Prosím kontrolu, podezření na spam v PC Vyřešeno

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

Uživatelský avatar
memphisto
Guru Level 13
Guru Level 13
Příspěvky: 21113
Registrován: září 06
Bydliště: Zlín - České Budějovice
Pohlaví: Muž
Stav:
Offline

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod memphisto » 12 kvě 2013 15:46

Zkus v nouzovém režimu tento skript

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore1cdf8c52842be6a.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upus.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu
PRAVIDLA PC-HELP.CZ, PRAVIDLA sekce HijackThis, HijackThis návod, Memtest, CCleaner
Logy z programu HijackThis neposílejte prosím přes SZ, ale vkládejte je do patřičné sekce. Děkuji

Reklama
Uživatelský avatar
Scanner
Level 3.5
Level 3.5
Příspěvky: 771
Registrován: srpen 11
Bydliště: Střední čechy
Pohlaví: Muž
Stav:
Offline
Kontakt:

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod Scanner » 13 kvě 2013 15:37

Spustil jsem ten skript v tom nouzovém režimu ale pořád to řvalo že mám zapnutý štíty u avastu! i když jsem je měl jasně vypnutý. Snad to nepokurvilo to čištění.

ComboFix 13-05-11.01 - Zkuřka 13.05.2013 15:05:14.4.4 - x64 MINIMAL
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4079.3348 [GMT 2:00]
Spuštěný z: c:\users\Zkuřka\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Zkuřka\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: avast! Antivirus *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore1cdf8c52842be6a.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\PFRO.log
c:\windows\Tasks\GoogleUpdateTaskMachineCore1cdf8c52842be6a.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-04-13 do 2013-05-13 )))))))))))))))))))))))))))))))
.
.
2013-05-13 13:20 . 2013-05-13 13:20 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-05-13 13:20 . 2013-05-13 13:20 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-05-13 13:20 . 2013-05-13 13:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-11 18:11 . 2013-05-11 18:11 -------- d-----w- c:\program files (x86)\Common Files\Spigot
2013-05-09 15:07 . 2013-05-09 15:07 -------- d-----w- c:\program files (x86)\IObit
2013-05-09 15:05 . 2013-05-09 15:05 -------- d-----w- c:\programdata\{D76294E6-03B8-4971-AF2E-3F846161A690}
2013-05-09 15:05 . 2013-05-09 15:05 -------- d-----w- c:\programdata\{5A85B23A-4B58-47D1-9B9C-DFBD7866099F}
2013-05-09 14:09 . 2013-05-09 14:09 -------- d-----w- c:\users\Zkuřka\AppData\Local\SKIDROW
2013-05-08 09:00 . 2013-05-08 09:00 -------- d-sh--w- c:\windows\ftpcache
2013-05-08 09:00 . 2010-04-29 17:10 127800 ----a-w- c:\windows\system32\HPSIsvc.exe
2013-05-08 09:00 . 2012-09-29 11:25 74240 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPM1210PP.dll
2013-05-08 08:59 . 2012-09-29 11:26 1366528 ----a-w- c:\windows\system32\HPM1210SM.exe
2013-05-08 08:59 . 2012-09-29 11:25 409088 ----a-w- c:\windows\system32\HPM1210LM.DLL
2013-05-08 08:59 . 2012-09-29 11:05 350720 ----a-w- c:\windows\system32\mvhlewsi.DLL
2013-05-08 08:56 . 2013-05-08 08:56 -------- d-----w- c:\program files\HP
2013-05-07 16:12 . 2013-05-07 16:12 -------- d-----w- c:\windows\cs
2013-05-07 16:12 . 2013-05-07 16:12 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2013-05-07 16:11 . 2013-05-07 16:12 -------- d-----w- c:\program files (x86)\Windows Live
2013-05-07 16:10 . 2013-05-08 08:44 -------- d-----w- c:\users\Zkuřka\AppData\Local\Windows Live
2013-05-07 16:09 . 2013-05-07 16:09 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2013-05-06 13:03 . 2013-05-09 15:11 -------- d-----w- c:\program files (x86)\Microsoft
2013-05-06 12:38 . 2013-05-06 12:38 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-05-06 12:37 . 2013-05-06 12:37 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-05-05 17:42 . 2013-05-05 17:42 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\PowerISO
2013-05-03 22:44 . 2013-05-03 22:44 -------- d-----w- c:\programdata\StarApp
2013-05-03 22:24 . 2013-05-03 22:28 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\Systweak
2013-05-03 22:24 . 2013-01-01 16:32 20488 ----a-w- c:\windows\system32\roboot64.exe
2013-04-29 18:59 . 2013-04-29 18:59 -------- d-----w- c:\users\Zkuřka\AppData\Local\Adobe
2013-04-29 09:45 . 2013-04-29 09:45 -------- d-----w- c:\users\Zkuřka\AppData\Local\Chromium
2013-04-29 09:21 . 2013-05-09 08:59 270824 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2013-04-29 09:21 . 2013-05-09 08:59 131232 ----a-w- c:\windows\system32\drivers\aswFW.sys
2013-04-29 09:21 . 2013-05-09 08:59 22600 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2013-04-29 09:21 . 2013-03-06 22:11 12368 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2013-04-26 16:29 . 2013-04-26 16:29 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-26 16:29 . 2013-04-04 03:35 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-26 16:21 . 2013-05-09 08:59 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-04-26 16:21 . 2013-05-09 08:59 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-04-25 09:03 . 2013-04-25 09:03 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\HD Tune Pro
2013-04-24 07:41 . 2013-05-09 08:59 378432 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-04-24 07:41 . 2013-05-09 08:59 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-04-24 07:41 . 2013-05-09 08:59 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-04-24 07:41 . 2013-05-09 08:59 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-04-24 07:41 . 2013-05-09 08:59 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-04-24 07:41 . 2013-05-09 08:59 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-04-24 07:41 . 2013-05-09 08:58 41664 ----a-w- c:\windows\avastSS.scr
2013-04-24 07:41 . 2012-08-21 09:12 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-24 07:29 . 2013-04-24 07:29 -------- d-s---w- c:\windows\SysWow64\Microsoft
2013-04-22 12:23 . 2013-05-09 08:58 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-22 12:22 . 2013-04-24 07:40 -------- d-----w- c:\program files\AVAST Software
2013-04-22 12:22 . 2013-04-24 07:40 -------- d-----w- c:\programdata\AVAST Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-06 12:38 . 2013-03-02 14:24 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-05-02 00:06 . 2012-11-16 20:36 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-26 16:25 . 2012-11-17 11:26 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-26 16:25 . 2012-11-17 11:26 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-17 18:20 . 2012-11-17 14:53 26432 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2013-04-10 13:52 . 2012-11-16 20:43 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-04 12:50 . 2012-11-17 11:46 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-27 05:38 . 2013-03-27 05:38 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-03-19 06:04 . 2013-04-10 13:49 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 13:49 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 13:49 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 13:49 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 13:49 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 13:49 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-16 07:26 . 2013-03-16 07:26 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-03-16 07:26 . 2013-03-16 07:26 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-03-16 07:26 . 2013-03-16 07:26 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-03-16 07:26 . 2013-03-16 07:26 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-16 07:26 . 2013-03-16 07:26 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-16 07:26 . 2013-03-16 07:26 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-03-16 07:26 . 2013-03-16 07:26 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-03-16 07:26 . 2013-03-16 07:26 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-03-16 07:26 . 2013-03-16 07:26 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-03-16 07:26 . 2013-03-16 07:26 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-16 07:26 . 2013-03-16 07:26 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-03-16 07:26 . 2013-03-16 07:26 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-16 07:26 . 2013-03-16 07:26 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-16 07:26 . 2013-03-16 07:26 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-16 07:26 . 2013-03-16 07:26 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-03-16 07:26 . 2013-03-16 07:26 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-03-16 07:26 . 2013-03-16 07:26 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-16 07:26 . 2013-03-16 07:26 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-16 07:26 . 2013-03-16 07:26 197120 ----a-w- c:\windows\system32\msrating.dll
2013-03-16 07:26 . 2013-03-16 07:26 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-03-16 07:26 . 2013-03-16 07:26 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-16 07:26 . 2013-03-16 07:26 81408 ----a-w- c:\windows\system32\icardie.dll
2013-03-16 07:26 . 2013-03-16 07:26 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-03-16 07:26 . 2013-03-16 07:26 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-03-16 07:26 . 2013-03-16 07:26 441856 ----a-w- c:\windows\system32\html.iec
2013-03-16 07:26 . 2013-03-16 07:26 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-03-16 07:26 . 2013-03-16 07:26 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-16 07:26 . 2013-03-16 07:26 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-03-16 07:26 . 2013-03-16 07:26 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-03-16 07:26 . 2013-03-16 07:26 235008 ----a-w- c:\windows\system32\url.dll
2013-03-16 07:26 . 2013-03-16 07:26 216064 ----a-w- c:\windows\system32\msls31.dll
2013-03-16 07:26 . 2013-03-16 07:26 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-16 07:26 . 2013-03-16 07:26 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-03-16 07:26 . 2013-03-16 07:26 102912 ----a-w- c:\windows\system32\inseng.dll
2013-03-16 07:26 . 2013-03-16 07:26 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-03-16 07:26 . 2013-03-16 07:26 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-03-16 07:26 . 2013-03-16 07:26 144896 ----a-w- c:\windows\system32\wextract.exe
2013-03-16 07:26 . 2013-03-16 07:26 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-16 07:26 . 2013-03-16 07:26 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-03-16 07:26 . 2013-03-16 07:26 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-03-16 07:26 . 2013-03-16 07:26 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-03-16 07:26 . 2013-03-16 07:26 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-16 07:26 . 2013-03-16 07:26 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-16 07:26 . 2013-03-16 07:26 149504 ----a-w- c:\windows\system32\occache.dll
2013-03-16 07:26 . 2013-03-16 07:26 13824 ----a-w- c:\windows\system32\mshta.exe
2013-03-16 07:26 . 2013-03-16 07:26 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-03-16 07:26 . 2013-03-16 07:26 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-16 07:26 . 2013-03-16 07:26 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-03-16 07:26 . 2013-03-16 07:26 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-03-15 05:53 . 2013-03-27 13:23 7573816 ----a-w- c:\windows\system32\nvopencl.dll
2013-03-15 05:53 . 2013-03-27 13:23 6271872 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-03-15 05:53 . 2013-03-27 13:23 26956576 ----a-w- c:\windows\system32\nvoglv64.dll
2013-03-15 05:53 . 2013-03-27 13:23 20542752 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-03-15 05:53 . 2013-03-27 13:23 13088000 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-03-15 05:53 . 2013-03-27 13:23 11048736 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-03-15 05:53 . 2013-03-27 13:23 9414456 ----a-w- c:\windows\system32\nvcuda.dll
2013-03-15 05:53 . 2013-03-27 13:23 7959000 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-03-15 05:53 . 2013-03-27 13:23 2913056 ----a-w- c:\windows\system32\nvcuvid.dll
2013-03-15 05:53 . 2013-03-27 13:23 2728736 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-03-15 05:53 . 2013-03-27 13:23 25256736 ----a-w- c:\windows\system32\nvcompiler.dll
2013-03-15 05:53 . 2013-03-27 13:23 2355488 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-03-15 05:53 . 2013-03-27 13:23 1995552 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-03-15 05:53 . 2013-03-27 13:23 1807136 ----a-w- c:\windows\system32\nvdispco6431422.dll
2013-03-15 05:53 . 2013-03-27 13:23 17990800 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-03-15 05:53 . 2013-03-27 13:23 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-03-15 05:53 . 2013-03-27 13:23 1510176 ----a-w- c:\windows\system32\nvdispgenco6431422.dll
2013-03-15 05:53 . 2013-02-26 20:24 2539128 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-03-15 05:53 . 2013-02-03 11:00 15042928 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-03-15 05:53 . 2010-10-08 01:19 2864144 ----a-w- c:\windows\system32\nvapi64.dll
2013-03-15 05:53 . 2010-10-08 01:19 15508512 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-03-15 04:16 . 2010-10-08 09:04 3477280 ----a-w- c:\windows\system32\nvsvc64.dll
2013-03-15 04:16 . 2010-10-08 09:04 6398240 ----a-w- c:\windows\system32\nvcpl.dll
2013-03-15 04:16 . 2010-10-08 09:04 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-03-15 04:16 . 2010-10-08 09:04 877856 ----a-w- c:\windows\system32\nvvsvc.exe
2013-03-15 04:16 . 2010-10-08 09:04 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-03-15 04:16 . 2010-10-08 09:04 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-03-14 21:07 . 2013-03-14 21:07 559904 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-03-08 18:21 . 2012-11-17 11:31 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-03-08 18:21 . 2012-11-17 11:31 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-03-01 03:36 . 2013-04-10 13:49 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-02-26 06:55 . 2013-02-26 06:55 71680 ----a-w- c:\windows\system32\frapsv64.dll
2013-02-21 10:30 . 2013-04-10 13:50 1766912 ----a-w- c:\windows\SysWow64\wininet.dll
2013-02-21 10:29 . 2013-04-10 13:50 2877440 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-02-21 10:29 . 2013-04-10 13:50 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-02-21 10:29 . 2013-04-10 13:50 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-02-21 10:15 . 2013-04-10 13:50 51712 ----a-w- c:\windows\system32\ie4uinit.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Easy Driver Pro"="e:\easy driver pro\DPLauncher.exe" [2012-09-23 147312]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18672232]
"DAEMON Tools Lite"="e:\daemon tools lite\DTLite.exe" [2013-03-14 3672640]
"Facebook Update"="c:\users\Zkuřka\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2013-04-05 138096]
"Advanced SystemCare 6"="e:\advanced systemcare 6\ASCTray.exe" [2013-04-18 491840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\Zkuřka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Verbatim GREEN BUTTON.lnk - e:\verbatim green button\GREEN BUTTON.exe [2012-11-17 463120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;e:\malwarebytes' anti-malware\mbamservice.exe [2013-04-04 701512]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2013-01-03 36680]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2012-12-24 20480]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 127488]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 18944]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 161280]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-16 1255736]
S0 aswKbd;aswKbd; [x]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2013-03-06 12368]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-27 283200]
S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;e:\advanced systemcare 6\ASCService.exe [2013-04-18 574272]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2013-05-09 137960]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2010-04-29 127800]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-03-14 383264]
S3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys [2011-11-28 33872]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-10 15:57 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-05-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-17 16:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - e:\micros~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\micros~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 77.48.254.254 77.48.100.254
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
e:\malwarebytes' anti-malware\mbamscheduler.exe
c:\windows\SysWOW64\IoctlSvc.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe
.
**************************************************************************
.
Celkový čas: 2013-05-13 15:26:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-05-13 13:26
ComboFix2.txt 2013-05-12 09:18
ComboFix3.txt 2013-05-11 17:53
.
Před spuštěním: Volných bajtů: 44 113 670 144
Po spuštění: Volných bajtů: 43 778 093 056
.
- - End Of File - - D52A24EAD590EE73A06508B7F7A712B2
When You smoke herb it reveals you to yourself. All the wickedness you do is revealed by the herb - it's you conscience and gives you an honest picture of yourself.
---------- Robert Nesta Marley ----------

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43298
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod jaro3 » 13 kvě 2013 20:05

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
Folder::
c:\program files (x86)\Common Files\Spigot
c:\users\Zkuřka\AppData\Local\Facebook\Update
c:\program files (x86)\Skype\Updater

Driver::
SkypeUpdate

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"=-

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"



Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

Uživatelský avatar
Scanner
Level 3.5
Level 3.5
Příspěvky: 771
Registrován: srpen 11
Bydliště: Střední čechy
Pohlaví: Muž
Stav:
Offline
Kontakt:

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod Scanner » 13 kvě 2013 22:55

ComboFix 13-05-11.01 - Zkuřka 13.05.2013 22:34:22.5.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4079.2554 [GMT 2:00]
Spuštěný z: c:\users\Zku°ka\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Zku°ka\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: avast! Antivirus *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-04-13 do 2013-05-13 )))))))))))))))))))))))))))))))
.
.
2013-05-13 20:51 . 2013-05-13 20:51 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-05-13 20:51 . 2013-05-13 20:51 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-05-13 20:51 . 2013-05-13 20:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-11 18:11 . 2013-05-11 18:11 -------- d-----w- c:\program files (x86)\Common Files\Spigot
2013-05-09 15:07 . 2013-05-09 15:07 -------- d-----w- c:\program files (x86)\IObit
2013-05-09 15:05 . 2013-05-09 15:05 -------- d-----w- c:\programdata\{D76294E6-03B8-4971-AF2E-3F846161A690}
2013-05-09 15:05 . 2013-05-09 15:05 -------- d-----w- c:\programdata\{5A85B23A-4B58-47D1-9B9C-DFBD7866099F}
2013-05-09 14:09 . 2013-05-09 14:09 -------- d-----w- c:\users\Zkuřka\AppData\Local\SKIDROW
2013-05-08 09:00 . 2013-05-08 09:00 -------- d-sh--w- c:\windows\ftpcache
2013-05-08 09:00 . 2010-04-29 17:10 127800 ----a-w- c:\windows\system32\HPSIsvc.exe
2013-05-08 09:00 . 2012-09-29 11:25 74240 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPM1210PP.dll
2013-05-08 08:59 . 2012-09-29 11:26 1366528 ----a-w- c:\windows\system32\HPM1210SM.exe
2013-05-08 08:59 . 2012-09-29 11:25 409088 ----a-w- c:\windows\system32\HPM1210LM.DLL
2013-05-08 08:59 . 2012-09-29 11:05 350720 ----a-w- c:\windows\system32\mvhlewsi.DLL
2013-05-08 08:56 . 2013-05-08 08:56 -------- d-----w- c:\program files\HP
2013-05-07 16:12 . 2013-05-07 16:12 -------- d-----w- c:\windows\cs
2013-05-07 16:12 . 2013-05-07 16:12 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2013-05-07 16:11 . 2013-05-07 16:12 -------- d-----w- c:\program files (x86)\Windows Live
2013-05-07 16:10 . 2013-05-08 08:44 -------- d-----w- c:\users\Zkuřka\AppData\Local\Windows Live
2013-05-07 16:09 . 2013-05-07 16:09 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2013-05-06 13:03 . 2013-05-09 15:11 -------- d-----w- c:\program files (x86)\Microsoft
2013-05-06 12:38 . 2013-05-06 12:38 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-05-06 12:37 . 2013-05-06 12:37 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-05-05 17:42 . 2013-05-05 17:42 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\PowerISO
2013-05-03 22:44 . 2013-05-03 22:44 -------- d-----w- c:\programdata\StarApp
2013-05-03 22:24 . 2013-05-03 22:28 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\Systweak
2013-05-03 22:24 . 2013-01-01 16:32 20488 ----a-w- c:\windows\system32\roboot64.exe
2013-04-29 18:59 . 2013-04-29 18:59 -------- d-----w- c:\users\Zkuřka\AppData\Local\Adobe
2013-04-29 09:45 . 2013-04-29 09:45 -------- d-----w- c:\users\Zkuřka\AppData\Local\Chromium
2013-04-29 09:21 . 2013-05-09 08:59 270824 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2013-04-29 09:21 . 2013-05-09 08:59 131232 ----a-w- c:\windows\system32\drivers\aswFW.sys
2013-04-29 09:21 . 2013-05-09 08:59 22600 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2013-04-29 09:21 . 2013-03-06 22:11 12368 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2013-04-26 16:29 . 2013-04-26 16:29 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-26 16:29 . 2013-04-04 03:35 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-26 16:21 . 2013-05-09 08:59 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-04-26 16:21 . 2013-05-09 08:59 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-04-25 09:03 . 2013-04-25 09:03 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\HD Tune Pro
2013-04-24 07:41 . 2013-05-09 08:59 378432 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-04-24 07:41 . 2013-05-09 08:59 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-04-24 07:41 . 2013-05-09 08:59 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-04-24 07:41 . 2013-05-09 08:59 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-04-24 07:41 . 2013-05-09 08:59 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-04-24 07:41 . 2013-05-09 08:59 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-04-24 07:41 . 2013-05-09 08:58 41664 ----a-w- c:\windows\avastSS.scr
2013-04-24 07:41 . 2012-08-21 09:12 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-24 07:29 . 2013-04-24 07:29 -------- d-s---w- c:\windows\SysWow64\Microsoft
2013-04-22 12:23 . 2013-05-09 08:58 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-22 12:22 . 2013-04-24 07:40 -------- d-----w- c:\program files\AVAST Software
2013-04-22 12:22 . 2013-04-24 07:40 -------- d-----w- c:\programdata\AVAST Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-06 12:38 . 2013-03-02 14:24 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-05-02 00:06 . 2012-11-16 20:36 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-26 16:25 . 2012-11-17 11:26 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-26 16:25 . 2012-11-17 11:26 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-17 18:20 . 2012-11-17 14:53 26432 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2013-04-10 13:52 . 2012-11-16 20:43 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-04 12:50 . 2012-11-17 11:46 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-27 05:38 . 2013-03-27 05:38 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-03-19 06:04 . 2013-04-10 13:49 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 13:49 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 13:49 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 13:49 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 13:49 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 13:49 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-16 07:26 . 2013-03-16 07:26 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-03-16 07:26 . 2013-03-16 07:26 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-03-16 07:26 . 2013-03-16 07:26 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-03-16 07:26 . 2013-03-16 07:26 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-16 07:26 . 2013-03-16 07:26 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-16 07:26 . 2013-03-16 07:26 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-03-16 07:26 . 2013-03-16 07:26 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-03-16 07:26 . 2013-03-16 07:26 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-03-16 07:26 . 2013-03-16 07:26 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-03-16 07:26 . 2013-03-16 07:26 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-16 07:26 . 2013-03-16 07:26 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-03-16 07:26 . 2013-03-16 07:26 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-16 07:26 . 2013-03-16 07:26 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-16 07:26 . 2013-03-16 07:26 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-16 07:26 . 2013-03-16 07:26 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-03-16 07:26 . 2013-03-16 07:26 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-03-16 07:26 . 2013-03-16 07:26 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-16 07:26 . 2013-03-16 07:26 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-16 07:26 . 2013-03-16 07:26 197120 ----a-w- c:\windows\system32\msrating.dll
2013-03-16 07:26 . 2013-03-16 07:26 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-03-16 07:26 . 2013-03-16 07:26 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-16 07:26 . 2013-03-16 07:26 81408 ----a-w- c:\windows\system32\icardie.dll
2013-03-16 07:26 . 2013-03-16 07:26 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-03-16 07:26 . 2013-03-16 07:26 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-03-16 07:26 . 2013-03-16 07:26 441856 ----a-w- c:\windows\system32\html.iec
2013-03-16 07:26 . 2013-03-16 07:26 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-03-16 07:26 . 2013-03-16 07:26 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-16 07:26 . 2013-03-16 07:26 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-03-16 07:26 . 2013-03-16 07:26 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-03-16 07:26 . 2013-03-16 07:26 235008 ----a-w- c:\windows\system32\url.dll
2013-03-16 07:26 . 2013-03-16 07:26 216064 ----a-w- c:\windows\system32\msls31.dll
2013-03-16 07:26 . 2013-03-16 07:26 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-16 07:26 . 2013-03-16 07:26 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-03-16 07:26 . 2013-03-16 07:26 102912 ----a-w- c:\windows\system32\inseng.dll
2013-03-16 07:26 . 2013-03-16 07:26 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-03-16 07:26 . 2013-03-16 07:26 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-03-16 07:26 . 2013-03-16 07:26 144896 ----a-w- c:\windows\system32\wextract.exe
2013-03-16 07:26 . 2013-03-16 07:26 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-16 07:26 . 2013-03-16 07:26 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-03-16 07:26 . 2013-03-16 07:26 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-03-16 07:26 . 2013-03-16 07:26 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-03-16 07:26 . 2013-03-16 07:26 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-16 07:26 . 2013-03-16 07:26 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-16 07:26 . 2013-03-16 07:26 149504 ----a-w- c:\windows\system32\occache.dll
2013-03-16 07:26 . 2013-03-16 07:26 13824 ----a-w- c:\windows\system32\mshta.exe
2013-03-16 07:26 . 2013-03-16 07:26 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-03-16 07:26 . 2013-03-16 07:26 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-16 07:26 . 2013-03-16 07:26 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-03-16 07:26 . 2013-03-16 07:26 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-03-15 05:53 . 2013-03-27 13:23 7573816 ----a-w- c:\windows\system32\nvopencl.dll
2013-03-15 05:53 . 2013-03-27 13:23 6271872 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-03-15 05:53 . 2013-03-27 13:23 26956576 ----a-w- c:\windows\system32\nvoglv64.dll
2013-03-15 05:53 . 2013-03-27 13:23 20542752 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-03-15 05:53 . 2013-03-27 13:23 13088000 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-03-15 05:53 . 2013-03-27 13:23 11048736 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-03-15 05:53 . 2013-03-27 13:23 9414456 ----a-w- c:\windows\system32\nvcuda.dll
2013-03-15 05:53 . 2013-03-27 13:23 7959000 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-03-15 05:53 . 2013-03-27 13:23 2913056 ----a-w- c:\windows\system32\nvcuvid.dll
2013-03-15 05:53 . 2013-03-27 13:23 2728736 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-03-15 05:53 . 2013-03-27 13:23 25256736 ----a-w- c:\windows\system32\nvcompiler.dll
2013-03-15 05:53 . 2013-03-27 13:23 2355488 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-03-15 05:53 . 2013-03-27 13:23 1995552 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-03-15 05:53 . 2013-03-27 13:23 1807136 ----a-w- c:\windows\system32\nvdispco6431422.dll
2013-03-15 05:53 . 2013-03-27 13:23 17990800 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-03-15 05:53 . 2013-03-27 13:23 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-03-15 05:53 . 2013-03-27 13:23 1510176 ----a-w- c:\windows\system32\nvdispgenco6431422.dll
2013-03-15 05:53 . 2013-02-26 20:24 2539128 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-03-15 05:53 . 2013-02-03 11:00 15042928 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-03-15 05:53 . 2010-10-08 01:19 2864144 ----a-w- c:\windows\system32\nvapi64.dll
2013-03-15 05:53 . 2010-10-08 01:19 15508512 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-03-15 04:16 . 2010-10-08 09:04 3477280 ----a-w- c:\windows\system32\nvsvc64.dll
2013-03-15 04:16 . 2010-10-08 09:04 6398240 ----a-w- c:\windows\system32\nvcpl.dll
2013-03-15 04:16 . 2010-10-08 09:04 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-03-15 04:16 . 2010-10-08 09:04 877856 ----a-w- c:\windows\system32\nvvsvc.exe
2013-03-15 04:16 . 2010-10-08 09:04 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-03-15 04:16 . 2010-10-08 09:04 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-03-14 21:07 . 2013-03-14 21:07 559904 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-03-08 18:21 . 2012-11-17 11:31 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-03-08 18:21 . 2012-11-17 11:31 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-03-01 03:36 . 2013-04-10 13:49 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-02-26 06:55 . 2013-02-26 06:55 71680 ----a-w- c:\windows\system32\frapsv64.dll
2013-02-21 10:30 . 2013-04-10 13:50 1766912 ----a-w- c:\windows\SysWow64\wininet.dll
2013-02-21 10:29 . 2013-04-10 13:50 2877440 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-02-21 10:29 . 2013-04-10 13:50 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-02-21 10:29 . 2013-04-10 13:50 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-02-21 10:15 . 2013-04-10 13:50 51712 ----a-w- c:\windows\system32\ie4uinit.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Easy Driver Pro"="e:\easy driver pro\DPLauncher.exe" [2012-09-23 147312]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18672232]
"DAEMON Tools Lite"="e:\daemon tools lite\DTLite.exe" [2013-03-14 3672640]
"Facebook Update"="c:\users\Zkuřka\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2013-04-05 138096]
"Advanced SystemCare 6"="e:\advanced systemcare 6\ASCTray.exe" [2013-04-18 491840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\Zkuřka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Verbatim GREEN BUTTON.lnk - e:\verbatim green button\GREEN BUTTON.exe [2012-11-17 463120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;e:\malwarebytes' anti-malware\mbamservice.exe [2013-04-04 701512]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2013-01-03 36680]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2012-12-24 20480]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 127488]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 18944]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 161280]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-16 1255736]
S0 aswKbd;aswKbd; [x]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2013-03-06 12368]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-27 283200]
S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;e:\advanced systemcare 6\ASCService.exe [2013-04-18 574272]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2013-05-09 137960]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2010-04-29 127800]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-03-14 383264]
S3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys [2011-11-28 33872]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-10 15:57 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-05-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-17 16:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - e:\micros~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\micros~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 77.48.254.254 77.48.100.254
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2013-05-13 22:54:51
ComboFix-quarantined-files.txt 2013-05-13 20:54
ComboFix2.txt 2013-05-13 13:26
ComboFix3.txt 2013-05-12 09:18
ComboFix4.txt 2013-05-11 17:53
.
Před spuštěním: Volných bajtů: 44 135 567 360
Po spuštění: Volných bajtů: 43 807 240 192
.
- - End Of File - - 688A8F7201D83569B370FFE961FB1B7D
When You smoke herb it reveals you to yourself. All the wickedness you do is revealed by the herb - it's you conscience and gives you an honest picture of yourself.
---------- Robert Nesta Marley ----------

Uživatelský avatar
Scanner
Level 3.5
Level 3.5
Příspěvky: 771
Registrován: srpen 11
Bydliště: Střední čechy
Pohlaví: Muž
Stav:
Offline
Kontakt:

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod Scanner » 13 kvě 2013 23:23

Ten aswMBR my nejde. Vždy se sekne u nějakého kontrolovaného souboru a nic. Předtím se to nechal testovat dýl než 3 hodiny, kouslo se to a nějakého .dll na Adobe a nic.

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-13 15:41:18
-----------------------------
15:41:18.455 OS Version: Windows x64 6.1.7601 Service Pack 1
15:41:18.455 Number of processors: 4 586 0x2A07
15:41:18.455 ComputerName: WEED UserName:
15:41:19.048 Initialize success
15:41:19.267 AVAST engine defs: 13051300
15:41:22.028 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
15:41:22.028 Disk 0 Vendor: Hitachi_HDS721010CLA632 JP4OA41A Size: 953869MB BusType: 3
15:41:22.043 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-5
15:41:22.043 Disk 1 Vendor: SAMSUNG_HD753LJ 1AA01113 Size: 715404MB BusType: 3
15:41:22.137 Disk 0 MBR read successfully
15:41:22.137 Disk 0 MBR scan
15:41:22.137 Disk 0 Windows 7 default MBR code
15:41:22.153 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
15:41:22.153 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 99900 MB offset 206848
15:41:22.184 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 853867 MB offset 204802048
15:41:22.262 Disk 0 scanning C:\Windows\system32\drivers
15:41:27.769 Service scanning
15:41:41.013 Modules scanning
15:41:41.512 Disk 0 trace - called modules:
15:41:41.512 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
15:41:41.528 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a54060]
15:41:41.528 3 CLASSPNP.SYS[fffff8800181743f] -> nt!IofCallDriver -> [0xfffffa80047f0520]
15:41:41.528 5 ACPI.sys[fffff88000f4d7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004447060]
15:41:41.793 AVAST engine scan C:\Windows
15:41:43.291 AVAST engine scan C:\Windows\system32
15:43:01.790 AVAST engine scan C:\Windows\system32\drivers
15:43:08.030 AVAST engine scan C:\Users\Zkuřka
15:44:53.985 AVAST engine scan C:\ProgramData
19:34:17.741 Disk 0 MBR has been saved successfully to "C:\Users\Zkuřka\Desktop\MBR.dat"
19:34:17.858 The log file has been saved successfully to "C:\Users\Zkuřka\Desktop\aswMBR.txt"
When You smoke herb it reveals you to yourself. All the wickedness you do is revealed by the herb - it's you conscience and gives you an honest picture of yourself.
---------- Robert Nesta Marley ----------

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43298
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod jaro3 » 14 kvě 2013 00:56

Script v Combofixu udělej ještě jednou v nouz. režimu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

Uživatelský avatar
Scanner
Level 3.5
Level 3.5
Příspěvky: 771
Registrován: srpen 11
Bydliště: Střední čechy
Pohlaví: Muž
Stav:
Offline
Kontakt:

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod Scanner » 14 kvě 2013 18:07

ComboFix 13-05-11.01 - Zkuřka 14.05.2013 17:37:50.6.4 - x64 MINIMAL
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4079.2605 [GMT 2:00]
Spuštěný z: c:\users\Zkuřka\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Zkuřka\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: avast! Antivirus *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\Spigot
c:\program files (x86)\Common Files\Spigot\GC\coupons_2.3.crx
c:\program files (x86)\Common Files\Spigot\GC\errorassistant_1.1.crx
c:\program files (x86)\Common Files\Spigot\GC\saamazon_1.0.crx
c:\program files (x86)\Common Files\Spigot\GC\saebay_1.0.crx
c:\program files (x86)\Skype\Updater
c:\program files (x86)\Skype\Updater\Updater.dll
c:\program files (x86)\Skype\Updater\Updater.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SkypeUpdate
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-04-14 do 2013-05-14 )))))))))))))))))))))))))))))))
.
.
2013-05-14 15:53 . 2013-05-14 15:53 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-05-14 15:53 . 2013-05-14 15:53 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-05-14 15:53 . 2013-05-14 15:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-09 15:07 . 2013-05-09 15:07 -------- d-----w- c:\program files (x86)\IObit
2013-05-09 15:05 . 2013-05-09 15:05 -------- d-----w- c:\programdata\{D76294E6-03B8-4971-AF2E-3F846161A690}
2013-05-09 15:05 . 2013-05-09 15:05 -------- d-----w- c:\programdata\{5A85B23A-4B58-47D1-9B9C-DFBD7866099F}
2013-05-09 14:09 . 2013-05-09 14:09 -------- d-----w- c:\users\Zkuřka\AppData\Local\SKIDROW
2013-05-08 09:00 . 2013-05-08 09:00 -------- d-sh--w- c:\windows\ftpcache
2013-05-08 09:00 . 2010-04-29 17:10 127800 ----a-w- c:\windows\system32\HPSIsvc.exe
2013-05-08 09:00 . 2012-09-29 11:25 74240 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPM1210PP.dll
2013-05-08 08:59 . 2012-09-29 11:26 1366528 ----a-w- c:\windows\system32\HPM1210SM.exe
2013-05-08 08:59 . 2012-09-29 11:25 409088 ----a-w- c:\windows\system32\HPM1210LM.DLL
2013-05-08 08:59 . 2012-09-29 11:05 350720 ----a-w- c:\windows\system32\mvhlewsi.DLL
2013-05-08 08:56 . 2013-05-08 08:56 -------- d-----w- c:\program files\HP
2013-05-07 16:12 . 2013-05-07 16:12 -------- d-----w- c:\windows\cs
2013-05-07 16:12 . 2013-05-07 16:12 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2013-05-07 16:11 . 2013-05-07 16:12 -------- d-----w- c:\program files (x86)\Windows Live
2013-05-07 16:10 . 2013-05-08 08:44 -------- d-----w- c:\users\Zkuřka\AppData\Local\Windows Live
2013-05-07 16:09 . 2013-05-07 16:09 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2013-05-06 13:03 . 2013-05-09 15:11 -------- d-----w- c:\program files (x86)\Microsoft
2013-05-06 12:38 . 2013-05-06 12:38 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-05-06 12:37 . 2013-05-06 12:37 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-05-05 17:42 . 2013-05-05 17:42 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\PowerISO
2013-05-03 22:44 . 2013-05-03 22:44 -------- d-----w- c:\programdata\StarApp
2013-05-03 22:24 . 2013-05-03 22:28 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\Systweak
2013-05-03 22:24 . 2013-01-01 16:32 20488 ----a-w- c:\windows\system32\roboot64.exe
2013-04-29 18:59 . 2013-04-29 18:59 -------- d-----w- c:\users\Zkuřka\AppData\Local\Adobe
2013-04-29 09:45 . 2013-04-29 09:45 -------- d-----w- c:\users\Zkuřka\AppData\Local\Chromium
2013-04-29 09:21 . 2013-05-09 08:59 270824 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2013-04-29 09:21 . 2013-05-09 08:59 131232 ----a-w- c:\windows\system32\drivers\aswFW.sys
2013-04-29 09:21 . 2013-05-09 08:59 22600 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2013-04-29 09:21 . 2013-03-06 22:11 12368 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2013-04-26 16:29 . 2013-04-26 16:29 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-26 16:29 . 2013-04-04 03:35 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-26 16:21 . 2013-05-09 08:59 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-04-26 16:21 . 2013-05-09 08:59 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-04-25 09:03 . 2013-04-25 09:03 -------- d-----w- c:\users\Zkuřka\AppData\Roaming\HD Tune Pro
2013-04-24 07:41 . 2013-05-09 08:59 378432 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-04-24 07:41 . 2013-05-09 08:59 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-04-24 07:41 . 2013-05-09 08:59 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-04-24 07:41 . 2013-05-09 08:59 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-04-24 07:41 . 2013-05-09 08:59 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-04-24 07:41 . 2013-05-09 08:59 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-04-24 07:41 . 2013-05-09 08:58 41664 ----a-w- c:\windows\avastSS.scr
2013-04-24 07:41 . 2012-08-21 09:12 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-24 07:29 . 2013-04-24 07:29 -------- d-s---w- c:\windows\SysWow64\Microsoft
2013-04-22 12:23 . 2013-05-09 08:58 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-22 12:22 . 2013-04-24 07:40 -------- d-----w- c:\program files\AVAST Software
2013-04-22 12:22 . 2013-04-24 07:40 -------- d-----w- c:\programdata\AVAST Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-06 12:38 . 2013-03-02 14:24 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-05-02 00:06 . 2012-11-16 20:36 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-26 16:25 . 2012-11-17 11:26 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-26 16:25 . 2012-11-17 11:26 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-17 18:20 . 2012-11-17 14:53 26432 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2013-04-10 13:52 . 2012-11-16 20:43 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-04 12:50 . 2012-11-17 11:46 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-27 05:38 . 2013-03-27 05:38 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-03-19 06:04 . 2013-04-10 13:49 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 13:49 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 13:49 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 13:49 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 13:49 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 13:49 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-16 07:26 . 2013-03-16 07:26 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-03-16 07:26 . 2013-03-16 07:26 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-03-16 07:26 . 2013-03-16 07:26 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-03-16 07:26 . 2013-03-16 07:26 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-16 07:26 . 2013-03-16 07:26 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-16 07:26 . 2013-03-16 07:26 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-03-16 07:26 . 2013-03-16 07:26 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-03-16 07:26 . 2013-03-16 07:26 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-03-16 07:26 . 2013-03-16 07:26 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-03-16 07:26 . 2013-03-16 07:26 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-16 07:26 . 2013-03-16 07:26 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-03-16 07:26 . 2013-03-16 07:26 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-16 07:26 . 2013-03-16 07:26 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-16 07:26 . 2013-03-16 07:26 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-16 07:26 . 2013-03-16 07:26 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-03-16 07:26 . 2013-03-16 07:26 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-03-16 07:26 . 2013-03-16 07:26 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-16 07:26 . 2013-03-16 07:26 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-16 07:26 . 2013-03-16 07:26 197120 ----a-w- c:\windows\system32\msrating.dll
2013-03-16 07:26 . 2013-03-16 07:26 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-03-16 07:26 . 2013-03-16 07:26 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-16 07:26 . 2013-03-16 07:26 81408 ----a-w- c:\windows\system32\icardie.dll
2013-03-16 07:26 . 2013-03-16 07:26 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-03-16 07:26 . 2013-03-16 07:26 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-03-16 07:26 . 2013-03-16 07:26 441856 ----a-w- c:\windows\system32\html.iec
2013-03-16 07:26 . 2013-03-16 07:26 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-03-16 07:26 . 2013-03-16 07:26 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-16 07:26 . 2013-03-16 07:26 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-03-16 07:26 . 2013-03-16 07:26 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-03-16 07:26 . 2013-03-16 07:26 235008 ----a-w- c:\windows\system32\url.dll
2013-03-16 07:26 . 2013-03-16 07:26 216064 ----a-w- c:\windows\system32\msls31.dll
2013-03-16 07:26 . 2013-03-16 07:26 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-16 07:26 . 2013-03-16 07:26 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-03-16 07:26 . 2013-03-16 07:26 102912 ----a-w- c:\windows\system32\inseng.dll
2013-03-16 07:26 . 2013-03-16 07:26 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-03-16 07:26 . 2013-03-16 07:26 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-03-16 07:26 . 2013-03-16 07:26 144896 ----a-w- c:\windows\system32\wextract.exe
2013-03-16 07:26 . 2013-03-16 07:26 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-16 07:26 . 2013-03-16 07:26 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-03-16 07:26 . 2013-03-16 07:26 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-03-16 07:26 . 2013-03-16 07:26 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-03-16 07:26 . 2013-03-16 07:26 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-16 07:26 . 2013-03-16 07:26 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-16 07:26 . 2013-03-16 07:26 149504 ----a-w- c:\windows\system32\occache.dll
2013-03-16 07:26 . 2013-03-16 07:26 13824 ----a-w- c:\windows\system32\mshta.exe
2013-03-16 07:26 . 2013-03-16 07:26 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-03-16 07:26 . 2013-03-16 07:26 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-16 07:26 . 2013-03-16 07:26 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-03-16 07:26 . 2013-03-16 07:26 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-03-15 05:53 . 2013-03-27 13:23 7573816 ----a-w- c:\windows\system32\nvopencl.dll
2013-03-15 05:53 . 2013-03-27 13:23 6271872 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-03-15 05:53 . 2013-03-27 13:23 26956576 ----a-w- c:\windows\system32\nvoglv64.dll
2013-03-15 05:53 . 2013-03-27 13:23 20542752 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-03-15 05:53 . 2013-03-27 13:23 13088000 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-03-15 05:53 . 2013-03-27 13:23 11048736 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-03-15 05:53 . 2013-03-27 13:23 9414456 ----a-w- c:\windows\system32\nvcuda.dll
2013-03-15 05:53 . 2013-03-27 13:23 7959000 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-03-15 05:53 . 2013-03-27 13:23 2913056 ----a-w- c:\windows\system32\nvcuvid.dll
2013-03-15 05:53 . 2013-03-27 13:23 2728736 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-03-15 05:53 . 2013-03-27 13:23 25256736 ----a-w- c:\windows\system32\nvcompiler.dll
2013-03-15 05:53 . 2013-03-27 13:23 2355488 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-03-15 05:53 . 2013-03-27 13:23 1995552 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-03-15 05:53 . 2013-03-27 13:23 1807136 ----a-w- c:\windows\system32\nvdispco6431422.dll
2013-03-15 05:53 . 2013-03-27 13:23 17990800 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-03-15 05:53 . 2013-03-27 13:23 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-03-15 05:53 . 2013-03-27 13:23 1510176 ----a-w- c:\windows\system32\nvdispgenco6431422.dll
2013-03-15 05:53 . 2013-02-26 20:24 2539128 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-03-15 05:53 . 2013-02-03 11:00 15042928 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-03-15 05:53 . 2010-10-08 01:19 2864144 ----a-w- c:\windows\system32\nvapi64.dll
2013-03-15 05:53 . 2010-10-08 01:19 15508512 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-03-15 04:16 . 2010-10-08 09:04 3477280 ----a-w- c:\windows\system32\nvsvc64.dll
2013-03-15 04:16 . 2010-10-08 09:04 6398240 ----a-w- c:\windows\system32\nvcpl.dll
2013-03-15 04:16 . 2010-10-08 09:04 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-03-15 04:16 . 2010-10-08 09:04 877856 ----a-w- c:\windows\system32\nvvsvc.exe
2013-03-15 04:16 . 2010-10-08 09:04 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-03-15 04:16 . 2010-10-08 09:04 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-03-14 21:07 . 2013-03-14 21:07 559904 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-03-08 18:21 . 2012-11-17 11:31 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-03-08 18:21 . 2012-11-17 11:31 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-03-01 03:36 . 2013-04-10 13:49 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-02-26 06:55 . 2013-02-26 06:55 71680 ----a-w- c:\windows\system32\frapsv64.dll
2013-02-21 10:30 . 2013-04-10 13:50 1766912 ----a-w- c:\windows\SysWow64\wininet.dll
2013-02-21 10:29 . 2013-04-10 13:50 2877440 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-02-21 10:29 . 2013-04-10 13:50 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-02-21 10:29 . 2013-04-10 13:50 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-02-21 10:15 . 2013-04-10 13:50 51712 ----a-w- c:\windows\system32\ie4uinit.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Easy Driver Pro"="e:\easy driver pro\DPLauncher.exe" [2012-09-23 147312]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18672232]
"DAEMON Tools Lite"="e:\daemon tools lite\DTLite.exe" [2013-03-14 3672640]
"Advanced SystemCare 6"="e:\advanced systemcare 6\ASCTray.exe" [2013-04-18 491840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\Zkuřka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Verbatim GREEN BUTTON.lnk - e:\verbatim green button\GREEN BUTTON.exe [2012-11-17 463120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;e:\malwarebytes' anti-malware\mbamservice.exe [2013-04-04 701512]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2013-01-03 36680]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys [2012-12-24 20480]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 127488]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 18944]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 161280]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-16 1255736]
S0 aswKbd;aswKbd; [x]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2013-03-06 12368]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-27 283200]
S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;e:\advanced systemcare 6\ASCService.exe [2013-04-18 574272]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2013-05-09 137960]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2010-04-29 127800]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-03-14 383264]
S3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys [2011-11-28 33872]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-10 15:57 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-05-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-17 16:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - e:\micros~1\Office12\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - e:\micros~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 77.48.254.254 77.48.100.254
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
e:\malwarebytes' anti-malware\mbamscheduler.exe
c:\program files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe
c:\windows\SysWOW64\IoctlSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Celkový čas: 2013-05-14 17:59:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-05-14 15:59
ComboFix2.txt 2013-05-13 20:54
ComboFix3.txt 2013-05-13 13:26
ComboFix4.txt 2013-05-12 09:18
ComboFix5.txt 2013-05-14 15:37
.
Před spuštěním: Volných bajtů: 43 360 665 600
Po spuštění: Volných bajtů: 42 709 209 088
.
- - End Of File - - AA4DDFC29E8134F3053353CB838B5D8A
When You smoke herb it reveals you to yourself. All the wickedness you do is revealed by the herb - it's you conscience and gives you an honest picture of yourself.
---------- Robert Nesta Marley ----------

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43298
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod jaro3 » 14 kvě 2013 21:21

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.


Vlož nový log z HJT+ info o problémech
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

Uživatelský avatar
Scanner
Level 3.5
Level 3.5
Příspěvky: 771
Registrován: srpen 11
Bydliště: Střední čechy
Pohlaví: Muž
Stav:
Offline
Kontakt:

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod Scanner » 15 kvě 2013 19:04

Všechny ty vyskytující se reklamy a spamy jsou pryč. Od teď v tomto ohledu paráda. Akorát je PC snad poslední 3 dny o něco pomalejší, delší start, veškeré načítání, skáče ve složkách že neodpovídají. Nevím čím to je ale bylo by super jestli bys věděl o nějakém očištění. ;-)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:57:37, on 15.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16537)
Boot mode: Normal

Running processes:
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
E:\Advanced SystemCare 6\ASCTray.exe
E:\Verbatim GREEN BUTTON\GREEN BUTTON.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Zkuřka\Desktop\hijackthis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: (no name) - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - (no file)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Easy Driver Pro] E:\Easy Driver Pro\DPLauncher.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Advanced SystemCare 6] "E:\Advanced SystemCare 6\ASCTray.exe" /AutoStart
O4 - Startup: Verbatim GREEN BUTTON.lnk = E:\Verbatim GREEN BUTTON\GREEN BUTTON.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://E:\MICROS~1\Office14\ONBttnIE.dll/105
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Advanced SystemCare Service 6 (AdvancedSystemCareService6) - IObit - E:\Advanced SystemCare 6\ASCService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP SI Service (HPSIService) - Unknown owner - C:\Windows\system32\HPSIsvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - E:\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - E:\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 7615 bytes
When You smoke herb it reveals you to yourself. All the wickedness you do is revealed by the herb - it's you conscience and gives you an honest picture of yourself.
---------- Robert Nesta Marley ----------

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43298
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod jaro3 » 15 kvě 2013 19:08

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: (no name) - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - (no file)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"


Stáhni si na svojí plochu StartupLite .exe by MalwareBytes

Tento program identifikuje a dává volbu k odstranění nepotřebných položek k vyprázdnění paměti.
Poklepej na ikonu StartupLite.exe (by MalwareBytes ) ke spuštění programu. Ve vistě a windows 7 spusť jako správce (pravým klik na ikonu a vyber-spustit jako správce).Vytvoří se list nepotřebných vstupů po spuštění. Nech všechny položky jako deaktivované a klikni na Continue . Restartuj PC.


Stáhni si Memtest:

Do políčka vlož největší velikost Tvé jednotlivé paměti RAM (256,512 nebo 1024,2048) dej Start , nech nejméně 2h běžet , pokud bude po 2h stále 0 errors , jsou v pořádku.


Je třeba zkontrolovat HDD na chyby , zkusit jeho defragmentaci ..

Stáhni si CrystalDiskInfo
Spusť program a klikni na Úpravy-Kopírovat. Poté sem vlož pomocí Ctrl+V obsah logu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

Uživatelský avatar
Scanner
Level 3.5
Level 3.5
Příspěvky: 771
Registrován: srpen 11
Bydliště: Střední čechy
Pohlaví: Muž
Stav:
Offline
Kontakt:

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod Scanner » 15 kvě 2013 23:06

Fixnuto. A ten StartupLite my nejde.

----------------------------------------------------------------------------
CrystalDiskInfo 5.4.1 Shizuku Edition (C) 2008-2013 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 7 Ultimate Edition SP1 [6.1 Build 7601] (x64)
Date : 2013/05/15 23:05:59

-- Controller Map ----------------------------------------------------------
+ PCI Standardní dvoukanálový řadič IDE [ATA]
- ATA Channel 0 (0)
- ATA Channel 1 (1)
+ PCI Standardní dvoukanálový řadič IDE [ATA]
+ ATA Channel 0 (0)
- SAMSUNG HD753LJ ATA Device
- Hitachi HDS721010CLA632 ATA Device
+ ATA Channel 1 (1)
- HL-DT-ST DVDRAM GH22NS70 ATA Device

-- Disk List ---------------------------------------------------------------
(1) Hitachi HDS721010CLA632 : 1000,2 GB [0/0/0, pd1]
(2) SAMSUNG HD753LJ : 750,1 GB [1/0/1, pd1]

----------------------------------------------------------------------------
(1) Hitachi HDS721010CLA632
----------------------------------------------------------------------------
Model : Hitachi HDS721010CLA632
Firmware : JP4OA41A
Serial Number : JP2940J834X26V
Disk Size : 1000,2 GB (8,4/137,4/1000,2)
Buffer Size : 29999 KB
Queue Depth : 32
# of Sectors : 1953525168
Rotation Rate : 7200 RPM
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ATA8-ACS version 4
Transfer Mode : SATA/600
Power On Hours : 4984 hod.
Power On Count : 1134 krát
Temparature : 33 C (91 F)
Health Status : Dobrý
Features : S.M.A.R.T., 48bit LBA, NCQ
APM Level : ----
AAM Level : ----

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 100 _94 _16 000000000000 Počet chyb čtení
02 138 100 _54 000000000056 Průchodnost disku
03 121 100 _24 0006013B0139 Čas na roztočení ploten
04 100 100 __0 00000000048D Počet spuštění/zastavení
05 100 100 __5 000000000000 Počet přemapovaných sektorů
07 100 100 _67 000000000000 Počet chybných hledání
08 142 100 _20 00000000001D Čas potřebný na vyhledání
09 100 100 __0 000000001378 Hodin v činnosti
0A 100 100 _60 000000000000 Počet opakovaných pokusů o roztočení ploten
0C 100 100 __0 00000000046E Počet cyklů zapnutí zařízení
B7 100 100 __0 000000000000 Neznámý
B8 100 100 _97 000000000000 Ukončovacích chyb
B9 100 100 __0 00000000FFFF Neznámý
BB 100 100 __0 000000000000 Ohlášeno neopravitelných chyb
BC 100 _97 __0 0000000104A2 Časový limit příkazu
BD 100 100 __0 000000000000 Vysoká rychlost zápisu
BE _67 _54 __0 000016210021 Teplota toku vzduchu
C0 100 100 __0 00000000048D Počet vypnutí disku
C1 100 100 __0 00000000048D Počet cyklů načítání/vymazání
C2 181 133 __0 002E000A0021 Teplota
C4 100 100 __0 000000000000 Počet udalostí s číslem realokování sektorů
C5 100 100 __0 000000000000 Počet podezřelých sektorů
C6 100 100 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 045A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 2020 2020 2020 4A50 3239 3430 4A38 3334 5832 3656
020: 0003 EA5F 0038 4A50 344F 4134 3141 4869 7461 6368
030: 6920 4844 5337 3231 3031 3043 4C41 3633 3220 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 4000 2F00
050: 4000 0200 0200 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 050E 0006 004C 0040
080: 01FC 0029 306B 7C01 4123 3069 BC01 4123 207F 0070
090: 0071 0000 FFFE 0000 0000 0000 0000 0000 0000 0000
100: 6DB0 7470 0000 0000 0000 0000 0000 5A87 5000 CCA3
110: 96EC 815F 0000 0000 0000 0000 0000 0000 0000 401C
120: 401C 0000 0000 0000 0000 0000 0000 0000 0029 000B
130: 0000 0000 2180 0CF1 3800 0001 4000 2800 026A 0000
140: 0000 0B02 0A04 0605 0A06 0000 0000 0000 0000 0000
150: 0000 0000 3448 4334 0000 6804 0000 5DBD A1D3 8000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0002 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 003D 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 1C20 0000 0000
220: 0000 0000 103F 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0001 0080 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 48A5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 2F 00 64 5E 00 00 00 00 00 00 00 02 27
010: 00 8A 64 56 00 00 00 00 00 00 03 23 00 79 64 39
020: 01 3B 01 06 00 00 04 22 00 64 64 8D 04 00 00 00
030: 00 00 05 33 00 64 64 00 00 00 00 00 00 00 07 2F
040: 00 64 64 00 00 00 00 00 00 00 08 25 00 8E 64 1D
050: 00 00 00 00 00 00 09 32 00 64 64 78 13 00 00 00
060: 00 00 0A 33 00 64 64 00 00 00 00 00 00 00 0C 32
070: 00 64 64 6E 04 00 00 00 00 00 B7 32 00 64 64 00
080: 00 00 00 00 00 00 B8 33 00 64 64 00 00 00 00 00
090: 00 00 B9 32 00 64 64 FF FF 00 00 00 00 00 BB 32
0A0: 00 64 64 00 00 00 00 00 00 00 BC 32 00 64 61 A2
0B0: 04 01 00 00 00 00 BD 32 00 64 64 00 00 00 00 00
0C0: 00 00 BE 22 00 43 36 21 00 21 16 00 00 00 C0 32
0D0: 00 64 64 8D 04 00 00 00 00 00 C1 32 00 64 64 8D
0E0: 04 00 00 00 00 00 C2 02 00 B5 85 21 00 0A 00 2E
0F0: 00 00 C4 32 00 64 64 00 00 00 00 00 00 00 C5 32
100: 00 64 64 00 00 00 00 00 00 00 C6 30 00 64 64 00
110: 00 00 00 00 00 00 C7 32 00 C8 C8 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 84 00 3F 27 01 5B
170: 03 00 01 00 02 A7 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 10 00 00 00 00 00 00 00 00 00 00 02 36
010: 00 00 00 00 00 00 00 00 00 00 03 18 00 00 00 00
020: 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00
030: 00 00 05 05 00 00 00 00 00 00 00 00 00 00 07 43
040: 00 00 00 00 00 00 00 00 00 00 08 14 00 00 00 00
050: 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00 00
060: 00 00 0A 3C 00 00 00 00 00 00 00 00 00 00 0C 00
070: 00 00 00 00 00 00 00 00 00 00 B7 00 00 00 00 00
080: 00 00 00 00 00 00 B8 61 00 00 00 00 00 00 00 00
090: 00 00 B9 00 00 00 00 00 00 00 00 00 00 00 BB 00
0A0: 00 00 00 00 00 00 00 00 00 00 BC 00 00 00 00 00
0B0: 00 00 00 00 00 00 BD 00 00 00 00 00 00 00 00 00
0C0: 00 00 BE 00 00 00 00 00 00 00 00 00 00 00 C0 00
0D0: 00 00 00 00 00 00 00 00 00 00 C1 00 00 00 00 00
0E0: 00 00 00 00 00 00 C2 00 00 00 00 00 00 00 00 00
0F0: 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 C5 00
100: 00 00 00 00 00 00 00 00 00 00 C6 00 00 00 00 00
110: 00 00 00 00 00 00 C7 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9

----------------------------------------------------------------------------
(2) SAMSUNG HD753LJ
----------------------------------------------------------------------------
Model : SAMSUNG HD753LJ
Firmware : 1AA01113
Serial Number : S13UJDWQ912071
Disk Size : 750,1 GB (8,4/137,4/750,1)
Buffer Size : 32767 KB
Queue Depth : 32
# of Sectors : 1465149168
Rotation Rate : Neznámy údaj
Interface : Serial ATA
Major Version : ATA/ATAPI-7
Minor Version : ATA8-ACS version 3b
Transfer Mode : SATA/300
Power On Hours : 15289 hod.
Power On Count : 2416 krát
Temparature : 27 C (80 F)
Health Status : Dobrý
Features : S.M.A.R.T., APM, AAM, 48bit LBA, NCQ
APM Level : 0000h [OFF]
AAM Level : FE00h [OFF]

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 100 _99 _51 000000000004 Počet chyb čtení
03 _75 _75 _11 000000002102 Čas na roztočení ploten
04 _95 _95 __0 000000001336 Počet spuštění/zastavení
05 100 100 _10 000000000000 Počet přemapovaných sektorů
07 100 100 _51 000000000000 Počet chybných hledání
08 100 100 _15 000000000000 Čas potřebný na vyhledání
09 _97 _97 __0 000000003BB9 Hodin v činnosti
0A 100 100 _51 000000000002 Počet opakovaných pokusů o roztočení ploten
0B 100 100 __0 000000000002 Počet pokusů o překalibrování
0C _98 _98 __0 000000000970 Počet cyklů zapnutí zařízení
0D 100 100 __0 000000000000 Počet pokusů o softvérové opravení chyb při čtení programů z disku
B7 100 100 __0 000000000000 Neznámý
B8 100 100 __0 000000000000 Ukončovacích chyb
BB 100 100 __0 000000000000 Ohlášeno neopravitelných chyb
BC 100 100 __0 000000000000 Časový limit příkazu
BE _75 _59 __0 000019100019 Teplota toku vzduchu
C2 _73 _59 __0 00001C10001B Teplota
C3 100 100 __0 00000000FFC5 Počet oprav chybného čtení
C4 100 100 __0 000000000000 Počet udalostí s číslem realokování sektorů
C5 100 100 __0 000000000000 Počet podezřelých sektorů
C6 100 100 __0 000000000000 Počet neopravitelných sektorů
C7 100 100 __0 000000000001 Počet chyb v kontrolním součtu UltraDMA
C8 _99 _99 __0 000000000072 Počet chyb při zápisu sektorů
C9 253 253 __0 000000000000 Počet chyb při čtení programů z disku

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 0040 3FFF C837 0010 8856 022A 003F 0000 0000 0000
010: 5331 3355 4A44 5751 3931 3230 3731 2020 2020 2020
020: 0003 FFFF 0004 3141 4130 3131 3133 5341 4D53 554E
030: 4720 4844 3735 334C 4A20 2020 2020 2020 2020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 0000 2F00
050: 4000 0200 0200 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 1706 0000 004C 0040
080: 00F8 0052 746B 7F69 4133 7469 BC41 4123 20FF 0057
090: 0057 0000 FFFE 0000 FE00 0008 0005 005D 86A0 0001
100: 66F0 5754 0000 0000 0064 0000 0000 0000 5000 0F00
110: 0319 0217 0000 0000 0000 0000 0000 0000 0000 401C
120: 401C 0000 0000 0000 0000 0000 0000 0000 0029 0000
130: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
140: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
150: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 003F 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0001 0400 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 DBA5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 0F 00 64 63 04 00 00 00 00 00 00 03 07
010: 00 4B 4B 02 21 00 00 00 00 00 04 32 00 5F 5F 36
020: 13 00 00 00 00 00 05 33 00 64 64 00 00 00 00 00
030: 00 00 07 0F 00 64 64 00 00 00 00 00 00 00 08 25
040: 00 64 64 00 00 00 00 00 00 00 09 32 00 61 61 B9
050: 3B 00 00 00 00 00 0A 33 00 64 64 02 00 00 00 00
060: 00 00 0B 12 00 64 64 02 00 00 00 00 00 00 0C 32
070: 00 62 62 70 09 00 00 00 00 00 0D 0E 00 64 64 00
080: 00 00 00 00 00 00 B7 32 00 64 64 00 00 00 00 00
090: 00 00 B8 33 00 64 64 00 00 00 00 00 00 00 BB 32
0A0: 00 64 64 00 00 00 00 00 00 00 BC 32 00 64 64 00
0B0: 00 00 00 00 00 00 BE 22 00 4B 3B 19 00 10 19 00
0C0: 00 00 C2 22 00 49 3B 1B 00 10 1C 00 00 00 C3 1A
0D0: 00 64 64 C5 FF 00 00 00 00 00 C4 32 00 64 64 00
0E0: 00 00 00 00 00 00 C5 12 00 64 64 00 00 00 00 00
0F0: 00 00 C6 30 00 64 64 00 00 00 00 00 00 00 C7 3E
100: 00 64 64 01 00 00 00 00 00 00 C8 0A 00 63 63 72
110: 00 00 00 00 00 00 C9 0A 00 FD FD 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 EB 2C 00 7B
170: 03 00 01 00 02 C0 15 C0 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 33 00 00 00 00 00 00 00 00 00 00 03 0B
010: 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00
020: 00 00 00 00 00 00 05 0A 00 00 00 00 00 00 00 00
030: 00 00 07 33 00 00 00 00 00 00 00 00 00 00 08 0F
040: 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00
050: 00 00 00 00 00 00 0A 33 00 00 00 00 00 00 00 00
060: 00 00 0B 00 00 00 00 00 00 00 00 00 00 00 0C 00
070: 00 00 00 00 00 00 00 00 00 00 0D 00 00 00 00 00
080: 00 00 00 00 00 00 B7 00 00 00 00 00 00 00 00 00
090: 00 00 B8 00 00 00 00 00 00 00 00 00 00 00 BB 00
0A0: 00 00 00 00 00 00 00 00 00 00 BC 00 00 00 00 00
0B0: 00 00 00 00 00 00 BE 00 00 00 00 00 00 00 00 00
0C0: 00 00 C2 00 00 00 00 00 00 00 00 00 00 00 C3 00
0D0: 00 00 00 00 00 00 00 00 00 00 C4 00 00 00 00 00
0E0: 00 00 00 00 00 00 C5 00 00 00 00 00 00 00 00 00
0F0: 00 00 C6 00 00 00 00 00 00 00 00 00 00 00 C7 00
100: 00 00 00 00 00 00 00 00 00 00 C8 00 00 00 00 00
110: 00 00 00 00 00 00 C9 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10
Přílohy
_.jpg
When You smoke herb it reveals you to yourself. All the wickedness you do is revealed by the herb - it's you conscience and gives you an honest picture of yourself.
---------- Robert Nesta Marley ----------

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43298
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím kontrolu, podezření na spam v PC

Příspěvekod jaro3 » 16 kvě 2013 09:54

Program OK...nic nenašel.



Co Memtest?
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra


Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: DotNetDotCom.org [Bot] a 104 hostů