Prosím o kontrolu logu, asi VIR Vyřešeno

[tomas_ch]

RogueKiller V10.10.7.0 [Sep 28 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Spuštěno : Normální režim
Uživatel : pc [Práva správce]
Started from : C:\Users\pc\Desktop\RogueKiller.exe
Mód : Prohledat -- Datum : 01/01/2001 02:36:49

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: FUJITSU MJA2320BH G2 +++++
--- User ---
[MBR] a546510a8ac508cd0f16d0116a85b7c8
[BSP] 00236dbc4b3a085c16fdc577ae13c298 : Acer MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 13000 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 26626048 | Size: 146119 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 325877760 | Size: 141004 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 614653952 | Size: 5120 MB
User = LL1 ... OK
User = LL2 ... OK

[Reklama]

[jaro3]

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:

- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)

- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni antivir i firewall.
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[tomas_ch]

RogueKiller V10.10.7.0 [Sep 28 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Spuštěno : Normální režim
Uživatel : pc [Práva správce]
Started from : C:\Users\pc\Desktop\RogueKiller.exe
Mód : Smazat -- Datum : 01/01/2001 22:17:47

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: FUJITSU MJA2320BH G2 +++++
--- User ---
[MBR] a546510a8ac508cd0f16d0116a85b7c8
[BSP] 00236dbc4b3a085c16fdc577ae13c298 : Acer MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 13000 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 26626048 | Size: 146119 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 325877760 | Size: 141004 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 614653952 | Size: 5120 MB
User = LL1 ... OK
User = LL2 ... OK

[tomas_ch]

Zoek.exe v5.0.0.1 Updated 30-09-2015
Tool run by pc on po 01.01.2001 at 22:27:34,24.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\pc\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-09-25-103826.log 11773 bytes

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\Users\pc\AppData\Roaming\Validity deleted successfully
C:\Users\pc\AppData\Local\GHISLER deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Splendid Difference deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Splendid Difference deleted successfully

==== Deleting Files \ Folders ======================

C:\Windows\system32\appdata deleted
C:\PROGRA~2\Package Cache deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension" [31.07.2011 12:12]

==== Chromium Look ======================

Google Chrome Version: 36.0.1985.143

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
flliilndjeohchalpbbcdekjklbdgfkk - No path found[]


==== Chromium Fix ======================

C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.donation-tools.org_0.localstorage deleted successfully
C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.donation-tools.org_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{00B409F9-12B1-4A91-81EB-078C48B0ABEF}"
{00B409F9-12B1-4A91-81EB-078C48B0ABEF} Bing Url="http://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{07CF137C-BF0B-4F78-8E85-92F1E95DFB3A} Zbo§ˇ.cz Url="http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=QuickSearch_12454"
{0E65AD17-19E9-41B6-A4C2-B37A4CE26B38} Slovnˇk EN/CZ Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_12454"
{20EFC17B-6739-45C2-ABC3-8E8D5E007C60} Mapy.cz Url="http://www.mapy.cz/?query={searchTerms}&sourceid=QuickSearch_12454"
{45D88136-6E13-412F-A81A-680128D7008B} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACAW_cs"
{5D60DF08-43B1-4B4A-B96B-0FECC2974E02} Slovnˇk CZ/EN Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_12454"
{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url="http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW"
{A7377303-F571-40F5-A397-5DFCF56521C9} Encyklopedie Seznam Url="http://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_12454"
{F9A51075-98E9-4CCF-9C81-2423E63626D1} Firmy.cz Url="http://www.firmy.cz/phr/{searchTerms}?sourceid=QuickSearch_12454"

==== Reset Google Chrome ======================

C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\Users\pc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\pc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=5258 folders=1215 991965721 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\pc\AppData\Local\temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\pc\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\pc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on po 01.01.2001 at 23:58:42,58 ======================

[tomas_ch]

ComboFix 15-10-01.01 - pc 02.01.2001 0:51.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3068.1638 [GMT 1:00]
Spuštěný z: c:\users\pc\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\Documents\NTIMP3.dll
c:\users\Public\Documents\NTIMPEG2.dll
c:\windows\system32\gatherWiredInfo.vbs
c:\windows\system32\gatherWirelessInfo.vbs
c:\windows\system32\InstallPackage_ETW.Log
c:\windows\system32\StructuredQuerySchemaTrivial.bin
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2000-12-02 do 2001-01-02 )))))))))))))))))))))))))))))))
.
.
2015-09-25 09:49 . 2015-09-25 10:31 -------- d-----w- C:\zoek_backup
2014-07-22 08:53 . 2000-12-31 23:44 -------- d-----w- C:\AdwCleaner
2014-07-22 08:07 . 2014-07-22 08:07 -------- d-----w- C:\totalcmd
2013-10-28 07:06 . 2013-10-28 07:06 -------- d-----r- C:\MSOCache
2011-03-11 14:36 . 2011-03-11 14:36 -------- d-----w- C:\CLSetup
2009-01-20 11:44 . 2001-01-01 02:35 -------- d-----w- C:\Boot
2009-01-20 11:39 . 2011-03-11 14:49 -------- d-----w- C:\ACER
2009-01-20 05:36 . 2009-01-20 05:37 -------- d---a-w- C:\book
2009-01-20 04:23 . 2009-01-20 04:23 -------- d-----w- C:\Intel
2008-01-21 02:32 . 2008-01-21 02:32 -------- d-----w- C:\PerfLogs
2007-12-06 06:56 . 2000-12-31 23:07 -------- d-----w- C:\TEMP
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-07 12:45 . 2001-01-01 07:33 568334 --s-a-w- c:\windows\inf\mskyncax\mskyncax.exe
2013-06-07 12:45 . 2001-01-01 07:32 84992 --s-a-w- c:\windows\inf\mskyncax\zlib1.dll
2013-06-07 12:45 . 2001-01-01 07:32 364544 --s-a-w- c:\windows\inf\mskyncax\ssleay32.dll
2013-06-07 12:45 . 2001-01-01 07:32 612352 --s-a-w- c:\windows\inf\mskyncax\libcurl.dll
2013-06-07 12:45 . 2001-01-01 07:32 279955 --s-a-w- c:\windows\inf\mskyncax\libidn-11.dll
2013-06-07 12:45 . 2001-01-01 07:32 183382 --s-a-w- c:\windows\inf\mskyncax\librtmp.dll
2013-06-07 12:45 . 2001-01-01 07:32 171008 --s-a-w- c:\windows\inf\mskyncax\libssh2.dll
2013-06-07 12:45 . 2001-01-01 07:32 1704448 --s-a-w- c:\windows\inf\mskyncax\libeay32.dll
2013-06-07 12:45 . 2001-01-01 07:32 110094 --s-a-w- c:\windows\inf\mskyncax\libusb-1.0.dll
2013-06-07 12:45 . 2000-12-31 23:36 568334 --s-a-w- c:\windows\inf\msecebq\msecebq.exe
2013-06-07 12:45 . 2000-12-31 23:36 84992 --s-a-w- c:\windows\inf\msecebq\zlib1.dll
2013-06-07 12:45 . 2000-12-31 23:36 364544 --s-a-w- c:\windows\inf\msecebq\ssleay32.dll
2013-06-07 12:45 . 2000-12-31 23:36 279955 --s-a-w- c:\windows\inf\msecebq\libidn-11.dll
2013-06-07 12:45 . 2000-12-31 23:36 183382 --s-a-w- c:\windows\inf\msecebq\librtmp.dll
2013-06-07 12:45 . 2000-12-31 23:36 171008 --s-a-w- c:\windows\inf\msecebq\libssh2.dll
2013-06-07 12:45 . 2000-12-31 23:36 1704448 --s-a-w- c:\windows\inf\msecebq\libeay32.dll
2013-06-07 12:45 . 2000-12-31 23:36 110094 --s-a-w- c:\windows\inf\msecebq\libusb-1.0.dll
2013-06-07 12:45 . 2000-12-31 23:36 612352 --s-a-w- c:\windows\inf\msecebq\libcurl.dll
2012-11-08 10:09 . 2012-11-08 10:09 203776 ----a-w- c:\windows\system32\webcheck.dll
2012-11-08 10:06 . 2012-11-08 10:06 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\dxgkrnl.sys.mui
2012-07-26 06:42 . 2001-01-01 03:46 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\wdf01000.sys.mui
2011-03-03 15:40 . 2011-07-24 08:36 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-07-24 08:36 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-07-24 08:36 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-07-24 08:36 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-02-19 22:03 . 2011-02-19 22:03 36176 ----a-w- c:\windows\system32\mfc100cht.dll
2011-02-19 22:03 . 2011-02-19 22:03 36176 ----a-w- c:\windows\system32\mfc100chs.dll
2009-11-04 02:05 . 2011-07-30 13:25 40960 ----a-w- c:\windows\system32\drivers\cs-CZ\http.sys.mui
2009-10-01 01:07 . 2012-11-08 10:58 3072 ----a-w- c:\windows\system32\drivers\UMDF\cs-CZ\wpdmtpdr.dll.mui
2009-04-11 17:35 . 2011-08-02 05:12 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\hdaudbus.sys.mui
2009-04-11 17:19 . 2011-08-02 05:12 7680 ----a-w- c:\windows\system32\drivers\cs-CZ\bthport.sys.mui
2009-04-11 06:28 . 2011-08-02 05:15 301568 ----a-w- c:\windows\system32\srchadmin.dll
2009-04-11 06:28 . 2011-08-02 05:15 409600 ----a-w- c:\windows\system32\msexch40.dll
2009-04-11 06:28 . 2011-08-02 05:13 40960 ----a-w- c:\windows\apppatch\apihex86.dll
2009-04-11 06:27 . 2011-08-02 05:14 643072 ----a-w- c:\windows\system32\autochk.exe
2008-11-01 03:44 . 2009-01-20 04:16 52736 ----a-w- c:\windows\apppatch\iebrshim.dll
2008-01-21 06:44 . 2008-01-21 06:44 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\battc.sys.mui
2008-01-21 06:44 . 2008-01-21 06:44 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\acpi.sys.mui
2008-01-21 06:44 . 2008-01-21 06:44 32768 ----a-w- c:\windows\system32\drivers\cs-CZ\volsnap.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5632 ----a-w- c:\windows\system32\drivers\cs-CZ\sermouse.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\mouclass.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\mouhid.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\i8042prt.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5120 ----a-w- c:\windows\system32\drivers\cs-CZ\tpm.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\kbdclass.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\kbdhid.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 7168 ----a-w- c:\windows\system32\drivers\cs-CZ\luafv.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5120 ----a-w- c:\windows\system32\drivers\cs-CZ\e100b325.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 20992 ----a-w- c:\windows\system32\drivers\cs-CZ\e1e6032.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\viac7.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\processr.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\intelppm.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\crusoe.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\amdk8.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\amdk7.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 17920 ----a-w- c:\windows\system32\drivers\cs-CZ\E1G60I32.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5632 ----a-w- c:\windows\system32\drivers\cs-CZ\b57nd60x.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 27648 ----a-w- c:\windows\system32\drivers\cs-CZ\mpio.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 9216 ----a-w- c:\windows\system32\drivers\cs-CZ\pci.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\isapnp.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\mssmbios.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\VIAAGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\ULIAGPKX.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\SISAGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\NV_AGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\AMDAGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\AGP440.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\qwavedrv.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\ati2mtag.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\wacompen.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\serial.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\SCR111.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\scmstcs.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\pscr.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\grserial.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\stcusb.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\gpr400.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\cxbp0wdm.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\cmbp0wdm.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\rndismpx.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\pnpmem.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\wd.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 7168 ----a-w- c:\windows\system32\drivers\cs-CZ\IPMIDrv.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\pcmcia.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\pacer.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\msdsm.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 9728 ----a-w- c:\windows\system32\drivers\cs-CZ\BrSerId.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\serscan.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\modem.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\ipnat.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 9728 ----a-w- c:\windows\system32\drivers\cs-CZ\afd.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 6656 ----a-w- c:\windows\system32\drivers\cs-CZ\yk60x86.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\hidbth.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 9728 ----a-w- c:\windows\system32\drivers\cs-CZ\ltmdmnt.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\srv.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\ati2mpad.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 65536 ----a-w- c:\windows\system32\drivers\cs-CZ\ntfs.sys.mui
2008-01-21 06:40 . 2008-01-21 06:40 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\ntrigdigi.sys.mui
2008-01-21 06:40 . 2008-01-21 06:40 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\parport.sys.mui
2008-01-21 06:40 . 2008-01-21 06:40 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\parvdm.sys.mui
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-29 16:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATIHLE.EXE" [2001-01-01 249440]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-08-07 53736048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-04 1037608]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 405504]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-29 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-05 13601312]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-05 92704]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2011-03-11 3719680]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-07-18 167936]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"Printsrv"="c:\windows\System32\Printing_Admin_Scripts\en-US\driverupd.vbs" [2013-12-04 559]
"mnchxmwboSrv"="c:\windows\inf\mnchxmwbo.vbe" [2014-01-19 1342]
"mnccqxddSrv"="c:\windows\inf\mnccqxdd.vbe" [2014-01-19 1342]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2015-07-14 5579624]
"Avira SystrayStartTrigger"="c:\program files\Avira\Launcher\Avira.SystrayStartTrigger.exe" [2015-08-13 66936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2011-03-11 14:16 3162624 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 01:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2011-07-22 20:22 30192 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-12-12 06:31 1840424 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-12-02 13:29 2221352 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProductReg]
2008-11-17 08:47 135168 ----a-w- c:\program files\Acer\WR_PopUp\ProductReg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\seznam-listicka-distribuce]
2012-09-13 13:24 1009288 ----a-w- c:\program files\Seznam.cz\distribution\szninstall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2014-07-25 11:29 256896 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-15 18:49 1104200 ----a-w- c:\program files\Google\Chrome\Application\36.0.1985.143\Installer\chrmstp.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\sign
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojeplatba.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-{315dd168-0794-4cf1-8355-f195cde642fc} - c:\programdata\Package Cache\{315dd168-0794-4cf1-8355-f195cde642fc}\Avira.OE.Setup.Bundle.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2001-01-02 01:22
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3280974334-3652872388-2672934827-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:86,5c,b4,55,ab,20,8a,4f,c6,af,dc,db,25,e6,75,b3,0a,60,e2,a4,a3,3a,e0,
c4,43,c7,2e,54,01,23,37,3e,4f,14,84,7d,53,14,a2,0f,50,4d,fe,5c,e1,75,61,72,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49
.
[HKEY_USERS\S-1-5-21-3280974334-3652872388-2672934827-1000\Software\SecuROM\License information*]
"datasecu"=hex:c2,54,50,8f,0b,61,1c,20,33,b7,eb,3c,0a,dd,6d,43,26,fe,56,fd,a7,
65,52,7a,8f,8a,72,b2,35,f6,8b,d6,74,b0,e3,cf,8e,32,24,14,e0,9f,2f,bf,e5,2f,\
"rkeysecu"=hex:4d,b3,60,ef,ec,a9,4b,08,56,91,60,9f,4c,b7,0c,7f
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Celkový čas: 2001-01-02 01:26:38
ComboFix-quarantined-files.txt 2001-01-02 00:26
ComboFix2.txt 2015-09-25 13:09
.
Před spuštěním: Volných bajtů: 36 961 566 720
Po spuštění: Volných bajtů: 37 039 816 704
.
- - End Of File - - C8AF602301B6577B775D20B5D25602BD
BB9D3A6A13C5010348DA7C900BB6AF50

[jerabina]

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému.

Toto otestuj na Virustotal
c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::

Collect::
c:\windows\inf\mnchxmwbo.vbe
c:\windows\inf\mnccqxdd.vbe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mnchxmwboSrv"=-
"mnccqxddSrv"=-
"LogMeIn Hamachi Ui"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\seznam-listicka-distribuce]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

RegLock::
[HKEY_USERS\S-1-5-21-3280974334-3652872388-2672934827-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:86,5c,b4,55,ab,20,8a,4f,c6,af,dc,db,25,e6,75,b3,0a,60,e2,a4,a3,3a,e0,
 c4,43,c7,2e,54,01,23,37,3e,4f,14,84,7d,53,14,a2,0f,50,4d,fe,5c,e1,75,61,72,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49

[HKEY_USERS\S-1-5-21-3280974334-3652872388-2672934827-1000\Software\SecuROM\License information*]
"datasecu"=hex:c2,54,50,8f,0b,61,1c,20,33,b7,eb,3c,0a,dd,6d,43,26,fe,56,fd,a7,
 65,52,7a,8f,8a,72,b2,35,f6,8b,d6,74,b0,e3,cf,8e,32,24,14,e0,9f,2f,bf,e5,2f,\
"rkeysecu"=hex:4d,b3,60,ef,ec,a9,4b,08,56,91,60,9f,4c,b7,0c,7f

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť:

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu, klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[tomas_ch]

https://www.virustotal.com/cs/file/23dd ... ize=167936

[tomas_ch]

ComboFix 15-10-01.01 - pc 01.01.2001 0:24.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3068.1610 [GMT 1:00]
Spuštěný z: c:\users\pc\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\pc\Desktop\CFScript.txt
.
file zipped: c:\windows\inf\mnccqxdd.vbe
file zipped: c:\windows\inf\mnchxmwbo.vbe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2000-11-28 do 2000-12-31 )))))))))))))))))))))))))))))))
.
.
2015-09-25 09:49 . 2015-09-25 10:31 -------- d-----w- C:\zoek_backup
2014-07-22 08:53 . 2000-12-31 23:44 -------- d-----w- C:\AdwCleaner
2014-07-22 08:07 . 2014-07-22 08:07 -------- d-----w- C:\totalcmd
2013-10-28 07:06 . 2013-10-28 07:06 -------- d-----r- C:\MSOCache
2011-03-11 14:36 . 2011-03-11 14:36 -------- d-----w- C:\CLSetup
2009-01-20 11:44 . 2001-01-01 02:35 -------- d-----w- C:\Boot
2009-01-20 11:39 . 2011-03-11 14:49 -------- d-----w- C:\ACER
2009-01-20 05:36 . 2009-01-20 05:37 -------- d---a-w- C:\book
2009-01-20 04:23 . 2009-01-20 04:23 -------- d-----w- C:\Intel
2008-01-21 02:32 . 2008-01-21 02:32 -------- d-----w- C:\PerfLogs
2007-12-06 06:56 . 2000-12-31 23:07 -------- d-----w- C:\TEMP
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-07 12:45 . 2001-01-01 07:33 568334 --s-a-w- c:\windows\inf\mskyncax\mskyncax.exe
2013-06-07 12:45 . 2001-01-01 07:32 84992 --s-a-w- c:\windows\inf\mskyncax\zlib1.dll
2013-06-07 12:45 . 2001-01-01 07:32 364544 --s-a-w- c:\windows\inf\mskyncax\ssleay32.dll
2013-06-07 12:45 . 2001-01-01 07:32 612352 --s-a-w- c:\windows\inf\mskyncax\libcurl.dll
2013-06-07 12:45 . 2001-01-01 07:32 279955 --s-a-w- c:\windows\inf\mskyncax\libidn-11.dll
2013-06-07 12:45 . 2001-01-01 07:32 183382 --s-a-w- c:\windows\inf\mskyncax\librtmp.dll
2013-06-07 12:45 . 2001-01-01 07:32 171008 --s-a-w- c:\windows\inf\mskyncax\libssh2.dll
2013-06-07 12:45 . 2001-01-01 07:32 1704448 --s-a-w- c:\windows\inf\mskyncax\libeay32.dll
2013-06-07 12:45 . 2001-01-01 07:32 110094 --s-a-w- c:\windows\inf\mskyncax\libusb-1.0.dll
2013-06-07 12:45 . 2000-12-31 23:36 568334 --s-a-w- c:\windows\inf\msecebq\msecebq.exe
2013-06-07 12:45 . 2000-12-31 23:36 84992 --s-a-w- c:\windows\inf\msecebq\zlib1.dll
2013-06-07 12:45 . 2000-12-31 23:36 364544 --s-a-w- c:\windows\inf\msecebq\ssleay32.dll
2013-06-07 12:45 . 2000-12-31 23:36 279955 --s-a-w- c:\windows\inf\msecebq\libidn-11.dll
2013-06-07 12:45 . 2000-12-31 23:36 183382 --s-a-w- c:\windows\inf\msecebq\librtmp.dll
2013-06-07 12:45 . 2000-12-31 23:36 171008 --s-a-w- c:\windows\inf\msecebq\libssh2.dll
2013-06-07 12:45 . 2000-12-31 23:36 1704448 --s-a-w- c:\windows\inf\msecebq\libeay32.dll
2013-06-07 12:45 . 2000-12-31 23:36 110094 --s-a-w- c:\windows\inf\msecebq\libusb-1.0.dll
2013-06-07 12:45 . 2000-12-31 23:36 612352 --s-a-w- c:\windows\inf\msecebq\libcurl.dll
2012-11-08 10:09 . 2012-11-08 10:09 203776 ----a-w- c:\windows\system32\webcheck.dll
2012-11-08 10:06 . 2012-11-08 10:06 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\dxgkrnl.sys.mui
2012-07-26 06:42 . 2001-01-01 03:46 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\wdf01000.sys.mui
2011-03-03 15:40 . 2011-07-24 08:36 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-07-24 08:36 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-07-24 08:36 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-07-24 08:36 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-02-19 22:03 . 2011-02-19 22:03 36176 ----a-w- c:\windows\system32\mfc100cht.dll
2011-02-19 22:03 . 2011-02-19 22:03 36176 ----a-w- c:\windows\system32\mfc100chs.dll
2009-11-04 02:05 . 2011-07-30 13:25 40960 ----a-w- c:\windows\system32\drivers\cs-CZ\http.sys.mui
2009-10-01 01:07 . 2012-11-08 10:58 3072 ----a-w- c:\windows\system32\drivers\UMDF\cs-CZ\wpdmtpdr.dll.mui
2009-04-11 17:35 . 2011-08-02 05:12 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\hdaudbus.sys.mui
2009-04-11 17:19 . 2011-08-02 05:12 7680 ----a-w- c:\windows\system32\drivers\cs-CZ\bthport.sys.mui
2009-04-11 06:28 . 2011-08-02 05:15 301568 ----a-w- c:\windows\system32\srchadmin.dll
2009-04-11 06:28 . 2011-08-02 05:15 409600 ----a-w- c:\windows\system32\msexch40.dll
2009-04-11 06:28 . 2011-08-02 05:13 40960 ----a-w- c:\windows\apppatch\apihex86.dll
2009-04-11 06:27 . 2011-08-02 05:14 643072 ----a-w- c:\windows\system32\autochk.exe
2008-11-01 03:44 . 2009-01-20 04:16 52736 ----a-w- c:\windows\apppatch\iebrshim.dll
2008-01-21 06:44 . 2008-01-21 06:44 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\battc.sys.mui
2008-01-21 06:44 . 2008-01-21 06:44 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\acpi.sys.mui
2008-01-21 06:44 . 2008-01-21 06:44 32768 ----a-w- c:\windows\system32\drivers\cs-CZ\volsnap.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5632 ----a-w- c:\windows\system32\drivers\cs-CZ\sermouse.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\mouclass.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\mouhid.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\i8042prt.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5120 ----a-w- c:\windows\system32\drivers\cs-CZ\tpm.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\kbdclass.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\kbdhid.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 7168 ----a-w- c:\windows\system32\drivers\cs-CZ\luafv.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5120 ----a-w- c:\windows\system32\drivers\cs-CZ\e100b325.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 20992 ----a-w- c:\windows\system32\drivers\cs-CZ\e1e6032.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\viac7.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\processr.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\intelppm.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\crusoe.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\amdk8.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 21504 ----a-w- c:\windows\system32\drivers\cs-CZ\amdk7.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 17920 ----a-w- c:\windows\system32\drivers\cs-CZ\E1G60I32.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 5632 ----a-w- c:\windows\system32\drivers\cs-CZ\b57nd60x.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 27648 ----a-w- c:\windows\system32\drivers\cs-CZ\mpio.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 9216 ----a-w- c:\windows\system32\drivers\cs-CZ\pci.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\isapnp.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\mssmbios.sys.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\VIAAGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\ULIAGPKX.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\SISAGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\NV_AGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\AMDAGP.SYS.mui
2008-01-21 06:43 . 2008-01-21 06:43 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\AGP440.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\qwavedrv.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\ati2mtag.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\wacompen.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 10240 ----a-w- c:\windows\system32\drivers\cs-CZ\serial.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\SCR111.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\scmstcs.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\pscr.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\grserial.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\stcusb.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\gpr400.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\cxbp0wdm.sys.mui
2008-01-21 06:42 . 2008-01-21 06:42 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\cmbp0wdm.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\rndismpx.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\pnpmem.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 2560 ----a-w- c:\windows\system32\drivers\cs-CZ\wd.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 7168 ----a-w- c:\windows\system32\drivers\cs-CZ\IPMIDrv.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\pcmcia.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\pacer.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\msdsm.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 9728 ----a-w- c:\windows\system32\drivers\cs-CZ\BrSerId.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\serscan.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\modem.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\ipnat.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 9728 ----a-w- c:\windows\system32\drivers\cs-CZ\afd.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 6656 ----a-w- c:\windows\system32\drivers\cs-CZ\yk60x86.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3584 ----a-w- c:\windows\system32\drivers\cs-CZ\hidbth.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 9728 ----a-w- c:\windows\system32\drivers\cs-CZ\ltmdmnt.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\srv.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\ati2mpad.sys.mui
2008-01-21 06:41 . 2008-01-21 06:41 65536 ----a-w- c:\windows\system32\drivers\cs-CZ\ntfs.sys.mui
2008-01-21 06:40 . 2008-01-21 06:40 4608 ----a-w- c:\windows\system32\drivers\cs-CZ\ntrigdigi.sys.mui
2008-01-21 06:40 . 2008-01-21 06:40 4096 ----a-w- c:\windows\system32\drivers\cs-CZ\parport.sys.mui
2008-01-21 06:40 . 2008-01-21 06:40 3072 ----a-w- c:\windows\system32\drivers\cs-CZ\parvdm.sys.mui
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-29 16:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATIHLE.EXE" [2001-01-01 249440]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-04 1037608]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 405504]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-29 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-05 13601312]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-05 92704]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2011-03-11 3719680]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-07-18 167936]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"Printsrv"="c:\windows\System32\Printing_Admin_Scripts\en-US\driverupd.vbs" [2013-12-04 559]
"Avira SystrayStartTrigger"="c:\program files\Avira\Launcher\Avira.SystrayStartTrigger.exe" [2015-08-13 66936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2011-03-11 14:16 3162624 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 01:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-12-12 06:31 1840424 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-12-02 13:29 2221352 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProductReg]
2008-11-17 08:47 135168 ----a-w- c:\program files\Acer\WR_PopUp\ProductReg.exe
.
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-15 18:49 1104200 ----a-w- c:\program files\Google\Chrome\Application\36.0.1985.143\Installer\chrmstp.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\sign
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojeplatba.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2001-01-01 00:51
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3280974334-3652872388-2672934827-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:86,5c,b4,55,ab,20,8a,4f,c6,af,dc,db,25,e6,75,b3,0a,60,e2,a4,a3,3a,e0,
c4,43,c7,2e,54,01,23,37,3e,4f,14,84,7d,53,14,a2,0f,50,4d,fe,5c,e1,75,61,72,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49
.
[HKEY_USERS\S-1-5-21-3280974334-3652872388-2672934827-1000\Software\SecuROM\License information*]
"datasecu"=hex:c2,54,50,8f,0b,61,1c,20,33,b7,eb,3c,0a,dd,6d,43,26,fe,56,fd,a7,
65,52,7a,8f,8a,72,b2,35,f6,8b,d6,74,b0,e3,cf,8e,32,24,14,e0,9f,2f,bf,e5,2f,\
"rkeysecu"=hex:4d,b3,60,ef,ec,a9,4b,08,56,91,60,9f,4c,b7,0c,7f
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(664)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\system32\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe
c:\windows\system32\vfsFPService.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\Acer\Empowering Technology\Service\ETService.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Acer\Acer Bio Protection\BASVC.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\LogMeIn Hamachi\LMIGuardianSvc.exe
c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Acer\Acer VCM\RS_Service.exe
c:\program files\LogMeIn Hamachi\hamachi-2.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
c:\windows\system32\conime.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
.
**************************************************************************
.
Celkový čas: 2001-01-01 01:01:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2001-01-01 00:00
ComboFix2.txt 2001-01-02 00:26
ComboFix3.txt 2015-09-25 13:09
.
Před spuštěním: Volných bajtů: 39 512 358 912
Po spuštění: Volných bajtů: 39 389 667 328
.
- - End Of File - - E2E028B14EA8358CB09321134FFC6CD5
BB9D3A6A13C5010348DA7C900BB6AF50

[tomas_ch]

aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2001-01-01 01:05:27
-----------------------------
01:05:27.443 OS Version: Windows 6.0.6002 Service Pack 2
01:05:27.443 Number of processors: 2 586 0xF0D
01:05:27.443 ComputerName: PC-PC UserName: pc
01:05:30.064 Initialize success
01:05:30.127 VM: initialized successfully
01:05:30.127 VM: Intel CPU virtualization not supported
01:06:30.132 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
01:06:30.148 Disk 0 Vendor: FUJITSU_ 8919 Size: 305245MB BusType: 3
01:06:30.257 Disk 0 MBR read successfully
01:06:30.273 Disk 0 MBR scan
01:06:30.273 Disk 0 unknown MBR code
01:06:32.503 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 13000 MB offset 2048
01:06:32.519 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 146119 MB offset 26626048
01:06:32.550 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 141004 MB offset 325877760
01:06:32.597 Disk 0 Partition 4 00 12 Compaq diag NTFS 5120 MB offset 614653952
01:06:32.644 Disk 0 scanning sectors +625139712
01:06:32.862 Disk 0 scanning C:\Windows\system32\drivers
01:06:42.097 Service scanning
01:07:09.507 Modules scanning
01:07:09.522 Disk 0 trace - called modules:
01:07:09.553 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll dxgkrnl.sys nvlddmkm.sys watchdog.sys
01:07:09.569 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86cae8d8]
01:07:09.585 3 CLASSPNP.SYS[8ad9d8b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85951028]
01:07:09.585 Disk 0 statistics 92116/0/0 @ 4,37 MB/s
01:07:09.600 Scan finished successfully
01:07:19.303 Disk 0 MBR has been saved successfully to "C:\Users\pc\Desktop\MBR.dat"
01:07:19.319 The log file has been saved successfully to "C:\Users\pc\Desktop\aswMBR.txt"

[Orcus]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

====================================================

Vyčisti systém CCleanerem

====================================================

Stáhni si zde DelFix
http://general-changelog-team.fr/fr/dow ... e/9-delfix

ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore) .
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci.

Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem. Jinak je zpráva zde:
v C: \ DelFix.txt

Co problémy? + nový log z HJT

[tomas_ch]

Ahoj,
k tomu pocitaci se dostanu zase az v pondeli.
Zaslu log z DELFIXU.
Zatim diky moc.

T.

[Orcus]

OK.