Podozrenie na vir Vyřešeno

[cobr4in]

Zdravim,
stiahol som si jeden keygen, ktory mi Microsoft Security Essentials oznacil za ponencialnu, moznu hrozbu - Worm. Oznacil tak uz viac veci, dokonca raz aj Battlefield 3 (origos), tak som tomu nevenoval pozornost, a vybral som moznost "povolit". Vtedy, neviem, ci je to nahoda, mi zacal ist pomalsie net. Bohuzial, v poslednom case (ako kazdu zimu), mi ide net pomalsie prakticky neustale, takze neviem, ci je to "virom", alebo klasicky pocasim, ci pretazenostou siete. Samozrejme som nechal vyssie menovanych programov preskenovat cely pocitac, ale nic nenasiel. Zvlastne bolo, ze ked som sa pokusal odstranit keygen rucne, tak mi pisalo, ze je pouzivany inym programom, ale v procesoch nic zvlastne nebolo. Po restarte PC uz odstranit siel. Toto ma utvrdilo, ze nieco nie je v poriadku.
Co myslite Vy?

[Reklama]

[bereline]

Když jsi antivirem projížděl počítač nic nenašel ?

Doporučuji udělat log z HiJackThis a hodit do správné sekce, návod nalezneš zde - viewtopic.php?f=70&t=5119
Stáhni si ještě CCleaner a pročisti, návod nalezneš zde - viewtopic.php?t=5130

Stáhni si ještě toto:

Kód: Vybrat vše

http://www.stahuj.centrum.cz/utility_a_ostatni/antiviry/kompletni/antivir-drwebr/

Je to sice Shareware na 20 dní, ale určitě s ním pročisti znovu PC.

[cobr4in]

Ten antivir, co si mi odporucal, mi nenasiel vir, ale nasiel infikovany subor - slo o themeui.dll (c/windows/system32), stav Win32.HLLM.Graz.based. Zmazal som ho. Mam stiahnut novy? Resp., co je to za subor?

[memphisto]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po probìhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[cobr4in]

Znova som pouzil antivir od bereline, no tentoraz som vybral hlbkovy scen, a nasiel dalsie 2 viry, resp. 2 subory, ktore som zmazal. Potom som pouzil memphistom navrhovany postup, no vynechal som prvy krok, pretoze pouzivam chrome.
Prikladam log pre memphista z kroku c. 2:

Malwarebytes' Anti-Malware 1.51.2.1300
http://www.malwarebytes.org

Verzia databázy: 8371

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

14. 12. 2011 21:56:20
mbam-log-2011-12-14 (21-56-14).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 181860
Uplynutý čas: 28 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 2

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
c:\Users\cobain_sk\AppData\Roaming\svchost.exe (Trojan.Agent) -> No action taken.
c:\Users\cobain_sk\AppData\Roaming\userinit.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.

[memphisto]

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštìní se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynù, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by mìl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[cobr4in]

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verzia databázy: 8371

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

14. 12. 2011 22:05:02
mbam-log-2011-12-14 (22-05-02).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 181937
Uplynutý čas: 23 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 2

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
c:\Users\cobain_sk\AppData\Roaming\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\cobain_sk\AppData\Roaming\userinit.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Pre dokoncenie procesu odstranovania musi byt restartovany PC, tak restartujem, potom aplikujem combofix.

[cobr4in]

Prikladam log z ComboFix:

ComboFix 11-12-13.03 - CoBain_SK . 12. 2011 22:10:29.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.8167.6820 [GMT 1:00]
Running from: c:\users\CoBain_SK\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))
.
.
2011-12-14 21:12 . 2011-12-14 21:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-14 21:07 . 2011-12-14 21:07 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2D28B492-9E8E-4CBD-A7E5-6D78A2BA65D3}\offreg.dll
2011-12-14 20:52 . 2011-12-14 20:52 -------- d-----w- c:\programdata\Malwarebytes
2011-12-14 20:52 . 2011-08-31 16:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-14 20:19 . 2011-11-21 02:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2D28B492-9E8E-4CBD-A7E5-6D78A2BA65D3}\mpengine.dll
2011-12-14 20:01 . 2011-12-14 20:01 77824 ----atw- c:\windows\SysWow64\DRWEBSP.DLL
2011-12-13 17:50 . 2011-12-13 17:50 -------- d-----w- c:\program files\Core Temp
2011-12-12 13:54 . 2011-03-25 03:29 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-12-12 12:17 . 2011-12-12 12:18 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2011-12-12 11:41 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2011-12-12 11:41 . 2011-02-19 12:04 1544192 ----a-w- c:\windows\system32\DWrite.dll
2011-12-12 11:41 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-12-12 11:41 . 2011-02-19 06:30 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-12-12 11:41 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-12-12 11:39 . 2011-12-12 11:39 -------- d-----w- c:\program files (x86)\Microsoft.NET
2011-12-12 10:22 . 2011-12-12 10:22 -------- d-----w- c:\program files\ASUS
2011-12-12 10:22 . 2011-10-07 10:34 46152 ----a-w- c:\windows\SysWow64\drivers\ASUSFILTER.sys
2011-12-12 10:22 . 2008-12-02 19:05 184320 ----a-w- c:\windows\SysWow64\drivers\UpdateHelper.dll
2011-12-12 10:22 . 2011-12-12 10:22 -------- d-----w- c:\programdata\ASUS
2011-12-12 10:22 . 2011-10-07 10:34 10216 ------w- c:\windows\SysWow64\drivers\AsInsHelp32.sys
2011-12-12 10:22 . 2011-10-07 10:34 11832 ------w- c:\windows\SysWow64\drivers\AsInsHelp64.sys
2011-12-12 10:21 . 2011-12-12 10:21 -------- d-----w- c:\program files (x86)\ASM104xUSB3
2011-12-12 10:21 . 2011-12-12 10:22 -------- d-----w- c:\program files (x86)\ASUS
2011-12-12 10:21 . 2011-10-07 10:34 28672 ----a-w- c:\windows\SysWow64\AsIO.dll
2011-12-12 10:21 . 2011-10-07 10:34 13440 ----a-w- c:\windows\SysWow64\drivers\AsIO.sys
2011-12-12 10:16 . 2011-12-12 10:16 -------- d-----w- c:\program files (x86)\Intel
2011-12-12 10:16 . 2010-12-23 10:09 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2011-12-12 10:15 . 2011-12-12 10:15 -------- d-----w- C:\Intel
2011-12-12 10:14 . 2011-07-20 08:37 342704 ----a-w- c:\windows\system32\drivers\e1c62x64.sys
2011-12-12 10:14 . 2011-06-30 00:13 68264 ----a-w- c:\windows\system32\e1cmsg.dll
2011-12-12 10:14 . 2011-06-16 00:02 98496 ----a-w- c:\windows\system32\NicInstC.dll
2011-12-12 10:14 . 2011-12-12 10:14 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-12-12 09:06 . 2011-12-12 09:06 -------- d-----w- c:\windows\SysWow64\Wat
2011-12-12 09:06 . 2011-12-12 09:06 -------- d-----w- c:\windows\system32\Wat
2011-12-12 05:36 . 2011-12-14 19:25 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-12-12 05:33 . 2011-12-12 05:33 -------- d-----w- c:\programdata\EA Core
2011-12-12 03:01 . 2011-07-16 05:41 362496 ----a-w- c:\windows\system32\wow64win.dll
2011-12-12 02:56 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-12-12 02:56 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
2011-12-12 02:56 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-12-12 02:56 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2011-12-12 02:56 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-12 02:56 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-12 02:54 . 2011-05-04 05:25 2315776 ----a-w- c:\windows\system32\tquery.dll
2011-12-12 02:51 . 2011-02-24 06:15 476160 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-12-12 02:51 . 2011-02-24 05:38 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-12-12 02:51 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-12-12 02:50 . 2011-03-11 06:34 1359872 ----a-w- c:\windows\system32\mfc42u.dll
2011-12-12 02:50 . 2011-03-11 06:34 1395712 ----a-w- c:\windows\system32\mfc42.dll
2011-12-12 02:50 . 2011-03-11 05:33 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll
2011-12-12 02:50 . 2011-03-11 05:33 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll
2011-12-12 02:47 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-12-12 02:47 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-12-12 02:47 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-12-12 02:47 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
2011-12-12 02:47 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
2011-12-12 02:46 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
2011-12-12 02:46 . 2011-08-17 05:25 108032 ----a-w- c:\windows\system32\psisrndr.ax
2011-12-12 02:46 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll
2011-12-12 02:46 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax
2011-12-12 02:44 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
2011-12-12 02:44 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
2011-12-12 02:44 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
2011-12-12 02:44 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
2011-12-12 02:44 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
2011-12-12 02:44 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
2011-12-12 02:44 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
2011-12-12 02:42 . 2011-05-24 11:42 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-12-12 02:42 . 2011-05-24 10:40 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-12-12 02:42 . 2011-05-24 10:40 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-12-12 02:42 . 2011-05-24 10:39 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-12-12 02:42 . 2011-05-24 10:37 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2011-12-12 02:42 . 2011-02-18 10:51 31232 ----a-w- c:\windows\system32\prevhost.exe
2011-12-12 02:42 . 2011-02-18 05:39 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
2011-12-12 02:42 . 2011-02-12 11:34 267776 ----a-w- c:\windows\system32\FXSCOVER.exe
2011-12-12 02:40 . 2011-02-23 04:55 90624 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-12-12 02:40 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-12 02:40 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-12-12 02:40 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-12-11 17:50 . 2011-12-11 17:50 -------- d-----w- c:\windows\74224F8D4A1748169EDB7BB854DE532C.TMP
2011-12-11 17:50 . 2011-12-11 17:50 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2011-12-11 17:41 . 2011-12-11 17:41 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-12-11 17:41 . 2011-12-11 17:41 -------- d-----w- c:\programdata\DAEMON Tools Lite
2011-12-11 17:02 . 2007-10-22 02:40 411656 ----a-w- c:\windows\system32\xactengine2_10.dll
2011-12-11 16:48 . 2011-12-14 20:01 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2011-12-11 16:45 . 2011-12-12 10:22 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2011-12-11 16:40 . 2011-12-13 17:47 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2011-12-11 16:22 . 2011-12-12 05:34 -------- d-----w- c:\programdata\Origin
2011-12-11 16:22 . 2011-12-12 05:33 -------- d-----w- c:\programdata\Electronic Arts
2011-12-11 16:22 . 2011-12-11 16:36 -------- d-----w- c:\program files (x86)\Origin Games
2011-12-11 16:01 . 2011-12-11 16:01 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4382D714-977A-4BD0-AE8F-68A5AE80969F}\gapaengine.dll
2011-12-11 15:59 . 2011-12-11 15:59 -------- d-----w- c:\program files (x86)\Common Files\LogiShrd
2011-12-11 15:59 . 2011-12-11 15:59 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-12-11 15:59 . 2011-12-11 15:59 -------- d-----w- c:\programdata\Logishrd
2011-12-11 15:59 . 2011-12-11 15:59 -------- d-----w- c:\program files\Logitech
2011-12-11 15:58 . 2011-12-11 15:59 -------- d-----w- c:\program files\Common Files\Logishrd
2011-12-11 15:37 . 2011-12-11 15:37 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2011-12-11 15:37 . 2011-12-11 15:37 -------- d-----w- c:\program files\Microsoft Security Client
2011-12-11 15:30 . 2011-12-11 15:30 -------- d-----w- c:\users\UpdatusUser
2011-12-11 15:30 . 2011-12-14 21:07 -------- d-----w- c:\programdata\NVIDIA
2011-12-11 15:30 . 2011-12-11 15:30 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2011-12-11 15:30 . 2011-10-15 08:53 837952 ----a-w- c:\windows\system32\easyupdatusapiu64.dll
2011-12-11 15:30 . 2011-10-15 08:53 5067584 ----a-w- c:\windows\system32\nvsvc64.dll
2011-12-11 15:30 . 2011-10-15 08:53 3074368 ----a-w- c:\windows\system32\nvsvcr.dll
2011-12-11 15:30 . 2011-10-15 08:53 222528 ----a-w- c:\windows\system32\nvmctray.dll
2011-12-11 15:30 . 2011-10-15 08:53 1640768 ----a-w- c:\windows\system32\nvvsvc.exe
2011-12-11 15:30 . 2011-10-15 08:53 137536 ----a-w- c:\windows\system32\nvshext.dll
2011-12-11 15:30 . 2011-10-15 08:53 10406208 ----a-w- c:\windows\system32\nvcpl.dll
2011-12-11 15:30 . 2011-12-11 15:30 -------- d-----w- c:\programdata\NVIDIA Corporation
2011-12-11 15:28 . 2011-07-26 11:57 355016 ----a-w- c:\windows\system32\PROUnstl.exe
2011-12-11 15:27 . 2009-05-26 02:05 36472 ----a-w- c:\windows\system32\NicCo36.dll
2011-12-11 15:27 . 2011-12-12 17:22 -------- d-sh--w- c:\windows\Installer
2011-12-11 14:37 . 2011-12-14 20:04 -------- d-----w- c:\users\CoBain_SK
2011-12-11 14:37 . 2011-12-11 14:37 -------- d-----w- C:\Recovery
2011-12-11 14:06 . 2011-12-11 14:37 -------- d-----w- c:\windows\Panther
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-14 23:54 . 2011-10-14 23:54 321856 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EADM"="d:\programy\Origin\Origin.exe" [2011-11-07 28846216]
"DAEMON Tools Lite"="d:\programy\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="d:\programy\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SpIDerMail"="d:\programy\DrWeb\spiderml.exe" [2008-06-10 501080]
"Malwarebytes' Anti-Malware"="d:\programy\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\CoBain_SK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech . Registrácia výrobku.lnk - c:\program files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ALSysIO;ALSysIO;c:\users\COBAIN~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola siete od spoločnosti Microsoft;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.14\atkexComSvc.exe [2011-10-07 922240]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [2011-10-07 915584]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2011-10-07 586880]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [x]
S2 MBAMService;MBAMService;d:\programy\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 ASUSFILTER;ASUSFILTER;SysWow64\drivers\ASUSFILTER.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-14 c:\windows\Tasks\Dr.Web automatic update.job
- d:\programy\DrWeb\drwebupw.exe [2011-12-14 13:36]
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4102318988-3621349773-3221444336-1000Core.job
- c:\users\CoBain_SK\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 15:34]
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4102318988-3621349773-3221444336-1000UA.job
- c:\users\CoBain_SK\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 15:34]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
LSP: c:\windows\system32\DRWEBSP.DLL
TCP: DhcpNameServer = 192.168.4.1
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-12-14 22:13:04
ComboFix-quarantined-files.txt 2011-12-14 21:13
.
Pre-Run: 23 314 788 352 bytes free
Post-Run: 23 295 778 816 bytes free
.
- - End Of File - - 068B8AE54585B895C3C281237DF99431

[Žbeky]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::

Folder::
c:\windows\74224F8D4A1748169EDB7BB854DE532C.TMP

File::
c:\users\COBAIN~1\AppData\Local\Temp\ALSysIO64.sys
c:\windows\Tasks\Dr.Web automatic update.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4102318988-3621349773-3221444336-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4102318988-3621349773-3221444336-1000UA.job

Driver::
ALSysIO

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=-

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[cobr4in]

Pred koncom to restartlo PC, po restarte vyzivalo na odstranenie niektorych suborov, nejake nepovolene kluce registra, alebo cosi take, tak som len potvrdil - ina moznost nebola. Tu je log:


ComboFix 11-12-13.03 - CoBain_SK . 12. 2011 23:21:56.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.8167.6510 [GMT 1:00]
Running from: c:\users\CoBain_SK\Desktop\ComboFix.exe
Command switches used :: c:\users\CoBain_SK\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ALSYSIO
-------\Service_ALSysIO
.
.
((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))
.
.
2011-12-14 22:24 . 2011-12-14 22:24 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2D28B492-9E8E-4CBD-A7E5-6D78A2BA65D3}\offreg.dll
2011-12-14 20:52 . 2011-12-14 20:52 -------- d-----w- c:\programdata\Malwarebytes
2011-12-14 20:52 . 2011-08-31 16:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-14 20:19 . 2011-11-21 02:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2D28B492-9E8E-4CBD-A7E5-6D78A2BA65D3}\mpengine.dll
2011-12-14 20:01 . 2011-12-14 20:01 77824 ----atw- c:\windows\SysWow64\DRWEBSP.DLL
2011-12-13 17:50 . 2011-12-13 17:50 -------- d-----w- c:\program files\Core Temp
2011-12-12 13:54 . 2011-03-25 03:29 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-12-12 12:17 . 2011-12-12 12:18 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2011-12-12 11:41 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2011-12-12 11:41 . 2011-02-19 12:04 1544192 ----a-w- c:\windows\system32\DWrite.dll
2011-12-12 11:41 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-12-12 11:41 . 2011-02-19 06:30 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2011-12-12 11:41 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-12-12 11:39 . 2011-12-12 11:39 -------- d-----w- c:\program files (x86)\Microsoft.NET
2011-12-12 10:22 . 2011-12-12 10:22 -------- d-----w- c:\program files\ASUS
2011-12-12 10:22 . 2011-10-07 10:34 46152 ----a-w- c:\windows\SysWow64\drivers\ASUSFILTER.sys
2011-12-12 10:22 . 2008-12-02 19:05 184320 ----a-w- c:\windows\SysWow64\drivers\UpdateHelper.dll
2011-12-12 10:22 . 2011-12-12 10:22 -------- d-----w- c:\programdata\ASUS
2011-12-12 10:22 . 2011-10-07 10:34 10216 ------w- c:\windows\SysWow64\drivers\AsInsHelp32.sys
2011-12-12 10:22 . 2011-10-07 10:34 11832 ------w- c:\windows\SysWow64\drivers\AsInsHelp64.sys
2011-12-12 10:21 . 2011-12-12 10:21 -------- d-----w- c:\program files (x86)\ASM104xUSB3
2011-12-12 10:21 . 2011-12-12 10:22 -------- d-----w- c:\program files (x86)\ASUS
2011-12-12 10:21 . 2011-10-07 10:34 28672 ----a-w- c:\windows\SysWow64\AsIO.dll
2011-12-12 10:21 . 2011-10-07 10:34 13440 ----a-w- c:\windows\SysWow64\drivers\AsIO.sys
2011-12-12 10:16 . 2011-12-12 10:16 -------- d-----w- c:\program files (x86)\Intel
2011-12-12 10:16 . 2010-12-23 10:09 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2011-12-12 10:15 . 2011-12-12 10:15 -------- d-----w- C:\Intel
2011-12-12 10:14 . 2011-07-20 08:37 342704 ----a-w- c:\windows\system32\drivers\e1c62x64.sys
2011-12-12 10:14 . 2011-06-30 00:13 68264 ----a-w- c:\windows\system32\e1cmsg.dll
2011-12-12 10:14 . 2011-06-16 00:02 98496 ----a-w- c:\windows\system32\NicInstC.dll
2011-12-12 10:14 . 2011-12-12 10:14 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-12-12 09:06 . 2011-12-12 09:06 -------- d-----w- c:\windows\SysWow64\Wat
2011-12-12 09:06 . 2011-12-12 09:06 -------- d-----w- c:\windows\system32\Wat
2011-12-12 05:36 . 2011-12-14 22:14 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-12-12 05:33 . 2011-12-12 05:33 -------- d-----w- c:\programdata\EA Core
2011-12-12 03:01 . 2011-07-16 05:41 362496 ----a-w- c:\windows\system32\wow64win.dll
2011-12-12 02:56 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-12-12 02:56 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
2011-12-12 02:56 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-12-12 02:56 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2011-12-12 02:56 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-12 02:56 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-12 02:54 . 2011-05-04 05:25 2315776 ----a-w- c:\windows\system32\tquery.dll
2011-12-12 02:51 . 2011-02-24 06:15 476160 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-12-12 02:51 . 2011-02-24 05:38 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-12-12 02:51 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-12-12 02:50 . 2011-03-11 06:34 1359872 ----a-w- c:\windows\system32\mfc42u.dll
2011-12-12 02:50 . 2011-03-11 06:34 1395712 ----a-w- c:\windows\system32\mfc42.dll
2011-12-12 02:50 . 2011-03-11 05:33 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll
2011-12-12 02:50 . 2011-03-11 05:33 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll
2011-12-12 02:47 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-12-12 02:47 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-12-12 02:47 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-12-12 02:47 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
2011-12-12 02:47 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
2011-12-12 02:46 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
2011-12-12 02:46 . 2011-08-17 05:25 108032 ----a-w- c:\windows\system32\psisrndr.ax
2011-12-12 02:46 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll
2011-12-12 02:46 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax
2011-12-12 02:44 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
2011-12-12 02:44 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
2011-12-12 02:44 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
2011-12-12 02:44 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
2011-12-12 02:44 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
2011-12-12 02:44 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
2011-12-12 02:44 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
2011-12-12 02:42 . 2011-05-24 11:42 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-12-12 02:42 . 2011-05-24 10:40 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-12-12 02:42 . 2011-05-24 10:40 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-12-12 02:42 . 2011-05-24 10:39 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-12-12 02:42 . 2011-05-24 10:37 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2011-12-12 02:42 . 2011-02-18 10:51 31232 ----a-w- c:\windows\system32\prevhost.exe
2011-12-12 02:42 . 2011-02-18 05:39 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
2011-12-12 02:42 . 2011-02-12 11:34 267776 ----a-w- c:\windows\system32\FXSCOVER.exe
2011-12-12 02:40 . 2011-02-23 04:55 90624 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-12-12 02:40 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-12 02:40 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-12-12 02:40 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-12-11 17:50 . 2011-12-11 17:50 -------- d-----w- c:\windows\74224F8D4A1748169EDB7BB854DE532C.TMP
2011-12-11 17:50 . 2011-12-11 17:50 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2011-12-11 17:41 . 2011-12-11 17:41 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-12-11 17:41 . 2011-12-11 17:41 -------- d-----w- c:\programdata\DAEMON Tools Lite
2011-12-11 17:02 . 2007-10-22 02:40 411656 ----a-w- c:\windows\system32\xactengine2_10.dll
2011-12-11 16:48 . 2011-12-14 20:01 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2011-12-11 16:45 . 2011-12-12 10:22 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2011-12-11 16:40 . 2011-12-13 17:47 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2011-12-11 16:22 . 2011-12-12 05:34 -------- d-----w- c:\programdata\Origin
2011-12-11 16:22 . 2011-12-12 05:33 -------- d-----w- c:\programdata\Electronic Arts
2011-12-11 16:22 . 2011-12-11 16:36 -------- d-----w- c:\program files (x86)\Origin Games
2011-12-11 16:01 . 2011-12-11 16:01 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4382D714-977A-4BD0-AE8F-68A5AE80969F}\gapaengine.dll
2011-12-11 15:59 . 2011-12-11 15:59 -------- d-----w- c:\program files (x86)\Common Files\LogiShrd
2011-12-11 15:59 . 2011-12-11 15:59 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-12-11 15:59 . 2011-12-11 15:59 -------- d-----w- c:\programdata\Logishrd
2011-12-11 15:59 . 2011-12-11 15:59 -------- d-----w- c:\program files\Logitech
2011-12-11 15:58 . 2011-12-11 15:59 -------- d-----w- c:\program files\Common Files\Logishrd
2011-12-11 15:37 . 2011-12-11 15:37 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2011-12-11 15:37 . 2011-12-11 15:37 -------- d-----w- c:\program files\Microsoft Security Client
2011-12-11 15:30 . 2011-12-11 15:30 -------- d-----w- c:\users\UpdatusUser
2011-12-11 15:30 . 2011-12-14 22:24 -------- d-----w- c:\programdata\NVIDIA
2011-12-11 15:30 . 2011-12-11 15:30 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2011-12-11 15:30 . 2011-10-15 08:53 837952 ----a-w- c:\windows\system32\easyupdatusapiu64.dll
2011-12-11 15:30 . 2011-10-15 08:53 5067584 ----a-w- c:\windows\system32\nvsvc64.dll
2011-12-11 15:30 . 2011-10-15 08:53 3074368 ----a-w- c:\windows\system32\nvsvcr.dll
2011-12-11 15:30 . 2011-10-15 08:53 222528 ----a-w- c:\windows\system32\nvmctray.dll
2011-12-11 15:30 . 2011-10-15 08:53 1640768 ----a-w- c:\windows\system32\nvvsvc.exe
2011-12-11 15:30 . 2011-10-15 08:53 137536 ----a-w- c:\windows\system32\nvshext.dll
2011-12-11 15:30 . 2011-10-15 08:53 10406208 ----a-w- c:\windows\system32\nvcpl.dll
2011-12-11 15:30 . 2011-12-11 15:30 -------- d-----w- c:\programdata\NVIDIA Corporation
2011-12-11 15:28 . 2011-07-26 11:57 355016 ----a-w- c:\windows\system32\PROUnstl.exe
2011-12-11 15:27 . 2009-05-26 02:05 36472 ----a-w- c:\windows\system32\NicCo36.dll
2011-12-11 15:27 . 2011-12-12 17:22 -------- d-sh--w- c:\windows\Installer
2011-12-11 14:37 . 2011-12-14 20:04 -------- d-----w- c:\users\CoBain_SK
2011-12-11 14:37 . 2011-12-11 14:37 -------- d-----w- C:\Recovery
2011-12-11 14:06 . 2011-12-11 14:37 -------- d-----w- c:\windows\Panther
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-14 23:54 . 2011-10-14 23:54 321856 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-14_21.12.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-12-14 21:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-12-14 22:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-12-14 22:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-12-14 21:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-12-14 21:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-12-14 22:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-12-14 22:24 . 2011-12-14 22:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-12-14 21:07 . 2011-12-14 21:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-12-11 17:03 . 2011-12-14 22:14 280904 c:\windows\SysWOW64\PnkBstrB.exe
- 2011-12-11 17:03 . 2011-12-14 19:25 280904 c:\windows\SysWOW64\PnkBstrB.exe
+ 2009-07-14 05:01 . 2011-12-14 22:23 235072 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-12-14 21:06 235072 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EADM"="d:\programy\Origin\Origin.exe" [2011-11-07 28846216]
"DAEMON Tools Lite"="d:\programy\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="d:\programy\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SpIDerMail"="d:\programy\DrWeb\spiderml.exe" [2008-06-10 501080]
"Malwarebytes' Anti-Malware"="d:\programy\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\CoBain_SK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech . Registrácia výrobku.lnk - c:\program files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;d:\programy\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola siete od spoločnosti Microsoft;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.14\atkexComSvc.exe [2011-10-07 922240]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [2011-10-07 915584]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2011-10-07 586880]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 ASUSFILTER;ASUSFILTER;SysWow64\drivers\ASUSFILTER.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-14 c:\windows\Tasks\Dr.Web automatic update.job
- d:\programy\DrWeb\drwebupw.exe [2011-12-14 13:36]
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4102318988-3621349773-3221444336-1000Core.job
- c:\users\CoBain_SK\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 15:34]
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4102318988-3621349773-3221444336-1000UA.job
- c:\users\CoBain_SK\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 15:34]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"combofix"="c:\combofix\CF25681.3XE" [2010-11-21 345088]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
LSP: c:\windows\system32\DRWEBSP.DLL
TCP: DhcpNameServer = 192.168.4.1
.
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\ASUS\AI Suite II\AsRoutineController.exe
d:\programy\Fraps\fraps.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\PnkBstrB.exe
.
**************************************************************************
.
Completion time: 2011-12-14 23:25:13 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-14 22:25
ComboFix2.txt 2011-12-14 21:13
.
Pre-Run: 22 911 909 888 bytes free
Post-Run: 22 685 782 016 bytes free
.
- - End Of File - - 0ACFB884951EB441E1C36DD1442DD09F

[Žbeky]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG , Avast,Avira či Microsoft Security Essentials následně T-Cleaner smaž a zapni si AVG , Avast, Avira či Microsoft Security Essentials

+ Nový log z HJT

Jak se chová PC?

[cobr4in]

Takze, po pouziti T-Cleanera mi totalne zblblo PC. Spomalene, niekedy neragovalo, zamrzali niektore aplikacie, kazdu chvilu hadzalo chybove hlasky... Preto, a snad Vas vsetkych kvoli Vami vynalozenej snahe velmi nenaseriem, som reinstaloval Win. Je to jednoduchsie a casovo menej narocnejsie riesenie.