 127.0.0.2 fbcdn.com
O1 - Hosts: 127.0.0.2 http://www.fbcdn.com
O1 - Hosts: 127.0.0.2 static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 http://www.static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 http://www.cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 http://cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 https://cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 http://www.seznam.cz# Block Facebook
O1 - Hosts: 127.0.0.2 http://www.facebook.com
O1 - Hosts: 127.0.0.2 facebook.com
O1 - Hosts: 127.0.0.2 static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 login.facebook.com
O1 - Hosts: 127.0.0.2 http://www.login.facebook.com
O1 - Hosts: 127.0.0.2 fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.fbcdn.net
O1 - Hosts: 127.0.0.2 fbcdn.com
O1 - Hosts: 127.0.0.2 http://www.fbcdn.com
O1 - Hosts: 127.0.0.2 static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 http://www.static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 https://www.torproject.org
O1 - Hosts: 127.0.0.2 http://www.torproject.org
O1 - Hosts: 127.0.0.2 http://www.torproject.org
O1 - Hosts: 127.0.0.2 torproject.org
O1 - Hosts: 127.0.0.2 https://www.hry.cz
O1 - Hosts: 127.0.0.2 http://www.hry.cz
O1 - Hosts: 127.0.0.2 http://www.hry.cz
O1 - Hosts: 127.0.0.2 hry.cz
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WorkSpIE - {D0035573-5C85-40A7-9B17-ED6B89A21C40} - C:\Program Files\OA10\WorkSpIe.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.intranet.pld
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pld.local
O17 - HKLM\Software\..\Telephony: DomainName = pld.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pld.local
O20 - Winlogon Notify: oaKel - oaKelNt.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: MicosClientSpr - MiCoS Software s.r.o. - C:\Program Files\Micos\SpravceClient\mcsspravcesrv.exe
O23 - Service: oaServerNT - SODATSW - C:\Program Files\OA10\oaServerNt.exe
O23 - Service: rcClient - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe

--
End of file - 7869 bytes

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Druhé PC: - Po restartu chybely soubory v c:\windows\fonts začínajicí souborem VGA852.fon
- vymazaný adresář z c:\Program Files konkrétně Firefox
- po přihlášení uživatele se přidaly do složky po spuštění (Media Player, Outlook express, IE 8, vzdálená pomoc).

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:42:17, on 18.10.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Micos\SpravceClient\mcsspravcesrv.exe
C:\Program Files\Micos\SpravceClient\mcsspravce.exe
C:\Program files\OA10\rcClient.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Program files\OA10\oaServerNt.exe
C:\Program files\OA10\oaServerNt.exe
C:\windows\system32\svchost.exe
C:\Program files\OA10\WorkSpApUia.exe
C:\windows\Explorer.EXE
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ClientRS\csend.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.seznam.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: Re§im ECHO je zapnut.
O1 - Hosts: 127.0.0.2 http://www.facebook.com
O1 - Hosts: 127.0.0.2 facebook.com
O1 - Hosts: 127.0.0.2 static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 login.facebook.com
O1 - Hosts: 127.0.0.2 http://www.login.facebook.com
O1 - Hosts: 127.0.0.2 fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.fbcdn.net
O1 - Hosts: 127.0.0.2 fbcdn.com
O1 - Hosts: 127.0.0.2 http://www.fbcdn.com
O1 - Hosts: 127.0.0.2 fbcdn.com
O1 - Hosts: 127.0.0.2 http://www.fbcdn.com
O1 - Hosts: 127.0.0.2 static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 http://www.static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 http://www.cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 http://cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 https://cs-cz.facebook.com
O1 - Hosts: 127.0.0.2 http://www.seznam.cz# Block Facebook
O1 - Hosts: 127.0.0.2 http://www.facebook.com
O1 - Hosts: 127.0.0.2 facebook.com
O1 - Hosts: 127.0.0.2 static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.static.ak.fbcdn.net
O1 - Hosts: 127.0.0.2 login.facebook.com
O1 - Hosts: 127.0.0.2 http://www.login.facebook.com
O1 - Hosts: 127.0.0.2 fbcdn.net
O1 - Hosts: 127.0.0.2 http://www.fbcdn.net
O1 - Hosts: 127.0.0.2 fbcdn.com
O1 - Hosts: 127.0.0.2 http://www.fbcdn.com
O1 - Hosts: 127.0.0.2 static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 http://www.static.ak.connect.facebook.com
O1 - Hosts: 127.0.0.2 https://www.torproject.org
O1 - Hosts: 127.0.0.2 http://www.torproject.org
O1 - Hosts: 127.0.0.2 http://www.torproject.org
O1 - Hosts: 127.0.0.2 torproject.org
O1 - Hosts: 127.0.0.2 https://www.hry.cz
O1 - Hosts: 127.0.0.2 http://www.hry.cz
O1 - Hosts: 127.0.0.2 http://www.hry.cz
O1 - Hosts: 127.0.0.2 hry.cz
O2 - BHO: WorkSpIE - {D0035573-5C85-40A7-9B17-ED6B89A21C40} - C:\Program files\OA10\WorkSpIe.dll
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [csend] "C:\Program Files\ClientRS\csend.exe" "" "769"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pld.local
O17 - HKLM\Software\..\Telephony: DomainName = pld.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pld.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = pld.local
O20 - Winlogon Notify: oaKel - oaKelNt.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\system32\browseui.dll
O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: MicosClientSpr - MiCoS Software s.r.o. - C:\Program Files\Micos\SpravceClient\mcsspravcesrv.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Unknown owner - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (file missing)
O23 - Service: oaServerNT - SODATSW - C:\Program files\OA10\oaServerNt.exe
O23 - Service: rcClient - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe

--
End of file - 7613 bytes

[Reklama]

[memphisto]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po probìhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Stáhni AdwCleaner
Ulož si ho na svojí plochu
Ukonči všechny programy, okna a prohlížeče
Spusť program poklepáním a klikni na „Search“
Po skenu se objeví log (jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

[viky]

Ahoj, zasílám požadované logy.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verze: v2013.10.21.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: H352-11-PS [administrátor]

21.10.2013 12:15:12
352_MBAM-log-2013-10-21 (12-19-52).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 333742
Uplynulý čas: 3 minut, 57 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Data: 1 -> Nebyla provedena žádná instrukce.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# AdwCleaner v3.010 - Report created 21/10/2013 at 12:22:52
# Updated 20/10/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Administrator - H352-11-PS
# Running from : \\Pldnt2\workdir\HijackThis\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


*************************

AdwCleaner[R0].txt - [510 octets] - [21/10/2013 12:22:52]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [569 octets] ##########

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujisti se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit
Můžeš sem pak vložit nový log z MbAM.

Stáhni si Junkware Removal Tool

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

[viky]

Malwarebytes Anti-Malware 1.75.0.1300
http://www.malwarebytes.org

Verze: v2013.10.21.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: H352-11-PS [administrátor]

22.10.2013 7:38:44
mbam-log-2013-10-22 (07-38-44).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 333518
Uplynulý čas: 4 minut, 12 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Data: 1 -> Bude smazán při restartu.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Po restartu se nález v MbAM nesmazal.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Microsoft Windows XP x86
Ran by Administrator on Łt 22.10.2013 at 7:58:01,64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Łt 22.10.2013 at 8:01:28,71
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

RogueKiller V8.7.4 [Oct 16 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v : Normální režim
Uživatel : Administrator [Práva správce]
Mód : Kontrola -- Datum : 10/22/2013 08:06:38
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 1 ¤¤¤
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
[Address] SSDT[25] : NtClose @ 0x805BC538 -> HOOKED (oaRegMgr.sys @ 0xBA0FA3EE)
[Address] SSDT[41] : NtCreateKey @ 0x80623FD6 -> HOOKED (oaRegMgr.sys @ 0xBA0FA012)
[Address] SSDT[50] : NtCreateSection @ 0x805AB3D0 -> HOOKED (oaFile.sys @ 0xB9EC650E)
[Address] SSDT[63] : NtDeleteKey @ 0x80624472 -> HOOKED (oaRegMgr.sys @ 0xBA0FA1A4)
[Address] SSDT[65] : NtDeleteValueKey @ 0x80624642 -> HOOKED (oaRegMgr.sys @ 0xBA0FA228)
[Address] SSDT[119] : NtOpenKey @ 0x806253B4 -> HOOKED (oaRegMgr.sys @ 0xBA0F9EC8)
[Address] SSDT[247] : NtSetValueKey @ 0x80622548 -> HOOKED (oaRegMgr.sys @ 0xBA0FA2F8)

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost
192.168.108.12 PLDNT9
192.168.109.235 PLDNT11

Re§im ECHO je zapnut.
127.0.0.2 http://www.facebook.com
127.0.0.2 facebook.com
127.0.0.2 static.ak.fbcdn.net
127.0.0.2 http://www.static.ak.fbcdn.net
127.0.0.2 login.facebook.com
127.0.0.2 http://www.login.facebook.com
127.0.0.2 fbcdn.net
127.0.0.2 http://www.fbcdn.net
127.0.0.2 fbcdn.com
127.0.0.2 http://www.fbcdn.com
127.0.0.2 fbcdn.com
127.0.0.2 http://www.fbcdn.com
127.0.0.2 static.ak.connect.facebook.com
127.0.0.2 http://www.static.ak.connect.facebook.com
127.0.0.2 cs-cz.facebook.com
[...]


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standardní diskové jednotky) - ST3160815AS +++++
--- User ---
[MBR] 99c0759403ef350c9c0f515e96e218b1
[BSP] 95cb395acbcc1ba006f89bb2b0ed3c4f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152586 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_S_10222013_080638.txt >>

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

@echo off
del /q /a /f %systemroot%\system32\drivers\etc\hosts 2>nul
echo 127.0.0.1 localhost>>%systemroot%\system32\drivers\etc\hosts
exit


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:zev souboru: zde napiš: FixHosts.bat
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Poklepáním na soubor ho spusť.

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "
- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

[viky]

Ahoj,
soubor hosts mám takto upravený záměrně, kvůli připojení k serverům a restrikcím na facebook a jiným web. stránkám. Na všech PC je soubor hosts stejný a problém se objevuje jen u některých PC.

[memphisto]

V tom případě pokračuj tou druhou částí

Stáhni si TDSSKiller

Na svojí plochu. Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller.2.2.7.1._(datum)_log.txt , vlož sem prosím celý obsah logu.

[viky]

Ahoj, log TDSSKILLERu

10:25:38.0365 1828 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
10:25:38.0584 1828 ============================================================
10:25:38.0584 1828 Current date / time: 2013/10/23 10:25:38.0584
10:25:38.0584 1828 SystemInfo:
10:25:38.0584 1828
10:25:38.0584 1828 OS Version: 5.1.2600 ServicePack: 3.0
10:25:38.0584 1828 Product type: Workstation
10:25:38.0584 1828 ComputerName: H352-11-PS
10:25:38.0584 1828 UserName: Administrator
10:25:38.0584 1828 Windows directory: C:\WINDOWS
10:25:38.0584 1828 System windows directory: C:\WINDOWS
10:25:38.0584 1828 Processor architecture: Intel x86
10:25:38.0584 1828 Number of processors: 2
10:25:38.0584 1828 Page size: 0x1000
10:25:38.0584 1828 Boot type: Normal boot
10:25:38.0584 1828 ============================================================
10:25:39.0834 1828 Drive \Device\Harddisk0\DR0 - Size: 0x2540BE4000 (149.01 Gb), SectorSize: 0x200, Cylinders: 0x4BFC, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
10:25:39.0850 1828 ============================================================
10:25:39.0850 1828 \Device\Harddisk0\DR0:
10:25:39.0850 1828 MBR partitions:
10:25:39.0850 1828 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A050BD
10:25:39.0850 1828 ============================================================
10:25:39.0865 1828 C: <-> \Device\Harddisk0\DR0\Partition1
10:25:39.0865 1828 ============================================================
10:25:39.0865 1828 Initialize success
10:25:39.0865 1828 ============================================================
10:26:09.0959 2476 ============================================================
10:26:09.0959 2476 Scan started
10:26:09.0959 2476 Mode: Manual;
10:26:09.0959 2476 ============================================================
10:26:10.0318 2476 ================ Scan system memory ========================
10:26:10.0318 2476 System memory - ok
10:26:10.0318 2476 ================ Scan services =============================
10:26:10.0380 2476 Abiosdsk - ok
10:26:10.0380 2476 abp480n5 - ok
10:26:10.0412 2476 [ 4FE34F1F3126B61FCC6B2043AA8112C9 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:26:10.0412 2476 ACPI - ok
10:26:10.0443 2476 [ AFDFF022A01F0B11C776F0860C3B282F ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
10:26:10.0459 2476 ACPIEC - ok
10:26:10.0505 2476 [ 0F0A69496989912351284BB1BAA2CE57 ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
10:26:10.0505 2476 ADIHdAudAddService - ok
10:26:10.0521 2476 adpu160m - ok
10:26:10.0537 2476 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
10:26:10.0552 2476 aec - ok
10:26:10.0584 2476 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
10:26:10.0584 2476 AFD - ok
10:26:10.0599 2476 Aha154x - ok
10:26:10.0599 2476 aic78u2 - ok
10:26:10.0615 2476 aic78xx - ok
10:26:10.0630 2476 [ E0A6FA244B8624D78FE5FF6F56A33BAE ] Alerter C:\WINDOWS\system32\alrsvc.dll
10:26:10.0646 2476 Alerter - ok
10:26:10.0646 2476 [ 88842DE939A827577BF24243699AC80A ] ALG C:\WINDOWS\System32\alg.exe
10:26:10.0646 2476 ALG - ok
10:26:10.0646 2476 AliIde - ok
10:26:10.0662 2476 amsint - ok
10:26:10.0709 2476 [ 6B8E7A90E576D4FE308F97C69060A171 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
10:26:10.0709 2476 AppMgmt - ok
10:26:10.0709 2476 asc - ok
10:26:10.0724 2476 asc3350p - ok
10:26:10.0724 2476 asc3550 - ok
10:26:10.0818 2476 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
10:26:10.0849 2476 aspnet_state - ok
10:26:10.0880 2476 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:26:10.0896 2476 AsyncMac - ok
10:26:10.0912 2476 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
10:26:10.0912 2476 atapi - ok
10:26:11.0005 2476 [ EECC1D40AA10F85126708796ABA1E7D5 ] atchksrv C:\Program Files\Intel\AMT\atchksrv.exe
10:26:11.0005 2476 atchksrv - ok
10:26:11.0005 2476 Atdisk - ok
10:26:11.0021 2476 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:26:11.0052 2476 Atmarpc - ok
10:26:11.0084 2476 [ DE31B88962A8645DBA5A37B993E7B0F1 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
10:26:11.0084 2476 AudioSrv - ok
10:26:11.0099 2476 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
10:26:11.0130 2476 audstub - ok
10:26:11.0177 2476 [ 6163664C7E9CD110AF70180C126C3FDC ] BcmSqlStartupSvc C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
10:26:11.0177 2476 BcmSqlStartupSvc - ok
10:26:11.0193 2476 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
10:26:11.0224 2476 Beep - ok
10:26:11.0255 2476 [ 19395D092FD85DDC2D9C7729CF5A2AC8 ] BITS C:\WINDOWS\system32\qmgr.dll
10:26:11.0287 2476 BITS - ok
10:26:11.0318 2476 [ 249276D3EF1E74B992299CB96099E4D7 ] Browser C:\WINDOWS\System32\browser.dll
10:26:11.0318 2476 Browser - ok
10:26:11.0349 2476 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
10:26:11.0365 2476 cbidf2k - ok
10:26:11.0365 2476 cd20xrnt - ok
10:26:11.0396 2476 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
10:26:11.0412 2476 Cdaudio - ok
10:26:11.0443 2476 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
10:26:11.0443 2476 Cdfs - ok
10:26:11.0474 2476 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:26:11.0505 2476 Cdrom - ok
10:26:11.0537 2476 Changer - ok
10:26:11.0568 2476 [ E390DC1D7C461D7D56EC53402F329928 ] CiSvc C:\WINDOWS\system32\cisvc.exe
10:26:11.0568 2476 CiSvc - ok
10:26:11.0584 2476 [ 064507A8DFA8C5C7E2FFDDD3E6F424FA ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
10:26:11.0584 2476 ClipSrv - ok
10:26:11.0646 2476 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:26:11.0693 2476 clr_optimization_v2.0.50727_32 - ok
10:26:11.0724 2476 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:26:11.0771 2476 clr_optimization_v4.0.30319_32 - ok
10:26:11.0771 2476 CmdIde - ok
10:26:11.0771 2476 COMSysApp - ok
10:26:11.0787 2476 Cpqarray - ok
10:26:11.0818 2476 [ F3AB0933CBD166D271992F411C27CCAF ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
10:26:11.0818 2476 CryptSvc - ok
10:26:11.0834 2476 dac2w2k - ok
10:26:11.0834 2476 dac960nt - ok
10:26:11.0865 2476 [ BE27674D1CBC3214AEC84B4336A38BBF ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
10:26:11.0880 2476 DcomLaunch - ok
10:26:11.0912 2476 [ 8C9A53E285AC5E6704844D0459EC85BE ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
10:26:11.0912 2476 Dhcp - ok
10:26:11.0927 2476 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
10:26:11.0927 2476 Disk - ok
10:26:11.0943 2476 dmadmin - ok
10:26:11.0974 2476 [ DB5FD2BF5B07DC54BFCB3664FF05BD7C ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
10:26:12.0005 2476 dmboot - ok
10:26:12.0052 2476 [ FFF1720AF51171F32F1EAD5CF71F2810 ] dmio C:\WINDOWS\system32\drivers\dmio.sys
10:26:12.0052 2476 dmio - ok
10:26:12.0068 2476 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
10:26:12.0068 2476 dmload - ok
10:26:12.0099 2476 [ 2BFEFE9E865655A76982F050450B9591 ] dmserver C:\WINDOWS\System32\dmserver.dll
10:26:12.0099 2476 dmserver - ok
10:26:12.0099 2476 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
10:26:12.0115 2476 DMusic - ok
10:26:12.0130 2476 [ DFAA406BF19F4EE806A6F8D4342137F7 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
10:26:12.0146 2476 Dnscache - ok
10:26:12.0209 2476 [ 4A3E2BD20157A0946751229E92EB8621 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
10:26:12.0224 2476 Dot3svc - ok
10:26:12.0240 2476 dpti2o - ok
10:26:12.0255 2476 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
10:26:12.0271 2476 drmkaud - ok
10:26:12.0302 2476 [ C19BDC4D495B29C88FEB2233CDD6B110 ] E1000 C:\WINDOWS\system32\DRIVERS\e1000nt5.sys
10:26:12.0334 2476 E1000 - ok
10:26:12.0334 2476 [ 866B8EE30E4504C11AE0D29ED6F8824B ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
10:26:12.0380 2476 E100B - ok
10:26:12.0412 2476 [ 34AAA3B298A852B3663E6E0D94D12945 ] e1express C:\WINDOWS\system32\DRIVERS\e1e5132.sys
10:26:12.0427 2476 e1express - ok
10:26:12.0459 2476 [ 7BD902F59C9430DB405C6E57DAB0D5B7 ] eamon C:\WINDOWS\system32\DRIVERS\eamon.sys
10:26:12.0459 2476 eamon - ok
10:26:12.0505 2476 [ 0887D9C2BE8D940778CAD1E3B85F2A41 ] EapHost C:\WINDOWS\System32\eapsvc.dll
10:26:12.0505 2476 EapHost - ok
10:26:12.0537 2476 [ A6C77EBB65D025B826222C6BE6D869F2 ] ehdrv C:\WINDOWS\system32\DRIVERS\ehdrv.sys
10:26:12.0552 2476 ehdrv - ok
10:26:12.0646 2476 [ 300367B6DFBEE655831B5AD7A9E3DA39 ] EhttpSrv C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
10:26:12.0646 2476 EhttpSrv - ok
10:26:12.0677 2476 [ 8471F4C783AA72D801A83309F3CBAA37 ] ekrn C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
10:26:12.0693 2476 ekrn - ok
10:26:12.0724 2476 [ FB2E7B7160CA024042BAD41DBFF44F4C ] epfwtdir C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
10:26:12.0740 2476 epfwtdir - ok
10:26:12.0755 2476 [ A2A4912798F2BE706ABADD3D30800D16 ] ERSvc C:\WINDOWS\System32\ersvc.dll
10:26:12.0771 2476 ERSvc - ok
10:26:12.0802 2476 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] Eventlog C:\WINDOWS\system32\services.exe
10:26:12.0802 2476 Eventlog - ok
10:26:12.0818 2476 [ A371F11EF07653591C8DE26AFB13CE7F ] EventSystem C:\WINDOWS\system32\es.dll
10:26:12.0818 2476 EventSystem - ok
10:26:12.0834 2476 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
10:26:12.0865 2476 Fastfat - ok
10:26:12.0896 2476 [ EE9A2B9EA968A792A053C9D1A86BF870 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
10:26:12.0896 2476 FastUserSwitchingCompatibility - ok
10:26:12.0912 2476 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
10:26:12.0927 2476 Fdc - ok
10:26:12.0927 2476 Suspicious service (NoAccess): FGLPMCLA
10:26:12.0943 2476 [ 102C4B15D5E69F399E98EEF8735D0A71 ] FGLPMCLA C:\WINDOWS\system32\DRIVERS\fglpmcla.sys
10:26:12.0943 2476 FGLPMCLA ( LockedService.Multi.Generic ) - warning
10:26:12.0943 2476 FGLPMCLA - detected LockedService.Multi.Generic (1)
10:26:12.0943 2476 Suspicious service (NoAccess): FGLPMKER
10:26:12.0959 2476 [ F969755741414C21105FADA2FE028D13 ] FGLPMKER C:\WINDOWS\system32\DRIVERS\fglpmkervault.sys
10:26:12.0974 2476 FGLPMKER ( LockedService.Multi.Generic ) - warning
10:26:12.0974 2476 FGLPMKER - detected LockedService.Multi.Generic (1)
10:26:13.0005 2476 [ FB75DAF11F4662A18B4F0C2A460DF7D5 ] FGSchedules C:\Program Files\Microsoft Activation Assistant\FGUPM.exe
10:26:13.0005 2476 FGSchedules - ok
10:26:13.0021 2476 [ FB75DAF11F4662A18B4F0C2A460DF7D5 ] FGUPM C:\Program Files\Microsoft Activation Assistant\FGUPM.exe
10:26:13.0037 2476 FGUPM - ok
10:26:13.0068 2476 [ AC366695A0796560AA37215AD5762AAF ] Fips C:\WINDOWS\system32\drivers\Fips.sys
10:26:13.0084 2476 Fips - ok
10:26:13.0099 2476 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
10:26:13.0130 2476 Flpydisk - ok
10:26:13.0162 2476 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
10:26:13.0162 2476 FltMgr - ok
10:26:13.0240 2476 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
10:26:13.0240 2476 FontCache3.0.0.0 - ok
10:26:13.0271 2476 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:26:13.0287 2476 Fs_Rec - ok
10:26:13.0302 2476 [ 4E664D8541DB4A66B73A24257E322E1F ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:26:13.0302 2476 Ftdisk - ok
10:26:13.0318 2476 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:26:13.0349 2476 Gpc - ok
10:26:13.0349 2476 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
10:26:13.0365 2476 HDAudBus - ok
10:26:13.0396 2476 [ C865D1F6D03595DF213DC3C67E4E4C58 ] HECI C:\WINDOWS\system32\DRIVERS\HECI.sys
10:26:13.0427 2476 HECI - ok
10:26:13.0459 2476 [ FCFE31FB75F8A6295B6B0AF87A626282 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
10:26:13.0459 2476 helpsvc - ok
10:26:13.0474 2476 [ 00E25EE90166B3E1BE6E74AEBF858306 ] HidServ C:\WINDOWS\System32\hidserv.dll
10:26:13.0474 2476 HidServ - ok
10:26:13.0505 2476 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
10:26:13.0521 2476 hidusb - ok
10:26:13.0568 2476 [ 7A6B320928F86BC851530D63C82965D9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
10:26:13.0568 2476 hkmsvc - ok
10:26:13.0568 2476 hpn - ok
10:26:13.0755 2476 [ 58D4765AB87347DB835D5693ADF652C1 ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
10:26:13.0755 2476 hpqcxs08 - ok
10:26:13.0787 2476 [ F6AACF5BCE2893E0C1754AFEB672E5C9 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
10:26:13.0818 2476 HTTP - ok
10:26:13.0849 2476 [ 58FE2F2DA3BC5573F4A35B3760D3125F ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
10:26:13.0849 2476 HTTPFilter - ok
10:26:13.0865 2476 i2omgmt - ok
10:26:13.0865 2476 i2omp - ok
10:26:13.0896 2476 [ C528E27945367191E7BAE364930B6932 ] i8042prt C:\WINDOWS\system32\drivers\i8042prt.sys
10:26:13.0912 2476 i8042prt - ok
10:26:14.0068 2476 [ B2768350BB50469AEB1AFE694372B613 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
10:26:14.0224 2476 ialm - ok
10:26:14.0302 2476 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
10:26:14.0349 2476 idsvc - ok
10:26:14.0349 2476 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
10:26:14.0365 2476 Imapi - ok
10:26:14.0412 2476 [ F7B93AAFAD33B2320954C17E26C8D361 ] ImapiService C:\WINDOWS\system32\imapi.exe
10:26:14.0412 2476 ImapiService - ok
10:26:14.0412 2476 ini910u - ok
10:26:14.0427 2476 IntelIde - ok
10:26:14.0443 2476 [ 27B290D632AF2CF3CF40BFDDB7370985 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:26:14.0459 2476 intelppm - ok
10:26:14.0474 2476 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
10:26:14.0521 2476 Ip6Fw - ok
10:26:14.0537 2476 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:26:14.0568 2476 IpFilterDriver - ok
10:26:14.0568 2476 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:26:14.0599 2476 IpInIp - ok
10:26:14.0615 2476 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:26:14.0630 2476 IpNat - ok
10:26:14.0677 2476 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:26:14.0693 2476 IPSec - ok
10:26:14.0709 2476 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
10:26:14.0724 2476 IRENUM - ok
10:26:14.0740 2476 [ CC9F8A2D60AED1A51A3AC34C59B987AE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:26:14.0755 2476 isapnp - ok
10:26:14.0787 2476 [ 1B6162FE7F66B1A71A4B70F941C4AA9B ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:26:14.0818 2476 Kbdclass - ok
10:26:14.0834 2476 [ 86C8F23616C6C6E5B2776901C17B945B ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
10:26:14.0849 2476 kbdhid - ok
10:26:14.0865 2476 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
10:26:14.0865 2476 kmixer - ok
10:26:14.0880 2476 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
10:26:14.0896 2476 KSecDD - ok
10:26:14.0912 2476 [ 3428E8F86F8ADD36B42FB23542C7B3E4 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
10:26:14.0927 2476 lanmanserver - ok
10:26:14.0943 2476 [ 936C1D110232D23B621CB0196E4F80F0 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
10:26:14.0943 2476 lanmanworkstation - ok
10:26:14.0959 2476 lbrtfdc - ok
10:26:14.0990 2476 [ 0AB159F536E3E8F7F07113702A07CCA5 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
10:26:14.0990 2476 LmHosts - ok
10:26:14.0990 2476 [ C518D248041C259FCFA7175C866915C3 ] LMS C:\Program Files\Intel\AMT\LMS.exe
10:26:15.0005 2476 LMS - ok
10:26:15.0021 2476 [ 221CD1C815B8A6B79389C3F5D1018DE8 ] Messenger C:\WINDOWS\System32\msgsvc.dll
10:26:15.0021 2476 Messenger - ok
10:26:15.0068 2476 [ CDF48F8826D247189000F75F03B677B7 ] MicosClientSpr C:\Program Files\Micos\SpravceClient\mcsspravcesrv.exe
10:26:15.0068 2476 MicosClientSpr - ok
10:26:15.0099 2476 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
10:26:15.0130 2476 mnmdd - ok
10:26:15.0162 2476 [ 9A57D046F88F4B69751B11FD40088A61 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
10:26:15.0162 2476 mnmsrvc - ok
10:26:15.0224 2476 [ 44032B0C6D9954D3FD26438330B99EE7 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
10:26:15.0240 2476 Modem - ok
10:26:15.0255 2476 [ 4CB582831DBDE63CE43B45D771218374 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:26:15.0271 2476 Mouclass - ok
10:26:15.0302 2476 [ BB269EBA740737AB749B214D568B6812 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
10:26:15.0318 2476 mouhid - ok
10:26:15.0334 2476 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
10:26:15.0334 2476 MountMgr - ok
10:26:15.0334 2476 mraid35x - ok
10:26:15.0349 2476 [ E3F17E1EA5256709D4E97EF0DA04B3C9 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:26:15.0349 2476 MRxDAV - ok
10:26:15.0380 2476 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:26:15.0396 2476 MRxSmb - ok
10:26:15.0427 2476 [ 6DB4D1521CABA9A5FFAB54ADE0AE867D ] MSDTC C:\WINDOWS\system32\msdtc.exe
10:26:15.0427 2476 MSDTC - ok
10:26:15.0443 2476 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
10:26:15.0459 2476 Msfs - ok
10:26:15.0474 2476 MSIServer - ok
10:26:15.0474 2476 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:26:15.0490 2476 MSKSSRV - ok
10:26:15.0490 2476 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:26:15.0521 2476 MSPCLOCK - ok
10:26:15.0521 2476 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
10:26:15.0537 2476 MSPQM - ok
10:26:15.0568 2476 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:26:15.0599 2476 mssmbios - ok
10:26:15.0615 2476 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
10:26:15.0615 2476 Mup - ok
10:26:15.0662 2476 [ 6EA362E9DB03D44F6B996F4D8BE237E9 ] napagent C:\WINDOWS\System32\qagentrt.dll
10:26:15.0677 2476 napagent - ok
10:26:15.0724 2476 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
10:26:15.0724 2476 NDIS - ok
10:26:15.0755 2476 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:26:15.0771 2476 NdisTapi - ok
10:26:15.0771 2476 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:26:15.0802 2476 Ndisuio - ok
10:26:15.0818 2476 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:26:15.0849 2476 NdisWan - ok
10:26:15.0865 2476 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
10:26:15.0880 2476 NDProxy - ok
10:26:15.0880 2476 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
10:26:15.0880 2476 NetBIOS - ok
10:26:15.0896 2476 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
10:26:15.0927 2476 NetBT - ok
10:26:15.0959 2476 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDE C:\WINDOWS\system32\netdde.exe
10:26:15.0959 2476 NetDDE - ok
10:26:15.0959 2476 [ 933DE774986EC85E48210C44AB431DE6 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
10:26:15.0974 2476 NetDDEdsdm - ok
10:26:16.0005 2476 [ ED0A176354487CEED65B80A7148AB739 ] Netlogon C:\WINDOWS\system32\lsass.exe
10:26:16.0005 2476 Netlogon - ok
10:26:16.0021 2476 [ 72E1E9E2977BE08BDEEDB6D8FD9D4D40 ] Netman C:\WINDOWS\System32\netman.dll
10:26:16.0021 2476 Netman - ok
10:26:16.0068 2476 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
10:26:16.0084 2476 NetTcpPortSharing - ok
10:26:16.0130 2476 [ 39EE7C3BFBC64BA87CC8CF67386E814C ] Nla C:\WINDOWS\System32\mswsock.dll
10:26:16.0130 2476 Nla - ok
10:26:16.0146 2476 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
10:26:16.0146 2476 Npfs - ok
10:26:16.0177 2476 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
10:26:16.0177 2476 Ntfs - ok
10:26:16.0193 2476 [ ED0A176354487CEED65B80A7148AB739 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
10:26:16.0193 2476 NtLmSsp - ok
10:26:16.0255 2476 [ 023DD70573D644F3D9C8B1258A7BFD08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
10:26:16.0271 2476 NtmsSvc - ok
10:26:16.0287 2476 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
10:26:16.0318 2476 Null - ok
10:26:16.0334 2476 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:26:16.0365 2476 NwlnkFlt - ok
10:26:16.0365 2476 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:26:16.0380 2476 NwlnkFwd - ok
10:26:16.0412 2476 [ 67F6175EE61E921DD23A2360746A1DFC ] oaFile C:\WINDOWS\system32\drivers\oaFile.sys
10:26:16.0427 2476 oaFile - ok
10:26:16.0427 2476 [ CDCAD6845F777EACF8D56083029E3366 ] oaRegMgr C:\WINDOWS\system32\drivers\oaRegMgr.sys
10:26:16.0427 2476 oaRegMgr - ok
10:26:16.0474 2476 [ 78700C02699660599C2C36E818D934DD ] oaServerNT C:\Program Files\OA10\oaServerNt.exe
10:26:16.0490 2476 oaServerNT - ok
10:26:16.0584 2476 [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
10:26:16.0599 2476 odserv - ok
10:26:16.0677 2476 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:26:16.0677 2476 ose - ok
10:26:16.0724 2476 [ 46F8DB73B4A53E543F8E371DC7C75BAE ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
10:26:16.0740 2476 Parport - ok
10:26:16.0755 2476 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
10:26:16.0755 2476 PartMgr - ok
10:26:16.0787 2476 [ 1FAE19D0457176318BBA4A8795656EBC ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
10:26:16.0818 2476 ParVdm - ok
10:26:16.0818 2476 [ 6CE351D149CB4BEFC702951E471E1730 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
10:26:16.0818 2476 PCI - ok
10:26:16.0818 2476 PCIDump - ok
10:26:16.0834 2476 [ 2DA4EC85E0EA7A45C6B2A05820492D5A ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
10:26:16.0834 2476 PCIIde - ok
10:26:16.0865 2476 [ 4FC31E6C19A5CE5198B1ABFF94CAE758 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
10:26:16.0896 2476 Pcmcia - ok
10:26:16.0912 2476 PDCOMP - ok
10:26:16.0912 2476 PDFRAME - ok
10:26:16.0912 2476 PDRELI - ok
10:26:16.0927 2476 PDRFRAME - ok
10:26:16.0927 2476 perc2 - ok
10:26:16.0927 2476 perc2hib - ok
10:26:16.0974 2476 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] PlugPlay C:\WINDOWS\system32\services.exe
10:26:16.0974 2476 PlugPlay - ok
10:26:16.0990 2476 [ ED0A176354487CEED65B80A7148AB739 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
10:26:16.0990 2476 PolicyAgent - ok
10:26:16.0990 2476 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:26:17.0021 2476 PptpMiniport - ok
10:26:17.0021 2476 [ ED0A176354487CEED65B80A7148AB739 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
10:26:17.0021 2476 ProtectedStorage - ok
10:26:17.0021 2476 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
10:26:17.0068 2476 PSched - ok
10:26:17.0068 2476 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:26:17.0084 2476 Ptilink - ok
10:26:17.0099 2476 ql1080 - ok
10:26:17.0099 2476 Ql10wnt - ok
10:26:17.0099 2476 ql12160 - ok
10:26:17.0115 2476 ql1240 - ok
10:26:17.0115 2476 ql1280 - ok
10:26:17.0130 2476 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:26:17.0146 2476 RasAcd - ok
10:26:17.0177 2476 [ 2B5E44EA009F2F374B980E1E9A70635D ] RasAuto C:\WINDOWS\System32\rasauto.dll
10:26:17.0177 2476 RasAuto - ok
10:26:17.0209 2476 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:26:17.0224 2476 Rasl2tp - ok
10:26:17.0287 2476 [ D57554C664B64604BD1EE13EA2C07E77 ] RasMan C:\WINDOWS\System32\rasmans.dll
10:26:17.0287 2476 RasMan - ok
10:26:17.0302 2476 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:26:17.0318 2476 RasPppoe - ok
10:26:17.0318 2476 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
10:26:17.0349 2476 Raspti - ok
10:26:17.0349 2476 rcClient - ok
10:26:17.0365 2476 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:26:17.0443 2476 Rdbss - ok
10:26:17.0459 2476 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:26:17.0474 2476 RDPCDD - ok
10:26:17.0505 2476 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:26:17.0521 2476 rdpdr - ok
10:26:17.0552 2476 [ 5B3055DAA788BD688594D2F5981F2A83 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
10:26:17.0584 2476 RDPWD - ok
10:26:17.0615 2476 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
10:26:17.0615 2476 RDSessMgr - ok
10:26:17.0662 2476 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
10:26:17.0677 2476 redbook - ok
10:26:17.0693 2476 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
10:26:17.0693 2476 RemoteAccess - ok
10:26:17.0709 2476 [ 8F31505484A190D5B22274708799F4EC ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
10:26:17.0724 2476 RemoteRegistry - ok
10:26:17.0724 2476 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\system32\locator.exe
10:26:17.0724 2476 RpcLocator - ok
10:26:17.0755 2476 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\system32\rpcss.dll
10:26:17.0755 2476 RpcSs - ok
10:26:17.0802 2476 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\system32\rsvp.exe
10:26:17.0802 2476 RSVP - ok
10:26:17.0834 2476 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
10:26:17.0834 2476 SamSs - ok
10:26:17.0849 2476 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
10:26:17.0849 2476 SCardSvr - ok
10:26:17.0880 2476 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
10:26:17.0880 2476 Schedule - ok
10:26:17.0896 2476 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:26:17.0912 2476 Secdrv - ok
10:26:17.0943 2476 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
10:26:17.0943 2476 seclogon - ok
10:26:17.0974 2476 [ B6A6B409FDA9D9EBD3AADB838D3D7173 ] SenFiltService C:\WINDOWS\system32\drivers\Senfilt.sys
10:26:17.0990 2476 SenFiltService - ok
10:26:18.0005 2476 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
10:26:18.0005 2476 SENS - ok
10:26:18.0005 2476 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
10:26:18.0021 2476 serenum - ok
10:26:18.0037 2476 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
10:26:18.0083 2476 Serial - ok
10:26:18.0115 2476 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\DRIVERS\sfloppy.sys
10:26:18.0130 2476 Sfloppy - ok
10:26:18.0177 2476 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
10:26:18.0193 2476 SharedAccess - ok
10:26:18.0208 2476 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
10:26:18.0208 2476 ShellHWDetection - ok
10:26:18.0208 2476 Simbad - ok
10:26:18.0224 2476 Sparrow - ok
10:26:18.0255 2476 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
10:26:18.0271 2476 splitter - ok
10:26:18.0333 2476 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
10:26:18.0333 2476 Spooler - ok
10:26:18.0349 2476 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
10:26:18.0365 2476 sr - ok
10:26:18.0396 2476 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\system32\srsvc.dll
10:26:18.0396 2476 srservice - ok
10:26:18.0412 2476 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
10:26:18.0427 2476 Srv - ok
10:26:18.0443 2476 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
10:26:18.0458 2476 SSDPSRV - ok
10:26:18.0474 2476 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
10:26:18.0474 2476 stisvc - ok
10:26:18.0521 2476 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
10:26:18.0552 2476 swenum - ok
10:26:18.0568 2476 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
10:26:18.0599 2476 swmidi - ok
10:26:18.0615 2476 SwPrv - ok
10:26:18.0615 2476 symc810 - ok
10:26:18.0615 2476 symc8xx - ok
10:26:18.0630 2476 sym_hi - ok
10:26:18.0630 2476 sym_u3 - ok
10:26:18.0646 2476 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
10:26:18.0646 2476 sysaudio - ok
10:26:18.0677 2476 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
10:26:18.0677 2476 SysmonLog - ok
10:26:18.0708 2476 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
10:26:18.0708 2476 TapiSrv - ok
10:26:18.0755 2476 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:26:18.0787 2476 Tcpip - ok
10:26:18.0818 2476 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
10:26:18.0833 2476 TDPIPE - ok
10:26:18.0849 2476 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
10:26:18.0880 2476 TDTCP - ok
10:26:18.0896 2476 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
10:26:18.0943 2476 TermDD - ok
10:26:18.0974 2476 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
10:26:18.0974 2476 TermService - ok
10:26:18.0990 2476 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
10:26:18.0990 2476 Themes - ok
10:26:19.0021 2476 [ CD0CC7B167D78043A41C98D4921EFB54 ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
10:26:19.0021 2476 TlntSvr - ok
10:26:19.0037 2476 TosIde - ok
10:26:19.0052 2476 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
10:26:19.0052 2476 TrkWks - ok
10:26:19.0068 2476 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
10:26:19.0083 2476 Udfs - ok
10:26:19.0099 2476 ultra - ok
10:26:19.0162 2476 [ 0558985BD646203DF5F36BF0FBD241A3 ] UNS C:\Program Files\Intel\AMT\UNS.exe
10:26:19.0224 2476 UNS - ok
10:26:19.0255 2476 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
10:26:19.0302 2476 Update - ok
10:26:19.0349 2476 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
10:26:19.0349 2476 upnphost - ok
10:26:19.0349 2476 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
10:26:19.0365 2476 UPS - ok
10:26:19.0380 2476 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:26:19.0396 2476 usbccgp - ok
10:26:19.0412 2476 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:26:19.0427 2476 usbehci - ok
10:26:19.0443 2476 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:26:19.0474 2476 usbhub - ok
10:26:19.0505 2476 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:26:19.0521 2476 usbprint - ok
10:26:19.0552 2476 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
10:26:19.0568 2476 usbscan - ok
10:26:19.0599 2476 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:26:19.0615 2476 USBSTOR - ok
10:26:19.0630 2476 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:26:19.0662 2476 usbuhci - ok
10:26:19.0677 2476 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
10:26:19.0693 2476 VgaSave - ok
10:26:19.0693 2476 ViaIde - ok
10:26:19.0708 2476 [ 28A4B296B47782173C346E376CB374D1 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
10:26:19.0708 2476 VolSnap - ok
10:26:19.0708 2476 vsdatant - ok
10:26:19.0755 2476 [ D6BA1A63D9E00933F1CD2A885573AFB2 ] VSS C:\WINDOWS\System32\vssvc.exe
10:26:19.0771 2476 VSS - ok
10:26:19.0787 2476 [ FA4E1CDBA256787F2149F4AAD07BC91F ] W32Time C:\WINDOWS\system32\w32time.dll
10:26:19.0787 2476 W32Time - ok
10:26:19.0802 2476 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:26:19.0818 2476 Wanarp - ok
10:26:19.0849 2476 [ A2D8552FDE97D38651FD2B1EC653BF53 ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
10:26:19.0880 2476 Wdf01000 - ok
10:26:19.0880 2476 WDICA - ok
10:26:19.0896 2476 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
10:26:19.0912 2476 wdmaud - ok
10:26:19.0943 2476 [ 47AE51048A82DFA1CD6B51D369F7E169 ] WebClient C:\WINDOWS\System32\webclnt.dll
10:26:19.0958 2476 WebClient - ok
10:26:20.0005 2476 [ E488332126E3B1182D2B8A0C35408EC6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
10:26:20.0005 2476 winmgmt - ok
10:26:20.0052 2476 [ 6199B2AE3F9DB9CB6DB230471A1DC601 ] WmdmPmSN C:\WINDOWS\system32\mspmsnsv.dll
10:26:20.0052 2476 WmdmPmSN - ok
10:26:20.0099 2476 [ 0171CFF34BBA8C5977F18C48D8AEF8C6 ] Wmi C:\WINDOWS\System32\advapi32.dll
10:26:20.0115 2476 Wmi - ok
10:26:20.0146 2476 [ 23F6F03272F7E5679F1F050AED5ACEE6 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
10:26:20.0162 2476 WmiApSrv - ok
10:26:20.0255 2476 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
10:26:20.0287 2476 WPFFontCache_v0400 - ok
10:26:20.0318 2476 [ 4C86D5FAF78194995AF9CC1075F65DD3 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
10:26:20.0318 2476 wscsvc - ok
10:26:20.0333 2476 [ C1364564800EE9784192145324A23308 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
10:26:20.0333 2476 wuauserv - ok
10:26:20.0365 2476 [ A27D4BA7264C0BF52F32D10405BEA1D4 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
10:26:20.0380 2476 WZCSVC - ok
10:26:20.0412 2476 [ EAA4BB9EDB3FB10CF8979FE65E63658F ] xmlprov C:\WINDOWS\System32\xmlprov.dll
10:26:20.0427 2476 xmlprov - ok
10:26:20.0427 2476 ================ Scan global ===============================
10:26:20.0474 2476 [ F36278E42C8C5DF03CE17DAC8231C91C ] C:\WINDOWS\system32\basesrv.dll
10:26:20.0490 2476 [ F3FA14A297BC687D0B51289D034033C9 ] C:\WINDOWS\system32\winsrv.dll
10:26:20.0490 2476 [ F3FA14A297BC687D0B51289D034033C9 ] C:\WINDOWS\system32\winsrv.dll
10:26:20.0521 2476 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] C:\WINDOWS\system32\services.exe
10:26:20.0521 2476 [Global] - ok
10:26:20.0521 2476 ================ Scan MBR ==================================
10:26:20.0552 2476 [ 413FC2A0C716421B3158746D63736515 ] \Device\Harddisk0\DR0
10:26:20.0693 2476 \Device\Harddisk0\DR0 - ok
10:26:20.0693 2476 ================ Scan VBR ==================================
10:26:20.0724 2476 [ 63E697795FFAF0FA1AADBA170D4CAFF3 ] \Device\Harddisk0\DR0\Partition1
10:26:20.0724 2476 \Device\Harddisk0\DR0\Partition1 - ok
10:26:20.0724 2476 ============================================================
10:26:20.0724 2476 Scan finished
10:26:20.0724 2476 ============================================================
10:26:20.0740 3668 Detected object count: 2
10:26:20.0740 3668 Actual detected object count: 2
10:26:45.0849 3668 FGLPMCLA ( LockedService.Multi.Generic ) - skipped by user
10:26:45.0849 3668 FGLPMCLA ( LockedService.Multi.Generic ) - User select action: Skip
10:26:45.0849 3668 FGLPMKER ( LockedService.Multi.Generic ) - skipped by user
10:26:45.0849 3668 FGLPMKER ( LockedService.Multi.Generic ) - User select action: Skip
10:26:52.0739 2176 Deinitialize success

[jaro3]

Udělej znovu v nouz. režimu Malwarebytes' Anti-Malware a zkus tu nákazu smazat.

dej pak log.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[viky]

ComboFix 13-10-23.01 - Administrator 24.10.2013 12:12:04.1.2 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2005.1672 [GMT 2:00]
Spuštěný z: C:\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\oaPassCn.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-09-24 do 2013-10-24 )))))))))))))))))))))))))))))))
.
.
2013-10-22 05:58 . 2013-10-22 05:58 -------- d-----w- c:\windows\ERUNT
2013-10-21 10:50 . 2013-10-21 10:50 -------- d-----w- c:\program files\Common Files\HP
2013-10-21 10:49 . 2013-10-21 10:49 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HP
2013-10-21 10:49 . 2013-10-21 10:49 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HP Product Assistant
2013-10-21 10:49 . 2013-10-21 10:49 -------- d-----w- c:\program files\Hewlett-Packard
2013-10-21 10:48 . 2013-10-21 10:50 -------- d-----w- c:\program files\HP
2013-10-21 10:45 . 2013-10-21 10:46 -------- d-----w- c:\program files\CCleaner
2013-10-21 10:22 . 2013-10-21 10:23 -------- d-----w- C:\AdwCleaner
2013-10-21 10:13 . 2013-10-21 10:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-10-21 10:10 . 2013-10-21 10:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-10-21 10:10 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-10-18 12:34 . 2013-10-18 12:34 -------- d-----w- c:\program files\Trend Micro
2013-10-18 11:53 . 2013-10-18 11:53 -------- d-----w- c:\program files\Common Files\Adobe
2013-10-18 11:37 . 2013-10-18 11:46 -------- d-----w- c:\documents and settings\administrator.PLD
2013-10-17 06:56 . 2013-10-17 07:01 -------- d-----w- c:\documents and settings\betlachovat
2013-10-02 13:10 . 2013-10-02 13:10 -------- d-----w- c:\program files\Microsoft Works
2013-09-26 18:00 . 2013-09-26 18:00 208760 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-27 06:37 . 2010-08-25 05:20 96768 ----a-w- c:\windows\system32\PrintMon.dll
2013-09-27 06:37 . 2009-10-09 06:44 333312 ------w- c:\windows\system32\oaKelNt.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-08-01 1036288]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-18 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-18 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-18 141848]
"atchk"="c:\program files\Intel\AMT\atchk.exe" [2007-06-12 408344]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-11-22 2219184]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"HP Software Update"="c:\program files\hp\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Micos\\SpravceClient\\mcsspravce.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"8886:TCP"= 8886:TCP:ClientRS_8886_TCP
"8887:TCP"= 8887:TCP:ClientRS_8887_TCP
"8888:TCP"= 8888:TCP:ClientRS_8888_TCP
.
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16.11.2009 10:06 94872]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 10:03 115008]
S2 atchksrv;Intel(R) Active Management Technology System Status Service;c:\program files\Intel\AMT\atchksrv.exe [16.3.2009 14:58 183064]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [22.11.2011 10:46 814264]
S2 FGSchedules;FlexGo Schedules Service;c:\program files\Microsoft Activation Assistant\FGUPM.exe [9.6.2008 18:50 564016]
S2 FGUPM;FlexGo UPM Service;c:\program files\Microsoft Activation Assistant\FGUPM.exe [9.6.2008 18:50 564016]
S2 MicosClientSpr;MicosClientSpr;c:\program files\Micos\SpravceClient\mcsspravcesrv.exe [30.1.2013 10:58 73224]
S2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [16.3.2009 14:58 2521880]
S3 FGLPMCLA;LPM Class Device Driver;c:\windows\system32\drivers\FGLPMCLA.sys [9.6.2008 18:44 26160]
S3 FGLPMKER;Kernel-mode LPM Mini Device Driver;c:\windows\system32\drivers\FGLPMKERVAULT.sys [9.6.2008 18:44 351488]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.108.6 192.168.108.200
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-10-24 12:15
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"="a"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FGLPMCLA]
"ImagePath"="system32\DRIVERS\fglpmcla.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FGLPMKER]
"ImagePath"="system32\DRIVERS\fglpmkervault.sys"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-207690562-3724874109-3353888244-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,47,99,9f,a6,50,e6,0e,49,96,6b,1f,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,47,99,9f,a6,50,e6,0e,49,96,6b,1f,\
.
Celkový čas: 2013-10-24 12:16:19
ComboFix-quarantined-files.txt 2013-10-24 10:16
.
Před spuštěním: Volných bajtů: 140 865 224 704
Po spuštění: Volných bajtů: 141 274 619 904
.
- - End Of File - - AE848B870704F783C4AF9B52FE99E93C
413FC2A0C716421B3158746D63736515

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

RegLock::
[HKEY_USERS\S-1-5-21-207690562-3724874109-3353888244-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,47,99,9f,a6,50,e6,0e,49,96,6b,1f,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,47,99,9f,a6,50,e6,0e,49,96,6b,1f,\

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\oaKelNt.dll

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Nebo na:
http://www.virscan.org/

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.