aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2015-10-24 22:01:21
-----------------------------
22:01:21.657 OS Version: Windows 6.1.7601 Service Pack 1
22:01:21.657 Number of processors: 2 586 0x209
22:01:21.672 ComputerName: DOMA-PC UserName: Doma
22:01:33.016 Initialize success
22:01:33.079 VM: initialized successfully
22:01:33.079 VM: Intel CPU virtualization not supported
22:01:55.487 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
22:01:55.502 Disk 0 Vendor: Maxtor_6L300S0 BANC1G10 Size: 286188MB BusType: 3
22:01:55.518 Disk 0 MBR read successfully
22:01:55.534 Disk 0 MBR scan
22:01:55.534 Disk 0 Windows 7 default MBR code
22:01:55.549 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 275946 MB offset 20973568
22:01:55.565 Disk 0 Boot: NTFS code=2
22:01:55.581 Disk 0 scanning sectors +586110976
22:01:55.627 Disk 0 scanning C:\Windows\system32\drivers
22:02:00.471 Service scanning
22:02:02.893 Service ehdrv C:\Windows\system32\DRIVERS\ehdrv.sys **LOCKED** 5
22:02:03.643 Service epfw C:\Windows\system32\DRIVERS\epfw.sys **LOCKED** 5
22:02:04.206 Service epfwwfpr C:\Windows\system32\DRIVERS\epfwwfpr.sys **LOCKED** 5
22:02:09.409 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
22:02:12.002 Modules scanning
22:02:12.002 Disk 0 trace - called modules:
22:02:12.034 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x850741f8]<<
22:02:12.034 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85eb93e8]
22:02:12.049 3 CLASSPNP.SYS[8a28859e] -> nt!IofCallDriver -> [0x85d81020]
22:02:12.065 5 ACPI.sys[89b0e3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0x85d7a908]
22:02:12.081 \Driver\atapi[0x85d76e08] -> IRP_MJ_CREATE -> 0x850741f8
22:02:12.096 Disk 0 statistics 80485/0/0 @ 10,11 MB/s
22:02:12.096 Scan finished successfully
22:02:22.596 Disk 0 MBR has been saved successfully to "C:\Users\Doma\Desktop\MBR.dat"
22:02:22.627 The log file has been saved successfully to "C:\Users\Doma\Desktop\aswMBR.txt"
Prosím o kontrolu logu Vyřešeno
- jerabina
- člen Security týmu
-
Level 6
- Příspěvky: 3647
- Registrován: březen 13
- Bydliště: Litoměřice
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť:

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Kód: Vybrat vše
ClearJavaCache::
KillAll::
Folder::
c:\programdata\RogueKiller
D:\PROGRAMY\freeram
File::
c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
DDS::
FF - prefs.js: browser.startup.homepage - about:home
RegLock::
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ce,96,30,2f,a1,e7,75,08,4c,6b,20,7b,05,b2,af,59,33,82,58,67,27,6c,38,
ac,5e,9f,e3,27,2e,96,fd,3b,57,b6,d0,de,81,5b,40,f4,95,80,aa,7a,00,86,9f,8d,\
"??"=hex:32,79,a3,96,1a,67,22,7f,6c,8c,a9,49,2e,1e,a5,7e
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\License information*]
"datasecu"=hex:9e,4c,27,28,ea,b6,cd,62,a1,be,8a,bd,fd,e1,af,4d,55,79,d5,0e,20,
6d,63,5f,65,43,8c,95,b4,3c,62,18,2c,fc,83,ee,5a,47,15,23,71,17,fd,3d,2b,de,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť:
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Re: Prosím o kontrolu logu
ComboFix 15-10-23.01 - Doma 24.10.2015 23:36:40.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2048.1567 [GMT 2:00]
Spuštěný z: c:\users\Doma\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Doma\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\RogueKiller
c:\programdata\RogueKiller\config.ini
c:\programdata\RogueKiller\Logs\RKreport_DEL_10242015_170804.json
c:\programdata\RogueKiller\Logs\RKreport_SCN_10202015_232139.json
c:\programdata\RogueKiller\Logs\RKreport_SCN_10242015_170716.json
c:\programdata\RogueKiller\vt.cache
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-24 do 2015-10-24 )))))))))))))))))))))))))))))))
.
.
2015-10-24 21:50 . 2015-10-24 21:53 -------- d-----w- c:\users\Doma\AppData\Local\temp
2015-10-24 21:50 . 2015-10-24 21:50 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-10-24 15:49 . 2015-10-24 15:11 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-24 15:10 . 2015-10-24 15:46 -------- d-----w- C:\zoek_backup
2015-10-24 14:56 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{87499880-6ABE-47DA-AECE-F9B8A5AE57E7}\mpengine.dll
2015-10-23 01:06 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-10-21 00:38 . 2015-10-21 00:38 -------- d-----w- c:\users\Doma\AppData\Local\CrashDumps
2015-10-21 00:00 . 2015-10-21 00:00 -------- d-----w- c:\users\Doma\AppData\Local\Adobe
2015-10-20 21:01 . 2015-10-24 14:47 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-20 19:13 . 2015-10-24 15:28 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-20 19:11 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-20 19:11 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-20 19:11 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-20 19:11 . 2015-10-20 19:12 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-20 19:11 . 2015-10-20 19:11 -------- d-----w- c:\programdata\Malwarebytes
2015-10-19 21:06 . 2015-10-19 21:07 -------- d-----w- c:\program files\Microsoft Silverlight
2015-10-19 17:27 . 2015-10-19 17:27 -------- d-----w- c:\users\Doma\AppData\Roaming\InstallShield
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82609FA-2FC6-40F8-B3F2-38C868E0CA44}\gapaengine.dll
2015-10-13 01:32 . 2015-07-30 13:13 103120 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-10 14:01 . 2015-10-10 14:01 -------- d-----w- c:\windows\Panther
2015-10-10 05:29 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2015-10-10 05:28 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2015-10-10 05:27 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2015-10-10 05:27 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-10-10 05:18 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2015-10-10 05:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2015-10-10 03:03 . 2015-10-10 03:03 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2015-10-10 00:38 . 2015-10-10 00:38 640512 ----a-w- c:\windows\system32\advapi32.dll
2015-10-10 00:38 . 2015-10-10 00:38 619520 ----a-w- c:\windows\system32\tdh.dll
2015-10-10 00:35 . 2015-10-10 00:35 231424 ----a-w- c:\windows\system32\mswsock.dll
2015-10-10 00:32 . 2015-10-10 00:32 49152 ----a-w- c:\windows\system32\taskhost.exe
2015-10-10 00:04 . 2015-10-10 00:04 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2015-10-10 00:04 . 2015-10-10 00:04 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2015-10-09 23:51 . 2015-10-09 23:51 1505280 ----a-w- c:\windows\system32\d3d11.dll
2015-10-09 19:45 . 2013-07-03 04:02 36352 ----a-w- c:\windows\system32\drivers\usbscan.sys
2015-10-09 19:45 . 2013-07-03 03:36 55808 ----a-w- c:\windows\system32\drivers\hidclass.sys
2015-10-09 19:45 . 2013-07-03 03:36 25728 ----a-w- c:\windows\system32\drivers\hidparse.sys
2015-10-09 19:45 . 2014-10-18 01:33 571904 ----a-w- c:\windows\system32\oleaut32.dll
2015-10-09 19:44 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2015-10-09 19:44 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2015-10-09 19:36 . 2015-07-01 20:30 206848 ----a-w- c:\windows\system32\WebClnt.dll
2015-10-09 19:36 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll
2015-10-09 19:36 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll
2015-10-09 19:35 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\system32\mstscax.dll
2015-10-09 19:35 . 2015-07-10 17:33 131584 ----a-w- c:\windows\system32\aaclient.dll
2015-10-09 19:35 . 2015-07-10 17:34 36864 ----a-w- c:\windows\system32\tsgqec.dll
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\system32\notepad.exe
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\notepad.exe
2015-10-09 19:28 . 2015-08-05 17:41 751104 ----a-w- c:\windows\system32\schedsvc.dll
2015-10-09 19:27 . 2014-11-11 02:44 186880 ----a-w- c:\windows\system32\pku2u.dll
2015-10-09 19:25 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\system32\msi.dll
2015-10-09 19:25 . 2015-06-15 21:43 1805824 ----a-w- c:\windows\system32\authui.dll
2015-10-09 19:25 . 2015-06-15 21:47 101824 ----a-w- c:\windows\system32\consent.exe
2015-10-09 19:25 . 2015-06-15 21:43 337408 ----a-w- c:\windows\system32\msihnd.dll
2015-10-09 19:25 . 2015-06-15 21:43 47104 ----a-w- c:\windows\system32\appinfo.dll
2015-10-09 19:25 . 2015-06-15 21:42 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-10-09 19:25 . 2015-06-15 21:37 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-10-09 19:23 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2015-10-09 19:23 . 2014-06-16 01:44 730048 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2015-10-09 19:23 . 2014-06-16 01:44 219072 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2015-10-09 19:23 . 2014-06-16 01:40 107520 ----a-w- c:\windows\system32\cdd.dll
2015-10-09 19:23 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2015-10-09 19:23 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2015-10-09 19:23 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2015-10-09 19:19 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2015-10-09 19:19 . 2011-03-03 05:36 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2015-10-09 19:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2015-10-09 19:15 . 2014-03-04 09:17 538112 ----a-w- c:\windows\system32\objsel.dll
2015-10-09 19:15 . 2014-03-04 09:17 36864 ----a-w- c:\windows\system32\dimsroam.dll
2015-10-09 19:15 . 2014-03-04 09:17 51200 ----a-w- c:\windows\system32\cngprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 49664 ----a-w- c:\windows\system32\adprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 48128 ----a-w- c:\windows\system32\capiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 47616 ----a-w- c:\windows\system32\dpapiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 35328 ----a-w- c:\windows\system32\wincredprovider.dll
2015-10-09 19:13 . 2014-08-12 01:36 701440 ----a-w- c:\windows\system32\IMJP10K.DLL
2015-10-09 19:13 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll
2015-10-09 19:12 . 2015-02-25 03:03 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-10-09 19:12 . 2012-11-28 22:57 9728 ----a-w- c:\windows\system32\Wdfres.dll
2015-10-09 19:12 . 2012-11-28 22:57 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2015-10-09 19:12 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2015-10-09 19:12 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2015-10-09 19:12 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2015-10-09 19:12 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2015-10-09 19:12 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2015-10-09 19:11 . 2015-02-18 07:06 123904 ----a-w- c:\windows\system32\poqexec.exe
2015-10-09 19:10 . 2015-04-29 18:06 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2015-10-09 19:10 . 2015-04-29 18:06 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2015-10-09 19:10 . 2015-04-29 18:07 8192 ----a-w- c:\windows\system32\spwmp.dll
2015-10-09 19:10 . 2015-04-29 18:06 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-10-09 19:10 . 2015-04-29 18:05 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2015-10-09 19:06 . 2014-04-25 02:06 626688 ----a-w- c:\windows\system32\usp10.dll
2015-10-09 19:06 . 2015-06-17 17:39 305664 ----a-w- c:\windows\system32\gdi32.dll
2015-10-09 19:06 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll
2015-10-09 19:06 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll
2015-10-09 19:05 . 2015-06-03 20:17 370488 ----a-w- c:\windows\system32\drivers\cng.sys
2015-10-09 19:05 . 2015-07-15 02:55 44032 ----a-w- c:\windows\system32\basesrv.dll
2015-10-09 19:03 . 2014-12-06 03:50 242688 ----a-w- c:\windows\system32\nlasvc.dll
2015-10-09 19:03 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2015-10-09 19:03 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2015-10-09 19:03 . 2015-07-15 02:55 1390592 ----a-w- c:\windows\system32\msxml6.dll
2015-10-09 19:03 . 2015-07-15 02:55 1241088 ----a-w- c:\windows\system32\msxml3.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-10-09 18:58 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2015-10-09 18:58 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2015-10-09 18:54 . 2014-06-06 09:44 509440 ----a-w- c:\windows\system32\qedit.dll
2015-10-09 18:53 . 2014-04-05 02:25 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2015-10-09 18:53 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2015-10-09 18:53 . 2014-04-05 02:24 187840 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2015-10-09 18:52 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
2015-10-09 18:52 . 2011-08-17 04:19 75776 ----a-w- c:\windows\system32\psisrndr.ax
2015-10-09 18:51 . 2013-04-26 04:55 492544 ----a-w- c:\windows\system32\win32spl.dll
2015-10-09 18:51 . 2015-04-13 03:19 259072 ----a-w- c:\windows\system32\services.exe
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-20 21:27 . 2014-10-25 19:33 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2015-10-20 21:27 . 2015-09-21 18:17 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2015-10-10 00:44 . 2015-10-10 00:44 208384 ----a-w- c:\windows\system32\webcheck.dll
2004-12-15 12:27 . 2004-12-15 12:27 591360 ----a-r- c:\program files\MasterTime.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2015-07-08 5089480]
"GLDStart"="c:\program files\GLDirect\gldirect.exe" [2004-07-20 241664]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 981688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
R1 vwujiale;vwujiale;c:\windows\system32\drivers\vwujiale.sys [x]
R1 xfbvwiuu;xfbvwiuu;c:\windows\system32\drivers\xfbvwiuu.sys [x]
R2 caMyciloP;caMyciloP; [x]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-10 102912]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-10-24 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 95408]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2015-04-29 284504]
R3 OSFMount;OSFMount;c:\hry\Counter-Strike Global Offensive\image\x86\OSFMount.sys [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files\Overwolf\OverwolfUpdater.exe [2015-09-29 1006320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 pmfilt;pmfilt;c:\windows\system32\drivers\pmfilt.sys [2004-07-20 10112]
S0 pmhelp;pmhelp;c:\windows\system32\drivers\pmhelp.sys [2004-07-20 50464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-06-11 691696]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2015-07-14 202704]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2015-07-14 144536]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2015-07-08 1353720]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2015-07-14 132152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2015-10-24 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe [2015-10-24 14:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\m78v8gr7.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ce,96,30,2f,a1,e7,75,08,4c,6b,20,7b,05,b2,af,59,33,82,58,67,27,6c,38,
ac,5e,9f,e3,27,2e,96,fd,3b,57,b6,d0,de,81,5b,40,f4,95,80,aa,7a,00,86,9f,8d,\
"??"=hex:32,79,a3,96,1a,67,22,7f,6c,8c,a9,49,2e,1e,a5,7e
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\License information*]
"datasecu"=hex:9e,4c,27,28,ea,b6,cd,62,a1,be,8a,bd,fd,e1,af,4d,55,79,d5,0e,20,
6d,63,5f,65,43,8c,95,b4,3c,62,18,2c,fc,83,ee,5a,47,15,23,71,17,fd,3d,2b,de,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\windows\soundman.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2015-10-24 23:57:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-10-24 21:57
ComboFix2.txt 2015-10-24 19:57
.
Před spuštěním: Volných bajtů: 43 809 312 768
Po spuštění: Volných bajtů: 43 783 553 024
.
- - End Of File - - 6E9EBDBC7F31A9DD4084903ABC4F69A3
A36C5E4F47E84449FF07ED3517B43A31
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2048.1567 [GMT 2:00]
Spuštěný z: c:\users\Doma\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Doma\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\RogueKiller
c:\programdata\RogueKiller\config.ini
c:\programdata\RogueKiller\Logs\RKreport_DEL_10242015_170804.json
c:\programdata\RogueKiller\Logs\RKreport_SCN_10202015_232139.json
c:\programdata\RogueKiller\Logs\RKreport_SCN_10242015_170716.json
c:\programdata\RogueKiller\vt.cache
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-24 do 2015-10-24 )))))))))))))))))))))))))))))))
.
.
2015-10-24 21:50 . 2015-10-24 21:53 -------- d-----w- c:\users\Doma\AppData\Local\temp
2015-10-24 21:50 . 2015-10-24 21:50 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-10-24 15:49 . 2015-10-24 15:11 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-24 15:10 . 2015-10-24 15:46 -------- d-----w- C:\zoek_backup
2015-10-24 14:56 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{87499880-6ABE-47DA-AECE-F9B8A5AE57E7}\mpengine.dll
2015-10-23 01:06 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-10-21 00:38 . 2015-10-21 00:38 -------- d-----w- c:\users\Doma\AppData\Local\CrashDumps
2015-10-21 00:00 . 2015-10-21 00:00 -------- d-----w- c:\users\Doma\AppData\Local\Adobe
2015-10-20 21:01 . 2015-10-24 14:47 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-20 19:13 . 2015-10-24 15:28 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-20 19:11 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-20 19:11 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-20 19:11 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-20 19:11 . 2015-10-20 19:12 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-20 19:11 . 2015-10-20 19:11 -------- d-----w- c:\programdata\Malwarebytes
2015-10-19 21:06 . 2015-10-19 21:07 -------- d-----w- c:\program files\Microsoft Silverlight
2015-10-19 17:27 . 2015-10-19 17:27 -------- d-----w- c:\users\Doma\AppData\Roaming\InstallShield
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82609FA-2FC6-40F8-B3F2-38C868E0CA44}\gapaengine.dll
2015-10-13 01:32 . 2015-07-30 13:13 103120 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-10 14:01 . 2015-10-10 14:01 -------- d-----w- c:\windows\Panther
2015-10-10 05:29 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2015-10-10 05:28 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2015-10-10 05:27 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2015-10-10 05:27 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-10-10 05:18 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2015-10-10 05:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2015-10-10 03:03 . 2015-10-10 03:03 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2015-10-10 00:38 . 2015-10-10 00:38 640512 ----a-w- c:\windows\system32\advapi32.dll
2015-10-10 00:38 . 2015-10-10 00:38 619520 ----a-w- c:\windows\system32\tdh.dll
2015-10-10 00:35 . 2015-10-10 00:35 231424 ----a-w- c:\windows\system32\mswsock.dll
2015-10-10 00:32 . 2015-10-10 00:32 49152 ----a-w- c:\windows\system32\taskhost.exe
2015-10-10 00:04 . 2015-10-10 00:04 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2015-10-10 00:04 . 2015-10-10 00:04 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2015-10-09 23:51 . 2015-10-09 23:51 1505280 ----a-w- c:\windows\system32\d3d11.dll
2015-10-09 19:45 . 2013-07-03 04:02 36352 ----a-w- c:\windows\system32\drivers\usbscan.sys
2015-10-09 19:45 . 2013-07-03 03:36 55808 ----a-w- c:\windows\system32\drivers\hidclass.sys
2015-10-09 19:45 . 2013-07-03 03:36 25728 ----a-w- c:\windows\system32\drivers\hidparse.sys
2015-10-09 19:45 . 2014-10-18 01:33 571904 ----a-w- c:\windows\system32\oleaut32.dll
2015-10-09 19:44 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2015-10-09 19:44 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2015-10-09 19:36 . 2015-07-01 20:30 206848 ----a-w- c:\windows\system32\WebClnt.dll
2015-10-09 19:36 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll
2015-10-09 19:36 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll
2015-10-09 19:35 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\system32\mstscax.dll
2015-10-09 19:35 . 2015-07-10 17:33 131584 ----a-w- c:\windows\system32\aaclient.dll
2015-10-09 19:35 . 2015-07-10 17:34 36864 ----a-w- c:\windows\system32\tsgqec.dll
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\system32\notepad.exe
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\notepad.exe
2015-10-09 19:28 . 2015-08-05 17:41 751104 ----a-w- c:\windows\system32\schedsvc.dll
2015-10-09 19:27 . 2014-11-11 02:44 186880 ----a-w- c:\windows\system32\pku2u.dll
2015-10-09 19:25 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\system32\msi.dll
2015-10-09 19:25 . 2015-06-15 21:43 1805824 ----a-w- c:\windows\system32\authui.dll
2015-10-09 19:25 . 2015-06-15 21:47 101824 ----a-w- c:\windows\system32\consent.exe
2015-10-09 19:25 . 2015-06-15 21:43 337408 ----a-w- c:\windows\system32\msihnd.dll
2015-10-09 19:25 . 2015-06-15 21:43 47104 ----a-w- c:\windows\system32\appinfo.dll
2015-10-09 19:25 . 2015-06-15 21:42 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-10-09 19:25 . 2015-06-15 21:37 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-10-09 19:23 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2015-10-09 19:23 . 2014-06-16 01:44 730048 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2015-10-09 19:23 . 2014-06-16 01:44 219072 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2015-10-09 19:23 . 2014-06-16 01:40 107520 ----a-w- c:\windows\system32\cdd.dll
2015-10-09 19:23 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2015-10-09 19:23 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2015-10-09 19:23 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2015-10-09 19:19 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2015-10-09 19:19 . 2011-03-03 05:36 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2015-10-09 19:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2015-10-09 19:15 . 2014-03-04 09:17 538112 ----a-w- c:\windows\system32\objsel.dll
2015-10-09 19:15 . 2014-03-04 09:17 36864 ----a-w- c:\windows\system32\dimsroam.dll
2015-10-09 19:15 . 2014-03-04 09:17 51200 ----a-w- c:\windows\system32\cngprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 49664 ----a-w- c:\windows\system32\adprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 48128 ----a-w- c:\windows\system32\capiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 47616 ----a-w- c:\windows\system32\dpapiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 35328 ----a-w- c:\windows\system32\wincredprovider.dll
2015-10-09 19:13 . 2014-08-12 01:36 701440 ----a-w- c:\windows\system32\IMJP10K.DLL
2015-10-09 19:13 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll
2015-10-09 19:12 . 2015-02-25 03:03 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-10-09 19:12 . 2012-11-28 22:57 9728 ----a-w- c:\windows\system32\Wdfres.dll
2015-10-09 19:12 . 2012-11-28 22:57 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2015-10-09 19:12 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2015-10-09 19:12 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2015-10-09 19:12 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2015-10-09 19:12 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2015-10-09 19:12 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2015-10-09 19:11 . 2015-02-18 07:06 123904 ----a-w- c:\windows\system32\poqexec.exe
2015-10-09 19:10 . 2015-04-29 18:06 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2015-10-09 19:10 . 2015-04-29 18:06 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2015-10-09 19:10 . 2015-04-29 18:07 8192 ----a-w- c:\windows\system32\spwmp.dll
2015-10-09 19:10 . 2015-04-29 18:06 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-10-09 19:10 . 2015-04-29 18:05 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2015-10-09 19:06 . 2014-04-25 02:06 626688 ----a-w- c:\windows\system32\usp10.dll
2015-10-09 19:06 . 2015-06-17 17:39 305664 ----a-w- c:\windows\system32\gdi32.dll
2015-10-09 19:06 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll
2015-10-09 19:06 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll
2015-10-09 19:05 . 2015-06-03 20:17 370488 ----a-w- c:\windows\system32\drivers\cng.sys
2015-10-09 19:05 . 2015-07-15 02:55 44032 ----a-w- c:\windows\system32\basesrv.dll
2015-10-09 19:03 . 2014-12-06 03:50 242688 ----a-w- c:\windows\system32\nlasvc.dll
2015-10-09 19:03 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2015-10-09 19:03 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2015-10-09 19:03 . 2015-07-15 02:55 1390592 ----a-w- c:\windows\system32\msxml6.dll
2015-10-09 19:03 . 2015-07-15 02:55 1241088 ----a-w- c:\windows\system32\msxml3.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-10-09 18:58 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2015-10-09 18:58 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2015-10-09 18:54 . 2014-06-06 09:44 509440 ----a-w- c:\windows\system32\qedit.dll
2015-10-09 18:53 . 2014-04-05 02:25 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2015-10-09 18:53 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2015-10-09 18:53 . 2014-04-05 02:24 187840 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2015-10-09 18:52 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
2015-10-09 18:52 . 2011-08-17 04:19 75776 ----a-w- c:\windows\system32\psisrndr.ax
2015-10-09 18:51 . 2013-04-26 04:55 492544 ----a-w- c:\windows\system32\win32spl.dll
2015-10-09 18:51 . 2015-04-13 03:19 259072 ----a-w- c:\windows\system32\services.exe
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-20 21:27 . 2014-10-25 19:33 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2015-10-20 21:27 . 2015-09-21 18:17 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2015-10-10 00:44 . 2015-10-10 00:44 208384 ----a-w- c:\windows\system32\webcheck.dll
2004-12-15 12:27 . 2004-12-15 12:27 591360 ----a-r- c:\program files\MasterTime.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2015-07-08 5089480]
"GLDStart"="c:\program files\GLDirect\gldirect.exe" [2004-07-20 241664]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 981688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
R1 vwujiale;vwujiale;c:\windows\system32\drivers\vwujiale.sys [x]
R1 xfbvwiuu;xfbvwiuu;c:\windows\system32\drivers\xfbvwiuu.sys [x]
R2 caMyciloP;caMyciloP; [x]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-10 102912]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-10-24 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 95408]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2015-04-29 284504]
R3 OSFMount;OSFMount;c:\hry\Counter-Strike Global Offensive\image\x86\OSFMount.sys [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files\Overwolf\OverwolfUpdater.exe [2015-09-29 1006320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 pmfilt;pmfilt;c:\windows\system32\drivers\pmfilt.sys [2004-07-20 10112]
S0 pmhelp;pmhelp;c:\windows\system32\drivers\pmhelp.sys [2004-07-20 50464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-06-11 691696]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2015-07-14 202704]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2015-07-14 144536]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2015-07-08 1353720]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2015-07-14 132152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2015-10-24 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe [2015-10-24 14:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\m78v8gr7.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ce,96,30,2f,a1,e7,75,08,4c,6b,20,7b,05,b2,af,59,33,82,58,67,27,6c,38,
ac,5e,9f,e3,27,2e,96,fd,3b,57,b6,d0,de,81,5b,40,f4,95,80,aa,7a,00,86,9f,8d,\
"??"=hex:32,79,a3,96,1a,67,22,7f,6c,8c,a9,49,2e,1e,a5,7e
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\License information*]
"datasecu"=hex:9e,4c,27,28,ea,b6,cd,62,a1,be,8a,bd,fd,e1,af,4d,55,79,d5,0e,20,
6d,63,5f,65,43,8c,95,b4,3c,62,18,2c,fc,83,ee,5a,47,15,23,71,17,fd,3d,2b,de,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\windows\soundman.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2015-10-24 23:57:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-10-24 21:57
ComboFix2.txt 2015-10-24 19:57
.
Před spuštěním: Volných bajtů: 43 809 312 768
Po spuštění: Volných bajtů: 43 783 553 024
.
- - End Of File - - 6E9EBDBC7F31A9DD4084903ABC4F69A3
A36C5E4F47E84449FF07ED3517B43A31
- jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43298
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému
Toto otestuj na Virustotal
c:\windows\system32\drivers\vwujiale.sys
c:\windows\system32\drivers\xfbvwiuu.sys
Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.
Nebo na:
http://www.virscan.org/
AV: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
dva antiviry , jeden odinstaluj.
Pak znovu sken Combofixu..
Toto otestuj na Virustotal
c:\windows\system32\drivers\vwujiale.sys
c:\windows\system32\drivers\xfbvwiuu.sys
Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.
Nebo na:
http://www.virscan.org/
AV: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
dva antiviry , jeden odinstaluj.
Pak znovu sken Combofixu..
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu logu
jaro3 píše:c:\windows\system32\drivers\vwujiale.sys
c:\windows\system32\drivers\xfbvwiuu.sys
Ani jedno jsem tam nenašel a zapnuté to mám správně.

Naposledy upravil(a) elrodos dne 25 říj 2015 17:48, celkem upraveno 1 x.
Re: Prosím o kontrolu logu
Mohu se zeptat který antivir mam ponechat ? Pokud stačí free Microsoft Security Essentials, tak bych byl radši.
mbam mam mít pořád aktivní ?
mbam mam mít pořád aktivní ?
- jerabina
- člen Security týmu
-
Level 6
- Příspěvky: 3647
- Registrován: březen 13
- Bydliště: Litoměřice
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
No, ESET je lepší, ale volba je jen na tobě.
Stáhni si z některého odkazu SystemLook
SystemLook (32-bit)
http://jpshortstuff.247fixes.com/SystemLook.exe
SystemLook (64-bit)
http://jpshortstuff.247fixes.com/SystemLook_x64.exe
a ulož si ho na plochu.
Poklepej na stažený SystemLook , zkopíruj do hlavního text. okna tento následující text:
Klikni na Look ke startu skenu. Když program skončí objeví se v poznámkovém bloku zpráva skenu. Zkopíruj sem celý jeho obsah. Log se také nachází na ploše pod názvem SystemLook.txt.
Poté udělej znovu sken pomocí ComboFixu.
Stáhni si z některého odkazu SystemLook
SystemLook (32-bit)
http://jpshortstuff.247fixes.com/SystemLook.exe
SystemLook (64-bit)
http://jpshortstuff.247fixes.com/SystemLook_x64.exe
a ulož si ho na plochu.
Poklepej na stažený SystemLook , zkopíruj do hlavního text. okna tento následující text:
Kód: Vybrat vše
:filefind
*vwujiale.sys*
*xfbvwiuu.sys*
:folderfind
*vwujiale.sys*
*xfbvwiuu.sys*
:regfind
*vwujiale.sys*
*xfbvwiuu.sys*
Klikni na Look ke startu skenu. Když program skončí objeví se v poznámkovém bloku zpráva skenu. Zkopíruj sem celý jeho obsah. Log se také nachází na ploše pod názvem SystemLook.txt.
Poté udělej znovu sken pomocí ComboFixu.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Re: Prosím o kontrolu logu
SystemLook 30.07.11 by jpshortstuff
Log created at 00:08 on 27/10/2015 by Doma
Administrator - Elevation successful
========== filefind ==========
Searching for "*vwujiale.sys*"
No files found.
Searching for "*xfbvwiuu.sys*"
No files found.
========== folderfind ==========
Searching for "*vwujiale.sys*"
No folders found.
Searching for "*xfbvwiuu.sys*"
No folders found.
========== regfind ==========
Searching for "*vwujiale.sys*"
No data found.
Searching for "*xfbvwiuu.sys*"
No data found.
-= EOF =-
Log created at 00:08 on 27/10/2015 by Doma
Administrator - Elevation successful
========== filefind ==========
Searching for "*vwujiale.sys*"
No files found.
Searching for "*xfbvwiuu.sys*"
No files found.
========== folderfind ==========
Searching for "*vwujiale.sys*"
No folders found.
Searching for "*xfbvwiuu.sys*"
No folders found.
========== regfind ==========
Searching for "*vwujiale.sys*"
No data found.
Searching for "*xfbvwiuu.sys*"
No data found.
-= EOF =-
Re: Prosím o kontrolu logu
ComboFix 15-10-23.01 - Doma 27.10.2015 0:19.3.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2048.1344 [GMT 1:00]
Spuštěný z: c:\users\Doma\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Enabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\logs\scecomp.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-26 do 2015-10-26 )))))))))))))))))))))))))))))))
.
.
2015-10-26 23:33 . 2015-10-26 23:33 -------- d-----w- c:\users\Doma\AppData\Local\temp
2015-10-26 23:33 . 2015-10-26 23:33 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-10-26 23:33 . 2015-10-26 23:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-10-26 23:14 . 2015-10-26 23:14 39168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle43b990a.sys
2015-10-26 23:06 . 2015-10-26 23:06 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\offreg.820.dll
2015-10-26 23:04 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\mpengine.dll
2015-10-25 16:44 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-10-24 15:49 . 2015-10-24 15:11 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-24 15:10 . 2015-10-24 15:46 -------- d-----w- C:\zoek_backup
2015-10-21 00:38 . 2015-10-21 00:38 -------- d-----w- c:\users\Doma\AppData\Local\CrashDumps
2015-10-21 00:00 . 2015-10-21 00:00 -------- d-----w- c:\users\Doma\AppData\Local\Adobe
2015-10-20 21:01 . 2015-10-24 14:47 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-20 19:13 . 2015-10-24 15:28 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-20 19:11 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-20 19:11 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-20 19:11 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-20 19:11 . 2015-10-20 19:12 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-20 19:11 . 2015-10-20 19:11 -------- d-----w- c:\programdata\Malwarebytes
2015-10-19 21:06 . 2015-10-19 21:07 -------- d-----w- c:\program files\Microsoft Silverlight
2015-10-19 17:27 . 2015-10-19 17:27 -------- d-----w- c:\users\Doma\AppData\Roaming\InstallShield
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82609FA-2FC6-40F8-B3F2-38C868E0CA44}\gapaengine.dll
2015-10-13 01:32 . 2015-07-30 13:13 103120 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-10 14:01 . 2015-10-10 14:01 -------- d-----w- c:\windows\Panther
2015-10-10 05:29 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2015-10-10 05:28 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2015-10-10 05:27 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2015-10-10 05:27 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-10-10 05:18 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2015-10-10 05:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2015-10-10 03:03 . 2015-10-10 03:03 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2015-10-10 00:38 . 2015-10-10 00:38 640512 ----a-w- c:\windows\system32\advapi32.dll
2015-10-10 00:38 . 2015-10-10 00:38 619520 ----a-w- c:\windows\system32\tdh.dll
2015-10-10 00:35 . 2015-10-10 00:35 231424 ----a-w- c:\windows\system32\mswsock.dll
2015-10-10 00:32 . 2015-10-10 00:32 49152 ----a-w- c:\windows\system32\taskhost.exe
2015-10-10 00:04 . 2015-10-10 00:04 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2015-10-10 00:04 . 2015-10-10 00:04 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2015-10-09 23:51 . 2015-10-09 23:51 1505280 ----a-w- c:\windows\system32\d3d11.dll
2015-10-09 19:45 . 2013-07-03 04:02 36352 ----a-w- c:\windows\system32\drivers\usbscan.sys
2015-10-09 19:45 . 2013-07-03 03:36 55808 ----a-w- c:\windows\system32\drivers\hidclass.sys
2015-10-09 19:45 . 2013-07-03 03:36 25728 ----a-w- c:\windows\system32\drivers\hidparse.sys
2015-10-09 19:45 . 2014-10-18 01:33 571904 ----a-w- c:\windows\system32\oleaut32.dll
2015-10-09 19:44 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2015-10-09 19:44 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2015-10-09 19:36 . 2015-07-01 20:30 206848 ----a-w- c:\windows\system32\WebClnt.dll
2015-10-09 19:36 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll
2015-10-09 19:36 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll
2015-10-09 19:35 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\system32\mstscax.dll
2015-10-09 19:35 . 2015-07-10 17:33 131584 ----a-w- c:\windows\system32\aaclient.dll
2015-10-09 19:35 . 2015-07-10 17:34 36864 ----a-w- c:\windows\system32\tsgqec.dll
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\system32\notepad.exe
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\notepad.exe
2015-10-09 19:28 . 2015-08-05 17:41 751104 ----a-w- c:\windows\system32\schedsvc.dll
2015-10-09 19:27 . 2014-11-11 02:44 186880 ----a-w- c:\windows\system32\pku2u.dll
2015-10-09 19:25 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\system32\msi.dll
2015-10-09 19:25 . 2015-06-15 21:43 1805824 ----a-w- c:\windows\system32\authui.dll
2015-10-09 19:25 . 2015-06-15 21:47 101824 ----a-w- c:\windows\system32\consent.exe
2015-10-09 19:25 . 2015-06-15 21:43 337408 ----a-w- c:\windows\system32\msihnd.dll
2015-10-09 19:25 . 2015-06-15 21:43 47104 ----a-w- c:\windows\system32\appinfo.dll
2015-10-09 19:25 . 2015-06-15 21:42 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-10-09 19:25 . 2015-06-15 21:37 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-10-09 19:23 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2015-10-09 19:23 . 2014-06-16 01:44 730048 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2015-10-09 19:23 . 2014-06-16 01:44 219072 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2015-10-09 19:23 . 2014-06-16 01:40 107520 ----a-w- c:\windows\system32\cdd.dll
2015-10-09 19:23 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2015-10-09 19:23 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2015-10-09 19:23 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2015-10-09 19:19 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2015-10-09 19:19 . 2011-03-03 05:36 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2015-10-09 19:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2015-10-09 19:15 . 2014-03-04 09:17 538112 ----a-w- c:\windows\system32\objsel.dll
2015-10-09 19:15 . 2014-03-04 09:17 36864 ----a-w- c:\windows\system32\dimsroam.dll
2015-10-09 19:15 . 2014-03-04 09:17 51200 ----a-w- c:\windows\system32\cngprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 49664 ----a-w- c:\windows\system32\adprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 48128 ----a-w- c:\windows\system32\capiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 47616 ----a-w- c:\windows\system32\dpapiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 35328 ----a-w- c:\windows\system32\wincredprovider.dll
2015-10-09 19:13 . 2014-08-12 01:36 701440 ----a-w- c:\windows\system32\IMJP10K.DLL
2015-10-09 19:13 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll
2015-10-09 19:12 . 2015-02-25 03:03 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-10-09 19:12 . 2012-11-28 22:57 9728 ----a-w- c:\windows\system32\Wdfres.dll
2015-10-09 19:12 . 2012-11-28 22:57 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2015-10-09 19:12 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2015-10-09 19:12 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2015-10-09 19:12 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2015-10-09 19:12 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2015-10-09 19:12 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2015-10-09 19:11 . 2015-02-18 07:06 123904 ----a-w- c:\windows\system32\poqexec.exe
2015-10-09 19:10 . 2015-04-29 18:06 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2015-10-09 19:10 . 2015-04-29 18:06 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2015-10-09 19:10 . 2015-04-29 18:07 8192 ----a-w- c:\windows\system32\spwmp.dll
2015-10-09 19:10 . 2015-04-29 18:06 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-10-09 19:10 . 2015-04-29 18:05 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2015-10-09 19:06 . 2014-04-25 02:06 626688 ----a-w- c:\windows\system32\usp10.dll
2015-10-09 19:06 . 2015-06-17 17:39 305664 ----a-w- c:\windows\system32\gdi32.dll
2015-10-09 19:06 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll
2015-10-09 19:06 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll
2015-10-09 19:05 . 2015-06-03 20:17 370488 ----a-w- c:\windows\system32\drivers\cng.sys
2015-10-09 19:05 . 2015-07-15 02:55 44032 ----a-w- c:\windows\system32\basesrv.dll
2015-10-09 19:03 . 2014-12-06 03:50 242688 ----a-w- c:\windows\system32\nlasvc.dll
2015-10-09 19:03 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2015-10-09 19:03 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2015-10-09 19:03 . 2015-07-15 02:55 1390592 ----a-w- c:\windows\system32\msxml6.dll
2015-10-09 19:03 . 2015-07-15 02:55 1241088 ----a-w- c:\windows\system32\msxml3.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-10-09 18:58 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2015-10-09 18:58 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2015-10-09 18:54 . 2014-06-06 09:44 509440 ----a-w- c:\windows\system32\qedit.dll
2015-10-09 18:53 . 2014-04-05 02:25 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2015-10-09 18:53 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2015-10-09 18:53 . 2014-04-05 02:24 187840 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2015-10-09 18:52 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-20 21:27 . 2014-10-25 19:33 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2015-10-20 21:27 . 2015-09-21 18:17 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2015-10-10 00:44 . 2015-10-10 00:44 208384 ----a-w- c:\windows\system32\webcheck.dll
2004-12-15 12:27 . 2004-12-15 12:27 591360 ----a-r- c:\program files\MasterTime.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"GLDStart"="c:\program files\GLDirect\gldirect.exe" [2004-07-20 241664]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 981688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
R1 vwujiale;vwujiale;c:\windows\system32\drivers\vwujiale.sys [x]
R1 xfbvwiuu;xfbvwiuu;c:\windows\system32\drivers\xfbvwiuu.sys [x]
R2 caMyciloP;caMyciloP; [x]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-10 102912]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-10-24 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 95408]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2015-04-29 284504]
R3 OSFMount;OSFMount;c:\hry\Counter-Strike Global Offensive\image\x86\OSFMount.sys [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files\Overwolf\OverwolfUpdater.exe [2015-09-29 1006320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 pmfilt;pmfilt;c:\windows\system32\drivers\pmfilt.sys [2004-07-20 10112]
S0 pmhelp;pmhelp;c:\windows\system32\drivers\pmhelp.sys [2004-07-20 50464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-06-11 691696]
S1 MpKsle43b990a;MpKsle43b990a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle43b990a.sys [2015-10-26 39168]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S4 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S4 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSLE43B990A
*Deregistered* - epfwwfpr
.
Obsah adresáře 'Naplánované úlohy'
.
2015-10-24 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe [2015-10-24 14:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\m78v8gr7.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ce,96,30,2f,a1,e7,75,08,4c,6b,20,7b,05,b2,af,59,33,82,58,67,27,6c,38,
ac,5e,9f,e3,27,2e,96,fd,3b,57,b6,d0,de,81,5b,40,f4,95,80,aa,7a,00,86,9f,8d,\
"??"=hex:32,79,a3,96,1a,67,22,7f,6c,8c,a9,49,2e,1e,a5,7e
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\License information*]
"datasecu"=hex:9e,4c,27,28,ea,b6,cd,62,a1,be,8a,bd,fd,e1,af,4d,55,79,d5,0e,20,
6d,63,5f,65,43,8c,95,b4,3c,62,18,2c,fc,83,ee,5a,47,15,23,71,17,fd,3d,2b,de,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
Celkový čas: 2015-10-27 00:36:47
ComboFix-quarantined-files.txt 2015-10-26 23:36
ComboFix2.txt 2015-10-24 21:57
ComboFix3.txt 2015-10-24 19:57
.
Před spuštěním: Volných bajtů: 43 254 906 880
Po spuštění: Volných bajtů: 43 070 255 104
.
- - End Of File - - 9908DEB137FAD7FA8CDE274517C0D060
A36C5E4F47E84449FF07ED3517B43A31
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2048.1344 [GMT 1:00]
Spuštěný z: c:\users\Doma\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Enabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\logs\scecomp.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-26 do 2015-10-26 )))))))))))))))))))))))))))))))
.
.
2015-10-26 23:33 . 2015-10-26 23:33 -------- d-----w- c:\users\Doma\AppData\Local\temp
2015-10-26 23:33 . 2015-10-26 23:33 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-10-26 23:33 . 2015-10-26 23:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-10-26 23:14 . 2015-10-26 23:14 39168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle43b990a.sys
2015-10-26 23:06 . 2015-10-26 23:06 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\offreg.820.dll
2015-10-26 23:04 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\mpengine.dll
2015-10-25 16:44 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-10-24 15:49 . 2015-10-24 15:11 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-24 15:10 . 2015-10-24 15:46 -------- d-----w- C:\zoek_backup
2015-10-21 00:38 . 2015-10-21 00:38 -------- d-----w- c:\users\Doma\AppData\Local\CrashDumps
2015-10-21 00:00 . 2015-10-21 00:00 -------- d-----w- c:\users\Doma\AppData\Local\Adobe
2015-10-20 21:01 . 2015-10-24 14:47 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-20 19:13 . 2015-10-24 15:28 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-20 19:11 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-20 19:11 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-20 19:11 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-20 19:11 . 2015-10-20 19:12 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-20 19:11 . 2015-10-20 19:11 -------- d-----w- c:\programdata\Malwarebytes
2015-10-19 21:06 . 2015-10-19 21:07 -------- d-----w- c:\program files\Microsoft Silverlight
2015-10-19 17:27 . 2015-10-19 17:27 -------- d-----w- c:\users\Doma\AppData\Roaming\InstallShield
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82609FA-2FC6-40F8-B3F2-38C868E0CA44}\gapaengine.dll
2015-10-13 01:32 . 2015-07-30 13:13 103120 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-10 14:01 . 2015-10-10 14:01 -------- d-----w- c:\windows\Panther
2015-10-10 05:29 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2015-10-10 05:28 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2015-10-10 05:27 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2015-10-10 05:27 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-10-10 05:18 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2015-10-10 05:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2015-10-10 03:03 . 2015-10-10 03:03 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2015-10-10 00:38 . 2015-10-10 00:38 640512 ----a-w- c:\windows\system32\advapi32.dll
2015-10-10 00:38 . 2015-10-10 00:38 619520 ----a-w- c:\windows\system32\tdh.dll
2015-10-10 00:35 . 2015-10-10 00:35 231424 ----a-w- c:\windows\system32\mswsock.dll
2015-10-10 00:32 . 2015-10-10 00:32 49152 ----a-w- c:\windows\system32\taskhost.exe
2015-10-10 00:04 . 2015-10-10 00:04 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2015-10-10 00:04 . 2015-10-10 00:04 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2015-10-09 23:51 . 2015-10-09 23:51 1505280 ----a-w- c:\windows\system32\d3d11.dll
2015-10-09 19:45 . 2013-07-03 04:02 36352 ----a-w- c:\windows\system32\drivers\usbscan.sys
2015-10-09 19:45 . 2013-07-03 03:36 55808 ----a-w- c:\windows\system32\drivers\hidclass.sys
2015-10-09 19:45 . 2013-07-03 03:36 25728 ----a-w- c:\windows\system32\drivers\hidparse.sys
2015-10-09 19:45 . 2014-10-18 01:33 571904 ----a-w- c:\windows\system32\oleaut32.dll
2015-10-09 19:44 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2015-10-09 19:44 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2015-10-09 19:36 . 2015-07-01 20:30 206848 ----a-w- c:\windows\system32\WebClnt.dll
2015-10-09 19:36 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll
2015-10-09 19:36 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll
2015-10-09 19:35 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\system32\mstscax.dll
2015-10-09 19:35 . 2015-07-10 17:33 131584 ----a-w- c:\windows\system32\aaclient.dll
2015-10-09 19:35 . 2015-07-10 17:34 36864 ----a-w- c:\windows\system32\tsgqec.dll
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\system32\notepad.exe
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\notepad.exe
2015-10-09 19:28 . 2015-08-05 17:41 751104 ----a-w- c:\windows\system32\schedsvc.dll
2015-10-09 19:27 . 2014-11-11 02:44 186880 ----a-w- c:\windows\system32\pku2u.dll
2015-10-09 19:25 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\system32\msi.dll
2015-10-09 19:25 . 2015-06-15 21:43 1805824 ----a-w- c:\windows\system32\authui.dll
2015-10-09 19:25 . 2015-06-15 21:47 101824 ----a-w- c:\windows\system32\consent.exe
2015-10-09 19:25 . 2015-06-15 21:43 337408 ----a-w- c:\windows\system32\msihnd.dll
2015-10-09 19:25 . 2015-06-15 21:43 47104 ----a-w- c:\windows\system32\appinfo.dll
2015-10-09 19:25 . 2015-06-15 21:42 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-10-09 19:25 . 2015-06-15 21:37 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-10-09 19:23 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2015-10-09 19:23 . 2014-06-16 01:44 730048 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2015-10-09 19:23 . 2014-06-16 01:44 219072 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2015-10-09 19:23 . 2014-06-16 01:40 107520 ----a-w- c:\windows\system32\cdd.dll
2015-10-09 19:23 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2015-10-09 19:23 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2015-10-09 19:23 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2015-10-09 19:19 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2015-10-09 19:19 . 2011-03-03 05:36 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2015-10-09 19:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2015-10-09 19:15 . 2014-03-04 09:17 538112 ----a-w- c:\windows\system32\objsel.dll
2015-10-09 19:15 . 2014-03-04 09:17 36864 ----a-w- c:\windows\system32\dimsroam.dll
2015-10-09 19:15 . 2014-03-04 09:17 51200 ----a-w- c:\windows\system32\cngprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 49664 ----a-w- c:\windows\system32\adprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 48128 ----a-w- c:\windows\system32\capiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 47616 ----a-w- c:\windows\system32\dpapiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 35328 ----a-w- c:\windows\system32\wincredprovider.dll
2015-10-09 19:13 . 2014-08-12 01:36 701440 ----a-w- c:\windows\system32\IMJP10K.DLL
2015-10-09 19:13 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll
2015-10-09 19:12 . 2015-02-25 03:03 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-10-09 19:12 . 2012-11-28 22:57 9728 ----a-w- c:\windows\system32\Wdfres.dll
2015-10-09 19:12 . 2012-11-28 22:57 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2015-10-09 19:12 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2015-10-09 19:12 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2015-10-09 19:12 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2015-10-09 19:12 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2015-10-09 19:12 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2015-10-09 19:11 . 2015-02-18 07:06 123904 ----a-w- c:\windows\system32\poqexec.exe
2015-10-09 19:10 . 2015-04-29 18:06 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2015-10-09 19:10 . 2015-04-29 18:06 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2015-10-09 19:10 . 2015-04-29 18:07 8192 ----a-w- c:\windows\system32\spwmp.dll
2015-10-09 19:10 . 2015-04-29 18:06 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-10-09 19:10 . 2015-04-29 18:05 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2015-10-09 19:06 . 2014-04-25 02:06 626688 ----a-w- c:\windows\system32\usp10.dll
2015-10-09 19:06 . 2015-06-17 17:39 305664 ----a-w- c:\windows\system32\gdi32.dll
2015-10-09 19:06 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll
2015-10-09 19:06 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll
2015-10-09 19:05 . 2015-06-03 20:17 370488 ----a-w- c:\windows\system32\drivers\cng.sys
2015-10-09 19:05 . 2015-07-15 02:55 44032 ----a-w- c:\windows\system32\basesrv.dll
2015-10-09 19:03 . 2014-12-06 03:50 242688 ----a-w- c:\windows\system32\nlasvc.dll
2015-10-09 19:03 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2015-10-09 19:03 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2015-10-09 19:03 . 2015-07-15 02:55 1390592 ----a-w- c:\windows\system32\msxml6.dll
2015-10-09 19:03 . 2015-07-15 02:55 1241088 ----a-w- c:\windows\system32\msxml3.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-10-09 18:58 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2015-10-09 18:58 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2015-10-09 18:54 . 2014-06-06 09:44 509440 ----a-w- c:\windows\system32\qedit.dll
2015-10-09 18:53 . 2014-04-05 02:25 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2015-10-09 18:53 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2015-10-09 18:53 . 2014-04-05 02:24 187840 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2015-10-09 18:52 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-20 21:27 . 2014-10-25 19:33 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2015-10-20 21:27 . 2015-09-21 18:17 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2015-10-10 00:44 . 2015-10-10 00:44 208384 ----a-w- c:\windows\system32\webcheck.dll
2004-12-15 12:27 . 2004-12-15 12:27 591360 ----a-r- c:\program files\MasterTime.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"GLDStart"="c:\program files\GLDirect\gldirect.exe" [2004-07-20 241664]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 981688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
R1 vwujiale;vwujiale;c:\windows\system32\drivers\vwujiale.sys [x]
R1 xfbvwiuu;xfbvwiuu;c:\windows\system32\drivers\xfbvwiuu.sys [x]
R2 caMyciloP;caMyciloP; [x]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-10 102912]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-10-24 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 95408]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2015-04-29 284504]
R3 OSFMount;OSFMount;c:\hry\Counter-Strike Global Offensive\image\x86\OSFMount.sys [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files\Overwolf\OverwolfUpdater.exe [2015-09-29 1006320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 pmfilt;pmfilt;c:\windows\system32\drivers\pmfilt.sys [2004-07-20 10112]
S0 pmhelp;pmhelp;c:\windows\system32\drivers\pmhelp.sys [2004-07-20 50464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-06-11 691696]
S1 MpKsle43b990a;MpKsle43b990a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle43b990a.sys [2015-10-26 39168]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S4 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S4 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSLE43B990A
*Deregistered* - epfwwfpr
.
Obsah adresáře 'Naplánované úlohy'
.
2015-10-24 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe [2015-10-24 14:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\m78v8gr7.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ce,96,30,2f,a1,e7,75,08,4c,6b,20,7b,05,b2,af,59,33,82,58,67,27,6c,38,
ac,5e,9f,e3,27,2e,96,fd,3b,57,b6,d0,de,81,5b,40,f4,95,80,aa,7a,00,86,9f,8d,\
"??"=hex:32,79,a3,96,1a,67,22,7f,6c,8c,a9,49,2e,1e,a5,7e
.
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\License information*]
"datasecu"=hex:9e,4c,27,28,ea,b6,cd,62,a1,be,8a,bd,fd,e1,af,4d,55,79,d5,0e,20,
6d,63,5f,65,43,8c,95,b4,3c,62,18,2c,fc,83,ee,5a,47,15,23,71,17,fd,3d,2b,de,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
Celkový čas: 2015-10-27 00:36:47
ComboFix-quarantined-files.txt 2015-10-26 23:36
ComboFix2.txt 2015-10-24 21:57
ComboFix3.txt 2015-10-24 19:57
.
Před spuštěním: Volných bajtů: 43 254 906 880
Po spuštění: Volných bajtů: 43 070 255 104
.
- - End Of File - - 9908DEB137FAD7FA8CDE274517C0D060
A36C5E4F47E84449FF07ED3517B43A31
- jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43298
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Kód: Vybrat vše
KillAll::
Collect::
c:\windows\system32\drivers\vwujiale.sys
c:\windows\system32\drivers\xfbvwiuu.sys
Driver::
vwujiale
xfbvwiuu
caMyciloP
RegLock::
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\License information*]
"datasecu"=hex:9e,4c,27,28,ea,b6,cd,62,a1,be,8a,bd,fd,e1,af,4d,55,79,d5,0e,20,
6d,63,5f,65,43,8c,95,b4,3c,62,18,2c,fc,83,ee,5a,47,15,23,71,17,fd,3d,2b,de,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
RegNull::
[HKEY_USERS\S-1-5-21-1777567604-985344441-3338332800-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ce,96,30,2f,a1,e7,75,08,4c,6b,20,7b,05,b2,af,59,33,82,58,67,27,6c,38,
ac,5e,9f,e3,27,2e,96,fd,3b,57,b6,d0,de,81,5b,40,f4,95,80,aa,7a,00,86,9f,8d,\
"??"=hex:32,79,a3,96,1a,67,22,7f,6c,8c,a9,49,2e,1e,a5,7e
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu logu
ComboFix 15-10-23.01 - Doma 27.10.2015 16:38:04.4.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2048.1351 [GMT 1:00]
Spuštěný z: c:\users\Doma\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Doma\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_caMyciloP
-------\Service_vwujiale
-------\Service_xfbvwiuu
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-27 do 2015-10-27 )))))))))))))))))))))))))))))))
.
.
2015-10-27 15:49 . 2015-10-27 15:49 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-10-27 15:49 . 2015-10-27 15:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-10-27 15:20 . 2015-10-27 15:20 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\offreg.804.dll
2015-10-27 15:20 . 2015-10-27 15:20 39168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle9b6966e.sys
2015-10-26 23:36 . 2015-10-27 15:52 -------- d-----w- c:\users\Doma\AppData\Local\temp
2015-10-26 23:04 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\mpengine.dll
2015-10-25 16:44 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-10-24 15:49 . 2015-10-24 15:11 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-24 15:10 . 2015-10-24 15:46 -------- d-----w- C:\zoek_backup
2015-10-21 00:38 . 2015-10-21 00:38 -------- d-----w- c:\users\Doma\AppData\Local\CrashDumps
2015-10-21 00:00 . 2015-10-21 00:00 -------- d-----w- c:\users\Doma\AppData\Local\Adobe
2015-10-20 21:01 . 2015-10-24 14:47 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-20 19:13 . 2015-10-24 15:28 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-20 19:11 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-20 19:11 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-20 19:11 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-20 19:11 . 2015-10-20 19:12 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-20 19:11 . 2015-10-20 19:11 -------- d-----w- c:\programdata\Malwarebytes
2015-10-19 21:06 . 2015-10-19 21:07 -------- d-----w- c:\program files\Microsoft Silverlight
2015-10-19 17:27 . 2015-10-19 17:27 -------- d-----w- c:\users\Doma\AppData\Roaming\InstallShield
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82609FA-2FC6-40F8-B3F2-38C868E0CA44}\gapaengine.dll
2015-10-13 01:32 . 2015-07-30 13:13 103120 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-10 14:01 . 2015-10-10 14:01 -------- d-----w- c:\windows\Panther
2015-10-10 05:29 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2015-10-10 05:28 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2015-10-10 05:27 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2015-10-10 05:27 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-10-10 05:18 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2015-10-10 05:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2015-10-10 03:03 . 2015-10-10 03:03 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2015-10-10 00:38 . 2015-10-10 00:38 640512 ----a-w- c:\windows\system32\advapi32.dll
2015-10-10 00:38 . 2015-10-10 00:38 619520 ----a-w- c:\windows\system32\tdh.dll
2015-10-10 00:35 . 2015-10-10 00:35 231424 ----a-w- c:\windows\system32\mswsock.dll
2015-10-10 00:32 . 2015-10-10 00:32 49152 ----a-w- c:\windows\system32\taskhost.exe
2015-10-10 00:04 . 2015-10-10 00:04 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2015-10-10 00:04 . 2015-10-10 00:04 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2015-10-09 23:51 . 2015-10-09 23:51 1505280 ----a-w- c:\windows\system32\d3d11.dll
2015-10-09 19:45 . 2013-07-03 04:02 36352 ----a-w- c:\windows\system32\drivers\usbscan.sys
2015-10-09 19:45 . 2013-07-03 03:36 55808 ----a-w- c:\windows\system32\drivers\hidclass.sys
2015-10-09 19:45 . 2013-07-03 03:36 25728 ----a-w- c:\windows\system32\drivers\hidparse.sys
2015-10-09 19:45 . 2014-10-18 01:33 571904 ----a-w- c:\windows\system32\oleaut32.dll
2015-10-09 19:44 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2015-10-09 19:44 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2015-10-09 19:36 . 2015-07-01 20:30 206848 ----a-w- c:\windows\system32\WebClnt.dll
2015-10-09 19:36 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll
2015-10-09 19:36 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll
2015-10-09 19:35 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\system32\mstscax.dll
2015-10-09 19:35 . 2015-07-10 17:33 131584 ----a-w- c:\windows\system32\aaclient.dll
2015-10-09 19:35 . 2015-07-10 17:34 36864 ----a-w- c:\windows\system32\tsgqec.dll
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\system32\notepad.exe
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\notepad.exe
2015-10-09 19:28 . 2015-08-05 17:41 751104 ----a-w- c:\windows\system32\schedsvc.dll
2015-10-09 19:27 . 2014-11-11 02:44 186880 ----a-w- c:\windows\system32\pku2u.dll
2015-10-09 19:25 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\system32\msi.dll
2015-10-09 19:25 . 2015-06-15 21:43 1805824 ----a-w- c:\windows\system32\authui.dll
2015-10-09 19:25 . 2015-06-15 21:47 101824 ----a-w- c:\windows\system32\consent.exe
2015-10-09 19:25 . 2015-06-15 21:43 337408 ----a-w- c:\windows\system32\msihnd.dll
2015-10-09 19:25 . 2015-06-15 21:43 47104 ----a-w- c:\windows\system32\appinfo.dll
2015-10-09 19:25 . 2015-06-15 21:42 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-10-09 19:25 . 2015-06-15 21:37 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-10-09 19:23 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2015-10-09 19:23 . 2014-06-16 01:44 730048 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2015-10-09 19:23 . 2014-06-16 01:44 219072 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2015-10-09 19:23 . 2014-06-16 01:40 107520 ----a-w- c:\windows\system32\cdd.dll
2015-10-09 19:23 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2015-10-09 19:23 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2015-10-09 19:23 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2015-10-09 19:19 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2015-10-09 19:19 . 2011-03-03 05:36 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2015-10-09 19:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2015-10-09 19:15 . 2014-03-04 09:17 538112 ----a-w- c:\windows\system32\objsel.dll
2015-10-09 19:15 . 2014-03-04 09:17 36864 ----a-w- c:\windows\system32\dimsroam.dll
2015-10-09 19:15 . 2014-03-04 09:17 51200 ----a-w- c:\windows\system32\cngprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 49664 ----a-w- c:\windows\system32\adprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 48128 ----a-w- c:\windows\system32\capiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 47616 ----a-w- c:\windows\system32\dpapiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 35328 ----a-w- c:\windows\system32\wincredprovider.dll
2015-10-09 19:13 . 2014-08-12 01:36 701440 ----a-w- c:\windows\system32\IMJP10K.DLL
2015-10-09 19:13 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll
2015-10-09 19:12 . 2015-02-25 03:03 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-10-09 19:12 . 2012-11-28 22:57 9728 ----a-w- c:\windows\system32\Wdfres.dll
2015-10-09 19:12 . 2012-11-28 22:57 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2015-10-09 19:12 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2015-10-09 19:12 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2015-10-09 19:12 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2015-10-09 19:12 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2015-10-09 19:12 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2015-10-09 19:11 . 2015-02-18 07:06 123904 ----a-w- c:\windows\system32\poqexec.exe
2015-10-09 19:10 . 2015-04-29 18:06 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2015-10-09 19:10 . 2015-04-29 18:06 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2015-10-09 19:10 . 2015-04-29 18:07 8192 ----a-w- c:\windows\system32\spwmp.dll
2015-10-09 19:10 . 2015-04-29 18:06 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-10-09 19:10 . 2015-04-29 18:05 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2015-10-09 19:06 . 2014-04-25 02:06 626688 ----a-w- c:\windows\system32\usp10.dll
2015-10-09 19:06 . 2015-06-17 17:39 305664 ----a-w- c:\windows\system32\gdi32.dll
2015-10-09 19:06 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll
2015-10-09 19:06 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll
2015-10-09 19:05 . 2015-06-03 20:17 370488 ----a-w- c:\windows\system32\drivers\cng.sys
2015-10-09 19:05 . 2015-07-15 02:55 44032 ----a-w- c:\windows\system32\basesrv.dll
2015-10-09 19:03 . 2014-12-06 03:50 242688 ----a-w- c:\windows\system32\nlasvc.dll
2015-10-09 19:03 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2015-10-09 19:03 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2015-10-09 19:03 . 2015-07-15 02:55 1390592 ----a-w- c:\windows\system32\msxml6.dll
2015-10-09 19:03 . 2015-07-15 02:55 1241088 ----a-w- c:\windows\system32\msxml3.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-10-09 18:58 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2015-10-09 18:58 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2015-10-09 18:54 . 2014-06-06 09:44 509440 ----a-w- c:\windows\system32\qedit.dll
2015-10-09 18:53 . 2014-04-05 02:25 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2015-10-09 18:53 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2015-10-09 18:53 . 2014-04-05 02:24 187840 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2015-10-09 18:52 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-20 21:27 . 2014-10-25 19:33 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2015-10-20 21:27 . 2015-09-21 18:17 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2015-10-10 00:44 . 2015-10-10 00:44 208384 ----a-w- c:\windows\system32\webcheck.dll
2004-12-15 12:27 . 2004-12-15 12:27 591360 ----a-r- c:\program files\MasterTime.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"GLDStart"="c:\program files\GLDirect\gldirect.exe" [2004-07-20 241664]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 981688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-10 102912]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-10-24 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2015-04-29 284504]
R3 OSFMount;OSFMount;c:\hry\Counter-Strike Global Offensive\image\x86\OSFMount.sys [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files\Overwolf\OverwolfUpdater.exe [2015-09-29 1006320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 pmfilt;pmfilt;c:\windows\system32\drivers\pmfilt.sys [2004-07-20 10112]
S0 pmhelp;pmhelp;c:\windows\system32\drivers\pmhelp.sys [2004-07-20 50464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-06-11 691696]
S1 MpKsle9b6966e;MpKsle9b6966e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle9b6966e.sys [2015-10-27 39168]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 95408]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2015-10-24 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe [2015-10-24 14:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\m78v8gr7.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\soundman.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2015-10-27 16:55:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-10-27 15:55
ComboFix2.txt 2015-10-26 23:36
ComboFix3.txt 2015-10-24 21:57
ComboFix4.txt 2015-10-24 19:57
.
Před spuštěním: Volných bajtů: 43 161 300 992
Po spuštění: Volných bajtů: 42 835 439 616
.
- - End Of File - - 1B2532B999F985FA9400DC76AD9805DA
A36C5E4F47E84449FF07ED3517B43A31
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.2048.1351 [GMT 1:00]
Spuštěný z: c:\users\Doma\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Doma\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_caMyciloP
-------\Service_vwujiale
-------\Service_xfbvwiuu
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-27 do 2015-10-27 )))))))))))))))))))))))))))))))
.
.
2015-10-27 15:49 . 2015-10-27 15:49 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-10-27 15:49 . 2015-10-27 15:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-10-27 15:20 . 2015-10-27 15:20 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\offreg.804.dll
2015-10-27 15:20 . 2015-10-27 15:20 39168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle9b6966e.sys
2015-10-26 23:36 . 2015-10-27 15:52 -------- d-----w- c:\users\Doma\AppData\Local\temp
2015-10-26 23:04 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\mpengine.dll
2015-10-25 16:44 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-10-24 15:49 . 2015-10-24 15:11 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-24 15:10 . 2015-10-24 15:46 -------- d-----w- C:\zoek_backup
2015-10-21 00:38 . 2015-10-21 00:38 -------- d-----w- c:\users\Doma\AppData\Local\CrashDumps
2015-10-21 00:00 . 2015-10-21 00:00 -------- d-----w- c:\users\Doma\AppData\Local\Adobe
2015-10-20 21:01 . 2015-10-24 14:47 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-20 19:13 . 2015-10-24 15:28 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-20 19:11 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-20 19:11 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-20 19:11 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-20 19:11 . 2015-10-20 19:12 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-20 19:11 . 2015-10-20 19:11 -------- d-----w- c:\programdata\Malwarebytes
2015-10-19 21:06 . 2015-10-19 21:07 -------- d-----w- c:\program files\Microsoft Silverlight
2015-10-19 17:27 . 2015-10-19 17:27 -------- d-----w- c:\users\Doma\AppData\Roaming\InstallShield
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-10-14 12:35 . 2015-10-08 11:12 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E82609FA-2FC6-40F8-B3F2-38C868E0CA44}\gapaengine.dll
2015-10-13 01:32 . 2015-07-30 13:13 103120 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-10 14:01 . 2015-10-10 14:01 -------- d-----w- c:\windows\Panther
2015-10-10 05:29 . 2014-03-09 21:47 99480 ----a-w- c:\windows\system32\infocardapi.dll
2015-10-10 05:28 . 2014-06-30 22:14 8856 ----a-w- c:\windows\system32\icardres.dll
2015-10-10 05:27 . 2014-03-09 21:47 619672 ----a-w- c:\windows\system32\icardagt.exe
2015-10-10 05:27 . 2014-06-06 06:16 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2015-10-10 05:18 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2015-10-10 05:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2015-10-10 03:03 . 2015-10-10 03:03 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2015-10-10 00:38 . 2015-10-10 00:38 640512 ----a-w- c:\windows\system32\advapi32.dll
2015-10-10 00:38 . 2015-10-10 00:38 619520 ----a-w- c:\windows\system32\tdh.dll
2015-10-10 00:35 . 2015-10-10 00:35 231424 ----a-w- c:\windows\system32\mswsock.dll
2015-10-10 00:32 . 2015-10-10 00:32 49152 ----a-w- c:\windows\system32\taskhost.exe
2015-10-10 00:04 . 2015-10-10 00:04 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-10-10 00:04 . 2015-10-10 00:04 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2015-10-10 00:04 . 2015-10-10 00:04 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2015-10-09 23:51 . 2015-10-09 23:51 1505280 ----a-w- c:\windows\system32\d3d11.dll
2015-10-09 19:45 . 2013-07-03 04:02 36352 ----a-w- c:\windows\system32\drivers\usbscan.sys
2015-10-09 19:45 . 2013-07-03 03:36 55808 ----a-w- c:\windows\system32\drivers\hidclass.sys
2015-10-09 19:45 . 2013-07-03 03:36 25728 ----a-w- c:\windows\system32\drivers\hidparse.sys
2015-10-09 19:45 . 2014-10-18 01:33 571904 ----a-w- c:\windows\system32\oleaut32.dll
2015-10-09 19:44 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2015-10-09 19:44 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2015-10-09 19:36 . 2015-07-01 20:30 206848 ----a-w- c:\windows\system32\WebClnt.dll
2015-10-09 19:36 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll
2015-10-09 19:36 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll
2015-10-09 19:35 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\system32\mstscax.dll
2015-10-09 19:35 . 2015-07-10 17:33 131584 ----a-w- c:\windows\system32\aaclient.dll
2015-10-09 19:35 . 2015-07-10 17:34 36864 ----a-w- c:\windows\system32\tsgqec.dll
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\system32\notepad.exe
2015-10-09 19:28 . 2015-07-09 17:42 179712 ----a-w- c:\windows\notepad.exe
2015-10-09 19:28 . 2015-08-05 17:41 751104 ----a-w- c:\windows\system32\schedsvc.dll
2015-10-09 19:27 . 2014-11-11 02:44 186880 ----a-w- c:\windows\system32\pku2u.dll
2015-10-09 19:25 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\system32\msi.dll
2015-10-09 19:25 . 2015-06-15 21:43 1805824 ----a-w- c:\windows\system32\authui.dll
2015-10-09 19:25 . 2015-06-15 21:47 101824 ----a-w- c:\windows\system32\consent.exe
2015-10-09 19:25 . 2015-06-15 21:43 337408 ----a-w- c:\windows\system32\msihnd.dll
2015-10-09 19:25 . 2015-06-15 21:43 47104 ----a-w- c:\windows\system32\appinfo.dll
2015-10-09 19:25 . 2015-06-15 21:42 73216 ----a-w- c:\windows\system32\msiexec.exe
2015-10-09 19:25 . 2015-06-15 21:37 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-10-09 19:23 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2015-10-09 19:23 . 2014-06-16 01:44 730048 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2015-10-09 19:23 . 2014-06-16 01:44 219072 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2015-10-09 19:23 . 2014-06-16 01:40 107520 ----a-w- c:\windows\system32\cdd.dll
2015-10-09 19:23 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2015-10-09 19:23 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2015-10-09 19:23 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2015-10-09 19:19 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2015-10-09 19:19 . 2011-03-03 05:36 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2015-10-09 19:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2015-10-09 19:15 . 2014-03-04 09:17 538112 ----a-w- c:\windows\system32\objsel.dll
2015-10-09 19:15 . 2014-03-04 09:17 36864 ----a-w- c:\windows\system32\dimsroam.dll
2015-10-09 19:15 . 2014-03-04 09:17 51200 ----a-w- c:\windows\system32\cngprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 49664 ----a-w- c:\windows\system32\adprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 48128 ----a-w- c:\windows\system32\capiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 47616 ----a-w- c:\windows\system32\dpapiprovider.dll
2015-10-09 19:15 . 2014-03-04 09:17 35328 ----a-w- c:\windows\system32\wincredprovider.dll
2015-10-09 19:13 . 2014-08-12 01:36 701440 ----a-w- c:\windows\system32\IMJP10K.DLL
2015-10-09 19:13 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll
2015-10-09 19:12 . 2015-02-25 03:03 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-10-09 19:12 . 2012-11-28 22:57 9728 ----a-w- c:\windows\system32\Wdfres.dll
2015-10-09 19:12 . 2012-11-28 22:57 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2015-10-09 19:12 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2015-10-09 19:12 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2015-10-09 19:12 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2015-10-09 19:12 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2015-10-09 19:12 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2015-10-09 19:11 . 2015-02-18 07:06 123904 ----a-w- c:\windows\system32\poqexec.exe
2015-10-09 19:10 . 2015-04-29 18:06 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2015-10-09 19:10 . 2015-04-29 18:06 102400 ----a-w- c:\program files\Windows Media Player\wmpshare.exe
2015-10-09 19:10 . 2015-04-29 18:07 8192 ----a-w- c:\windows\system32\spwmp.dll
2015-10-09 19:10 . 2015-04-29 18:06 101888 ----a-w- c:\program files\Windows Media Player\wmpconfig.exe
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-10-09 19:10 . 2015-04-29 18:07 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-10-09 19:10 . 2015-04-29 18:05 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2015-10-09 19:06 . 2014-04-25 02:06 626688 ----a-w- c:\windows\system32\usp10.dll
2015-10-09 19:06 . 2015-06-17 17:39 305664 ----a-w- c:\windows\system32\gdi32.dll
2015-10-09 19:06 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll
2015-10-09 19:06 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll
2015-10-09 19:05 . 2015-06-03 20:17 370488 ----a-w- c:\windows\system32\drivers\cng.sys
2015-10-09 19:05 . 2015-07-15 02:55 44032 ----a-w- c:\windows\system32\basesrv.dll
2015-10-09 19:03 . 2014-12-06 03:50 242688 ----a-w- c:\windows\system32\nlasvc.dll
2015-10-09 19:03 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll
2015-10-09 19:03 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll
2015-10-09 19:03 . 2015-07-15 02:55 1390592 ----a-w- c:\windows\system32\msxml6.dll
2015-10-09 19:03 . 2015-07-15 02:55 1241088 ----a-w- c:\windows\system32\msxml3.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-10-09 19:03 . 2015-07-15 02:51 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-10-09 18:58 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2015-10-09 18:58 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2015-10-09 18:54 . 2014-06-06 09:44 509440 ----a-w- c:\windows\system32\qedit.dll
2015-10-09 18:53 . 2014-04-05 02:25 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2015-10-09 18:53 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2015-10-09 18:53 . 2014-04-05 02:24 187840 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2015-10-09 18:52 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-20 21:27 . 2014-10-25 19:33 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2015-10-20 21:27 . 2015-09-21 18:17 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2015-10-10 00:44 . 2015-10-10 00:44 208384 ----a-w- c:\windows\system32\webcheck.dll
2004-12-15 12:27 . 2004-12-15 12:27 591360 ----a-r- c:\program files\MasterTime.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"GLDStart"="c:\program files\GLDirect\gldirect.exe" [2004-07-20 241664]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 981688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-10 102912]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-10-24 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [2015-04-29 284504]
R3 OSFMount;OSFMount;c:\hry\Counter-Strike Global Offensive\image\x86\OSFMount.sys [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files\Overwolf\OverwolfUpdater.exe [2015-09-29 1006320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 pmfilt;pmfilt;c:\windows\system32\drivers\pmfilt.sys [2004-07-20 10112]
S0 pmhelp;pmhelp;c:\windows\system32\drivers\pmhelp.sys [2004-07-20 50464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-06-11 691696]
S1 MpKsle9b6966e;MpKsle9b6966e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8AEA4A90-3BC2-4E86-938B-E9D65A996A46}\MpKsle9b6966e.sys [2015-10-27 39168]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 95408]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2015-10-24 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe [2015-10-24 14:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Doma\AppData\Roaming\Mozilla\Firefox\Profiles\m78v8gr7.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\soundman.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2015-10-27 16:55:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-10-27 15:55
ComboFix2.txt 2015-10-26 23:36
ComboFix3.txt 2015-10-24 21:57
ComboFix4.txt 2015-10-24 19:57
.
Před spuštěním: Volných bajtů: 43 161 300 992
Po spuštění: Volných bajtů: 42 835 439 616
.
- - End Of File - - 1B2532B999F985FA9400DC76AD9805DA
A36C5E4F47E84449FF07ED3517B43A31
Re: Prosím o kontrolu logu
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:59:59, on 27.10.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
FIREFOX: 31.0 (x86 cs)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\soundman.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\Explorer.exe
C:\Users\Doma\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [GLDStart] C:\Program Files\GLDirect\gldirect.exe -filterstart
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Overwolf Updater Windows SCM (OverwolfUpdater) - Overwolf LTD - C:\Program Files\Overwolf\OverwolfUpdater.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
--
End of file - 3349 bytes
Scan saved at 16:59:59, on 27.10.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
FIREFOX: 31.0 (x86 cs)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\soundman.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\Explorer.exe
C:\Users\Doma\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [GLDStart] C:\Program Files\GLDirect\gldirect.exe -filterstart
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Overwolf Updater Windows SCM (OverwolfUpdater) - Overwolf LTD - C:\Program Files\Overwolf\OverwolfUpdater.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
--
End of file - 3349 bytes
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 96 hostů