Prosím o kontrolu logu Vyřešeno

[Aurelius]

Jak mám těd pokračovat ? Děkuji

[Reklama]

[Orcus]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený červeně:

ClearJavaCache::
KillAll::

File::
O4 - HKLM\..\Run: [msnohuSrv] C:\Windows\inf\msnohu.vbe
O4 - HKLM\..\Run: [MSStp] C:\Windows\system32\msstp.vbe
O4 - HKLM\..\Run: [mncxdnhSrv] C:\Windows\inf\mncxdnh.vbe
c:\windows\Tasks\Adobe Flash Player Updater.job

RegLock::
.
[HKEY_USERS\S-1-5-21-1830440610-1908763506-3238583907-1000\Software\SecuROM\License information*]
"datasecu"=hex:d0,09,4d,fa,40,3c,61,45,2a,7a,2e,7a,c0,bc,ba,49,20,1c,39,c1,a2,
f4,d3,26,e4,4d,99,88,63,26,ca,fb,a1,2e,19,bf,66,06,5c,94,93,4e,41,f0,76,44,\
"rkeysecu"=hex:5c,0f,6e,1a,2b,66,5f,ac,89,57,ae,90,a8,d8,d1,77
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu

Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.

====================================================

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[Aurelius]

ComboFix 14-05-29.01 - šalomoun 30.05.2014 23:45:27.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2047.1181 [GMT 2:00]
Spuštěný z: c:\users\Üalomoun\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Üalomoun\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-04-28 do 2014-05-30 )))))))))))))))))))))))))))))))
.
.
2014-05-30 21:50 . 2014-05-30 21:50 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-05-30 21:50 . 2014-05-30 21:50 -------- d-----w- c:\users\hedev\AppData\Local\temp
2014-05-30 21:50 . 2014-05-30 21:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-30 21:50 . 2014-05-30 21:50 -------- d-----w- c:\users\çalomoun\AppData\Local\temp
2014-05-30 21:50 . 2014-05-30 21:50 -------- d-----w- c:\users\aalomoun\AppData\Local\temp
2014-05-30 21:50 . 2014-05-30 21:50 -------- d-----w- c:\users\Guest\AppData\Local\temp
2014-05-30 17:22 . 2014-05-30 17:22 -------- d-----w- c:\program files\EA Sports
2014-05-30 16:43 . 2014-05-30 21:35 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DC77227-3F35-4A55-8C97-87EAD1CA10A3}\offreg.dll
2014-05-30 16:07 . 2014-05-30 16:07 -------- d-----w- c:\users\šalomoun\AppData\Local\CrashDumps
2014-05-30 14:14 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DC77227-3F35-4A55-8C97-87EAD1CA10A3}\mpengine.dll
2014-05-30 13:59 . 2014-05-30 13:59 -------- d-----w- c:\users\šalomoun\AppData\Local\Apple
2014-05-29 12:48 . 2014-05-29 20:11 26624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-05-29 12:48 . 2014-05-29 12:48 -------- d-----w- c:\programdata\RogueKiller
2014-05-28 15:33 . 2014-05-28 15:33 -------- d-----w- c:\windows\system32\MpEngineStore
2014-05-28 15:14 . 2010-08-30 06:34 536576 ----a-w- c:\windows\system32\sqlite3.dll
2014-05-28 15:11 . 2014-05-28 15:11 -------- d-----w- c:\users\šalomoun\AppData\Local\Ahead
2014-05-28 14:36 . 2014-05-28 14:36 -------- d-----w- c:\users\šalomoun\AppData\Local\Diagnostics
2014-05-28 12:11 . 2014-05-28 12:11 -------- d-----w- c:\windows\ERUNT
2014-05-28 11:29 . 2014-05-28 11:29 -------- d-----w- c:\programdata\Malwarebytes
2014-05-06 09:57 . 2014-05-06 09:57 -------- d-----w- c:\program files\Geeks3D
2014-05-06 09:47 . 2014-05-28 14:42 -------- d-----w- c:\users\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-21 13:42 . 2012-07-23 14:03 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-21 13:42 . 2012-07-23 14:03 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-30 23:37 . 2012-07-19 14:03 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-04-27 11:25 . 2014-04-26 07:52 139112 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2014-04-27 11:25 . 2014-04-26 07:51 280792 ----a-w- c:\windows\system32\PnkBstrB.exe
2014-04-27 11:25 . 2013-05-15 15:09 280792 ----a-w- c:\windows\system32\PnkBstrB.xtr
2014-04-27 11:22 . 2014-04-26 07:51 280856 ----a-w- c:\windows\system32\PnkBstrB.ex0
2014-04-26 07:53 . 2014-04-26 07:51 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2014-04-09 16:10 . 2012-07-23 14:24 1110 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2014-04-06 18:16 . 2014-04-06 18:16 243128 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2014-04-05 19:30 . 2012-08-01 13:19 320120 ----a-w- c:\windows\system32\drivers\sptd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]
"Steam"="c:\program files\Steam\steam.exe" [2014-05-27 1775808]
"Mobile Partner"="c:\program files\HiSuite\HiSuite.exe" [2013-05-15 579904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-08-27 1028896]
"mncxdnhSrv"="c:\windows\inf\mncxdnh.vbe" [2014-01-19 1342]
.
c:\users\šalomoun\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2012-7-31 625952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2010-06-23 21:07 1699128 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.autoupdate]
2013-05-16 13:25 1062472 ----a-w- c:\users\šalomoun\AppData\Roaming\Seznam.cz\szninstall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.szndesktop]
2013-04-12 08:10 92664 ----a-w- c:\users\šalomoun\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-09 16:53 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
R2 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist.exe [2012-09-20 136648]
R2 HiSuiteOuc.exe;HiSuiteOuc.exe;c:\programdata\HiSuiteOuc\HiSuiteOuc.exe [2013-07-11 116032]
R2 HuaweiHiSuiteService.exe;HuaweiHiSuiteService.exe;c:\programdata\HandSetService\HuaweiHiSuiteService.exe [2013-05-02 158208]
R2 Util DiVapton;Util DiVapton;c:\program files\DiVapton\bin\utilDiVapton.exe [x]
R3 cpuz135;cpuz135;c:\users\ALOMOU~1\AppData\Local\Temp\cpuz135\cpuz135_x32.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-02 1343400]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-04-06 243128]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\AMD\OverDrive\i386\AODDriver2.sys [2012-09-20 48296]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-08-27 14573856]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-09-12 414496]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2013-08-20 33568]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2014-05-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-23 13:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
TCP: Interfaces\{42ACFE0C-F9D0-490D-815E-98B0187928FA}: NameServer = 172.16.0.1
TCP: Interfaces\{EE928C34-4B07-41BE-A09A-893F11660DF4}: NameServer = 172.16.0.1
FF - ProfilePath - c:\users\šalomoun\AppData\Roaming\Mozilla\Firefox\Profiles\h4pr3j9e.default\
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1830440610-1908763506-3238583907-1000\Software\SecuROM\License information*]
"datasecu"=hex:d0,09,4d,fa,40,3c,61,45,2a,7a,2e,7a,c0,bc,ba,49,20,1c,39,c1,a2,
f4,d3,26,e4,4d,99,88,63,26,ca,fb,a1,2e,19,bf,66,06,5c,94,93,4e,41,f0,76,44,\
"rkeysecu"=hex:5c,0f,6e,1a,2b,66,5f,ac,89,57,ae,90,a8,d8,d1,77
.
Celkový čas: 2014-05-30 23:51:20
ComboFix-quarantined-files.txt 2014-05-30 21:51
ComboFix2.txt 2014-05-30 21:38
ComboFix3.txt 2014-05-30 14:13
.
Před spuštěním: Volných bajtů: 25 071 362 048
Po spuštění: Volných bajtů: 25 011 601 408
.
- - End Of File - - E56618DCD8AEA6BE3397ED0C7AE3A4D6
A36C5E4F47E84449FF07ED3517B43A31

[Aurelius]

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2014-05-30 23:53:27
-----------------------------
23:53:27.476 OS Version: Windows 6.1.7601 Service Pack 1
23:53:27.476 Number of processors: 2 586 0x603
23:53:27.476 ComputerName: ŠALOMOUN-PC UserName: šalomoun
23:53:30.331 Initialize success
23:53:37.969 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
23:53:37.969 Disk 0 Vendor: ST3320413AS JC45 Size: 146585MB BusType: 3
23:53:37.984 Disk 0 MBR read successfully
23:53:38.000 Disk 0 MBR scan
23:53:38.000 Disk 0 Windows 7 default MBR code
23:53:38.015 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 146577 MB offset 63
23:53:38.015 Disk 0 scanning sectors +300190590
23:53:38.062 Disk 0 scanning C:\Windows\system32\drivers
23:53:44.271 Service scanning
23:53:48.499 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
23:53:55.004 Modules scanning
23:54:10.729 Disk 0 trace - called modules:
23:54:10.744 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x850621f8]<<
23:54:10.760 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85e6ea78]
23:54:11.275 3 CLASSPNP.SYS[8963a59e] -> nt!IofCallDriver -> [0x85d4a938]
23:54:11.290 5 ACPI.sys[88efe3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x850aa908]
23:54:11.306 \Driver\atapi[0x85d7eb78] -> IRP_MJ_CREATE -> 0x850621f8
23:54:11.321 Scan finished successfully
23:55:43.970 Disk 0 MBR has been saved successfully to "C:\Users\šalomoun\Desktop\MBR.dat"
23:55:43.970 The log file has been saved successfully to "C:\Users\šalomoun\Desktop\aswMBR.txt"

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

KillAll::
File::
c:\windows\inf\mncxdnh.vbe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mncxdnhSrv"=-


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[Aurelius]

ComboFix 14-05-29.01 - šalomoun 31.05.2014 10:29:40.4.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2047.1317 [GMT 2:00]
Spuštěný z: c:\users\Üalomoun\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Üalomoun\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-04-28 do 2014-05-31 )))))))))))))))))))))))))))))))
.
.
2014-05-31 08:35 . 2014-05-31 08:35 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-05-31 08:35 . 2014-05-31 08:35 -------- d-----w- c:\users\hedev\AppData\Local\temp
2014-05-31 08:35 . 2014-05-31 08:35 -------- d-----w- c:\users\Guest\AppData\Local\temp
2014-05-31 08:35 . 2014-05-31 08:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-31 08:35 . 2014-05-31 08:35 -------- d-----w- c:\users\çalomoun\AppData\Local\temp
2014-05-31 08:35 . 2014-05-31 08:35 -------- d-----w- c:\users\aalomoun\AppData\Local\temp
2014-05-31 06:19 . 2014-05-31 06:19 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9E08A78A-1C2E-4D3C-AF99-0D78394D604B}\offreg.dll
2014-05-30 22:03 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9E08A78A-1C2E-4D3C-AF99-0D78394D604B}\mpengine.dll
2014-05-30 17:22 . 2014-05-30 17:22 -------- d-----w- c:\program files\EA Sports
2014-05-30 16:07 . 2014-05-30 16:07 -------- d-----w- c:\users\šalomoun\AppData\Local\CrashDumps
2014-05-30 13:59 . 2014-05-30 13:59 -------- d-----w- c:\users\šalomoun\AppData\Local\Apple
2014-05-29 12:48 . 2014-05-29 20:11 26624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-05-29 12:48 . 2014-05-29 12:48 -------- d-----w- c:\programdata\RogueKiller
2014-05-28 15:33 . 2014-05-28 15:33 -------- d-----w- c:\windows\system32\MpEngineStore
2014-05-28 15:14 . 2010-08-30 06:34 536576 ----a-w- c:\windows\system32\sqlite3.dll
2014-05-28 15:11 . 2014-05-28 15:11 -------- d-----w- c:\users\šalomoun\AppData\Local\Ahead
2014-05-28 14:36 . 2014-05-28 14:36 -------- d-----w- c:\users\šalomoun\AppData\Local\Diagnostics
2014-05-28 12:11 . 2014-05-28 12:11 -------- d-----w- c:\windows\ERUNT
2014-05-28 11:29 . 2014-05-28 11:29 -------- d-----w- c:\programdata\Malwarebytes
2014-05-06 09:57 . 2014-05-06 09:57 -------- d-----w- c:\program files\Geeks3D
2014-05-06 09:47 . 2014-05-28 14:42 -------- d-----w- c:\users\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-21 13:42 . 2012-07-23 14:03 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-21 13:42 . 2012-07-23 14:03 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-30 23:37 . 2012-07-19 14:03 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-04-27 11:25 . 2014-04-26 07:52 139112 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2014-04-27 11:25 . 2014-04-26 07:51 280792 ----a-w- c:\windows\system32\PnkBstrB.exe
2014-04-27 11:25 . 2013-05-15 15:09 280792 ----a-w- c:\windows\system32\PnkBstrB.xtr
2014-04-27 11:22 . 2014-04-26 07:51 280856 ----a-w- c:\windows\system32\PnkBstrB.ex0
2014-04-26 07:53 . 2014-04-26 07:51 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2014-04-09 16:10 . 2012-07-23 14:24 1110 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2014-04-06 18:16 . 2014-04-06 18:16 243128 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2014-04-05 19:30 . 2012-08-01 13:19 320120 ----a-w- c:\windows\system32\drivers\sptd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]
"Steam"="c:\program files\Steam\steam.exe" [2014-05-27 1775808]
"Mobile Partner"="c:\program files\HiSuite\HiSuite.exe" [2013-05-15 579904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-08-27 1028896]
"mncxdnhSrv"="c:\windows\inf\mncxdnh.vbe" [2014-01-19 1342]
.
c:\users\šalomoun\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2012-7-31 625952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2010-06-23 21:07 1699128 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.autoupdate]
2013-05-16 13:25 1062472 ----a-w- c:\users\šalomoun\AppData\Roaming\Seznam.cz\szninstall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.szndesktop]
2013-04-12 08:10 92664 ----a-w- c:\users\šalomoun\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-09 16:53 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
R2 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist.exe [2012-09-20 136648]
R2 HiSuiteOuc.exe;HiSuiteOuc.exe;c:\programdata\HiSuiteOuc\HiSuiteOuc.exe [2013-07-11 116032]
R2 HuaweiHiSuiteService.exe;HuaweiHiSuiteService.exe;c:\programdata\HandSetService\HuaweiHiSuiteService.exe [2013-05-02 158208]
R2 Util DiVapton;Util DiVapton;c:\program files\DiVapton\bin\utilDiVapton.exe [x]
R3 cpuz135;cpuz135;c:\users\ALOMOU~1\AppData\Local\Temp\cpuz135\cpuz135_x32.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-02 1343400]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-04-06 243128]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\AMD\OverDrive\i386\AODDriver2.sys [2012-09-20 48296]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-08-27 14573856]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-09-12 414496]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2013-08-20 33568]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2014-05-31 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-23 13:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
TCP: Interfaces\{42ACFE0C-F9D0-490D-815E-98B0187928FA}: NameServer = 172.16.0.1
TCP: Interfaces\{EE928C34-4B07-41BE-A09A-893F11660DF4}: NameServer = 172.16.0.1
FF - ProfilePath - c:\users\šalomoun\AppData\Roaming\Mozilla\Firefox\Profiles\h4pr3j9e.default\
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1830440610-1908763506-3238583907-1000\Software\SecuROM\License information*]
"datasecu"=hex:d0,09,4d,fa,40,3c,61,45,2a,7a,2e,7a,c0,bc,ba,49,20,1c,39,c1,a2,
f4,d3,26,e4,4d,99,88,63,26,ca,fb,a1,2e,19,bf,66,06,5c,94,93,4e,41,f0,76,44,\
"rkeysecu"=hex:5c,0f,6e,1a,2b,66,5f,ac,89,57,ae,90,a8,d8,d1,77
.
Celkový čas: 2014-05-31 10:36:24
ComboFix-quarantined-files.txt 2014-05-31 08:36
ComboFix2.txt 2014-05-30 21:51
ComboFix3.txt 2014-05-30 21:38
ComboFix4.txt 2014-05-30 14:13
.
Před spuštěním: Volných bajtů: 28 097 490 944
Po spuštění: Volných bajtů: 28 046 827 520
.
- - End Of File - - DB9F44A502EF0D394AB0069D675BE9BF
A36C5E4F47E84449FF07ED3517B43A31

[Aurelius]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:47:39, on 31.5.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\šalomoun\Downloads\HiJackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Nvtmru] "C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
O4 - HKLM\..\Run: [mncxdnhSrv] C:\Windows\inf\mncxdnh.vbe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [Mobile Partner] C:\Program Files\HiSuite\HiSuite.exe -s
O4 - HKUS\S-1-5-21-1830440610-1908763506-3238583907-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1830440610-1908763506-3238583907-1001\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office15\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - http://content.systemrequirementslab.co ... .5.1.0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42ACFE0C-F9D0-490D-815E-98B0187928FA}: NameServer = 172.16.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE928C34-4B07-41BE-A09A-893F11660DF4}: NameServer = 172.16.0.1
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AODService - Unknown owner - C:\Program Files\AMD\OverDrive\AODAssist.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: HiSuiteOuc.exe - Unknown owner - C:\ProgramData\HiSuiteOuc\HiSuiteOuc.exe
O23 - Service: HuaweiHiSuiteService.exe - Unknown owner - C:\ProgramData\HandSetService\HuaweiHiSuiteService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Util DiVapton - Unknown owner - C:\Program Files\DiVapton\bin\utilDiVapton.exe (file missing)

--
End of file - 5219 bytes

[Aurelius]

Jak prosím pokračovat ?

[jaro3]

Ten script v Combofixu udělej znovu v nouz. režimu.

[Aurelius]

ComboFix 14-05-29.01 - šalomoun 01.06.2014 11:09:35.6.2 - x86 MINIMAL
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2047.1079 [GMT 2:00]
Spuštěný z: c:\users\šalomoun\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\šalomoun\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\inf\mncxdnh.vbe"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-05-01 do 2014-06-01 )))))))))))))))))))))))))))))))
.
.
2014-06-01 09:15 . 2014-06-01 09:15 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-06-01 09:15 . 2014-06-01 09:15 -------- d-----w- c:\users\Guest\AppData\Local\temp
2014-06-01 09:15 . 2014-06-01 09:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-01 09:00 . 2014-06-01 09:00 -------- d-----w- c:\users\šalomoun\AppData\Local\Ahead
2014-06-01 08:30 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B4B141FC-E627-460E-B46F-337AFFF821B3}\mpengine.dll
2014-05-31 13:16 . 2014-05-31 13:16 -------- d-----w- c:\program files\Defraggler
2014-05-31 13:14 . 2014-05-31 13:54 -------- d-----w- c:\program files\Google
2014-05-30 17:22 . 2014-05-31 12:53 -------- d-----w- c:\program files\EA Sports
2014-05-29 12:48 . 2014-05-29 20:11 26624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-05-29 12:48 . 2014-05-29 12:48 -------- d-----w- c:\programdata\RogueKiller
2014-05-28 15:33 . 2014-05-28 15:33 -------- d-----w- c:\windows\system32\MpEngineStore
2014-05-28 15:14 . 2010-08-30 06:34 536576 ----a-w- c:\windows\system32\sqlite3.dll
2014-05-28 14:36 . 2014-05-28 14:36 -------- d-----w- c:\users\šalomoun\AppData\Local\Diagnostics
2014-05-28 12:11 . 2014-05-28 12:11 -------- d-----w- c:\windows\ERUNT
2014-05-28 11:29 . 2014-05-28 11:29 -------- d-----w- c:\programdata\Malwarebytes
2014-05-06 09:57 . 2014-05-06 09:57 -------- d-----w- c:\program files\Geeks3D
2014-05-06 09:47 . 2014-05-28 14:42 -------- d-----w- c:\users\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-31 09:49 . 2014-04-26 07:52 139112 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2014-05-31 09:49 . 2014-04-26 07:51 280792 ----a-w- c:\windows\system32\PnkBstrB.exe
2014-05-31 09:49 . 2013-05-15 15:09 280792 ----a-w- c:\windows\system32\PnkBstrB.xtr
2014-05-31 09:46 . 2014-04-26 07:51 280856 ----a-w- c:\windows\system32\PnkBstrB.ex0
2014-05-21 13:42 . 2012-07-23 14:03 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-21 13:42 . 2012-07-23 14:03 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-30 23:37 . 2012-07-19 14:03 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-04-26 07:53 . 2014-04-26 07:51 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2014-04-09 16:10 . 2012-07-23 14:24 1110 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2014-04-06 18:16 . 2014-04-06 18:16 243128 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2014-04-05 19:30 . 2012-08-01 13:19 320120 ----a-w- c:\windows\system32\drivers\sptd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]
"Steam"="c:\program files\Steam\steam.exe" [2014-05-29 1754816]
"Mobile Partner"="c:\program files\HiSuite\HiSuite.exe" [2013-05-15 579904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-08-27 1028896]
.
c:\users\šalomoun\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2012-7-31 625952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2010-06-23 21:07 1699128 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.autoupdate]
2013-05-16 13:25 1062472 ----a-w- c:\users\šalomoun\AppData\Roaming\Seznam.cz\szninstall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.szndesktop]
2013-04-12 08:10 92664 ----a-w- c:\users\šalomoun\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-09 16:53 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
R2 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist.exe [2012-09-20 136648]
R2 Util DiVapton;Util DiVapton;c:\program files\DiVapton\bin\utilDiVapton.exe [x]
R3 cpuz135;cpuz135;c:\users\ALOMOU~1\AppData\Local\Temp\cpuz135\cpuz135_x32.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-02 1343400]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-04-06 243128]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\AMD\OverDrive\i386\AODDriver2.sys [2012-09-20 48296]
S2 HiSuiteOuc.exe;HiSuiteOuc.exe;c:\programdata\HiSuiteOuc\HiSuiteOuc.exe [2013-07-11 116032]
S2 HuaweiHiSuiteService.exe;HuaweiHiSuiteService.exe;c:\programdata\HandSetService\HuaweiHiSuiteService.exe [2013-05-02 158208]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-08-27 14573856]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-09-12 414496]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2013-08-20 33568]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2014-06-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-23 13:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
TCP: Interfaces\{42ACFE0C-F9D0-490D-815E-98B0187928FA}: NameServer = 172.16.0.1
TCP: Interfaces\{EE928C34-4B07-41BE-A09A-893F11660DF4}: NameServer = 172.16.0.1
FF - ProfilePath - c:\users\šalomoun\AppData\Roaming\Mozilla\Firefox\Profiles\h4pr3j9e.default\
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1830440610-1908763506-3238583907-1000\Software\SecuROM\License information*]
"datasecu"=hex:d0,09,4d,fa,40,3c,61,45,2a,7a,2e,7a,c0,bc,ba,49,20,1c,39,c1,a2,
f4,d3,26,e4,4d,99,88,63,26,ca,fb,a1,2e,19,bf,66,06,5c,94,93,4e,41,f0,76,44,\
"rkeysecu"=hex:5c,0f,6e,1a,2b,66,5f,ac,89,57,ae,90,a8,d8,d1,77
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\rundll32.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2014-06-01 11:19:09 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-06-01 09:19
ComboFix2.txt 2014-05-31 08:36
ComboFix3.txt 2014-05-30 21:51
ComboFix4.txt 2014-05-30 21:38
ComboFix5.txt 2014-05-31 20:56
.
Před spuštěním: Volných bajtů: 35 174 199 296
Po spuštění: Volných bajtů: 34 724 687 872
.
- - End Of File - - 37A0AB6BA5E17B28378A81D0C88B44F0
A36C5E4F47E84449FF07ED3517B43A31

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mncxdnhSrv] C:\Windows\inf\mncxdnh.vbe

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.

Co problémy?

[Aurelius]

Děkuji je to o dost lepší ale todle nemám HJT O4 - HKLM\..\Run: [mncxdnhSrv] C:\Windows\inf\mncxdnh.vbe. A ještě bych se chtěl optat jestli by nějak šlo uknčit nějaké zbytečné procesy po zapnutí mám jich těd 39 a hodně je jich zbytečných si myslím tak se chci optat jestli by to nějak šlo ukončit.Děkuji