Prosím o kontrolu logu Vyřešeno

[cobr4in]

Tak to bol podnet, ale vyzerá, že aj Jaro niečo našiel.

[Reklama]

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Koukni občas do:
C:\Windows\Minidump jestli se tam soubor objeví.

[cobr4in]

ComboFix 13-05-18.04 - CoBain_SK . 05. 2013 15:40:34.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.8159.6278 [GMT 2:00]
Running from: c:\users\CoBain_SK\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\CoBain_SK\AppData\Roaming\0ad
c:\users\CoBain_SK\AppData\Roaming\0ad\config\user.cfg
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\frapsvid.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-04-20 to 2013-05-20 )))))))))))))))))))))))))))))))
.
.
2013-05-20 13:42 . 2013-05-20 13:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-20 10:34 . 2013-05-20 10:34 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE445AB2-D1A3-4F70-AA5F-1004CCED10EA}\offreg.dll
2013-05-20 10:27 . 2013-05-20 10:36 -------- d-----w- c:\program files\WhoCrashed
2013-05-19 23:59 . 2013-05-19 23:59 -------- d-----w- c:\users\CoBain_SK\AppData\Local\Adobe
2013-05-19 16:15 . 2013-05-19 16:15 -------- d-----w- c:\users\CoBain_SK\AppData\Local\ESN
2013-05-19 15:52 . 2013-05-19 15:53 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-05-19 15:52 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-17 08:56 . 2013-05-17 08:56 388096 ----a-r- c:\users\CoBain_SK\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-05-17 07:01 . 2013-05-17 08:48 -------- d-----w- C:\Boot
2013-05-16 19:23 . 2013-05-13 23:48 9460464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE445AB2-D1A3-4F70-AA5F-1004CCED10EA}\mpengine.dll
2013-05-16 19:14 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-05-16 19:14 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-16 19:14 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-16 19:14 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-16 19:14 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-16 19:14 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-15 23:10 . 2013-05-15 23:10 -------- d-----w- c:\users\CoBain_SK\AppData\Local\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{1CEDDDD4-56D2-463F-BC4E-C5DFFD3533C9}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files (x86)\Common Files\Digidesign
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{DCC412E7-393B-4016-91FB-9307F059AFB6}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files\Common Files\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\programdata\Native Instruments
2013-04-26 11:52 . 2013-04-26 11:52 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-22 10:22 . 2013-04-22 10:22 -------- d-----w- c:\programdata\NVIDIA
2013-04-22 10:21 . 2013-04-22 10:21 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2013-04-22 10:16 . 2013-05-15 19:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-22 10:16 . 2013-05-15 19:40 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-20 10:44 . 2013-01-15 18:40 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-05-20 10:44 . 2012-10-15 09:57 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-05-19 22:50 . 2013-01-15 18:40 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-05-16 19:22 . 2012-10-14 20:30 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-02 00:06 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-19 02:00 . 2013-04-19 02:00 25600 ----a-w- c:\windows\system32\drivers\rzdaendpt.sys
2013-04-19 02:00 . 2013-04-19 02:00 23040 ----a-w- c:\windows\system32\drivers\rzvkeyboard.sys
2013-04-19 02:00 . 2013-04-19 02:00 119808 ----a-w- c:\windows\system32\drivers\rzudd.sys
2013-04-19 01:56 . 2013-04-19 01:56 56832 ----a-w- c:\windows\SysWow64\rzdevinfo.dll
2013-04-19 01:56 . 2013-04-19 01:56 148480 ----a-w- c:\windows\SysWow64\rztouchdll.dll
2013-04-19 01:56 . 2013-04-19 01:56 724480 ----a-w- c:\windows\SysWow64\rzdevicedll.dll
2013-04-19 01:56 . 2013-04-19 01:56 288256 ----a-w- c:\windows\SysWow64\rzaudiodll.dll
2013-04-13 05:49 . 2013-05-16 19:15 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 19:15 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 19:15 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 19:15 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 19:15 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 19:15 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-04 03:35 . 2013-03-09 15:38 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-19 06:04 . 2013-04-11 00:35 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-11 00:35 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-11 00:35 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-11 00:35 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-11 00:35 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-11 00:35 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-09 15:38 . 2012-10-14 22:31 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-03-09 15:38 . 2012-10-14 22:31 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"DAEMON Tools Lite"="d:\programy\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-04-22 608104]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-11-30 56128]
.
c:\users\CoBain_SK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Fences.lnk - d:\programy\Stardock\Fences\Fences.exe [2012-10-9 4011736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 LicCtrlService;LicCtrl Service;c:\windows\runservice.exe [2013-01-17 16384]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
R3 ALSysIO;ALSysIO;c:\users\COBAIN~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RTCore64;RTCore64;d:\programy\MSI Afterburner\RTCore64.sys [2013-01-23 13368]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-10-14 1255736]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys [2012-11-19 652344]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys [2012-11-19 28216]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-10-14 283200]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2012-10-08 211344]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2012-10-08 149592]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2012-10-23 1329304]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2012-10-08 138744]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-11-19 14904]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2011-06-29 171688]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-02-26 3560800]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-09-14 129000]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-09-14 394216]
S3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2011-03-10 2725376]
S3 rzdaendpt;Razer DeathAdder end point;c:\windows\system32\DRIVERS\rzdaendpt.sys [2013-04-19 25600]
S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys [2013-04-19 119808]
S3 rzvkeyboard;Razer Virtual Keyboard Driver;c:\windows\system32\DRIVERS\rzvkeyboard.sys [2013-04-19 23040]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-10 11:48 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-22 19:40]
.
2013-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce4db74a4e1861.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-14 14:03]
.
2013-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-14 14:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio8788GX"="c:\windows\syswow64\HsMgr.exe" [2008-07-11 200704]
"Cmaudio8788GX64"="c:\windows\system\HsMgr64.exe" [2008-07-11 282112]
"BCSSync"="d:\programy\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"Fences"="d:\programy\Stardock\Fences\Fences.exe" [2012-10-09 4011736]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2012-10-23 6325424]
"AutoKMS"="c:\windows\AutoKMS.exe" [2013-01-25 615936]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "d:\programy\Stardock\Fences\FencesMenu64.dll" [2012-10-09 551640]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.sk/
mLocal Page = c:\windows\SYSTEM32\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - d:\programy\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\CoBain_SK\AppData\Roaming\Mozilla\Firefox\Profiles\p9tbya7x.default\
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3713588044-2388146318-2309624440-1000\Software\SecuROM\License information*]
"datasecu"=hex:d0,09,ba,06,4b,08,16,89,95,08,4e,87,14,58,56,1e,f9,7b,19,f4,9e,
27,fc,08,9c,23,63,4e,64,9a,5b,5b,c0,07,82,55,0e,0c,a1,66,34,1d,18,f3,78,cc,\
"rkeysecu"=hex:d6,3f,ba,92,db,82,3d,6b,6f,a7,64,6e,3a,0a,30,6c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\0BB4AB33ED50D261F5C8A2C244CF5435]
"1"=hex:df,c7,3a,96,ab,66,13,d2,36,78,6c,b8,10,1c,c4,b0,41,14,92,53,8b,f4,9f,
53,ff,8f,6c,08,d5,ab,f1,06
"2"=hex:7d,73,4a,d4,1d,ee,c7,5a
"3"=hex:81,20,8f,ab,28,6a,52,9c
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:97,e4,84,cd,95,83,bf,82,bd,04,75,27,c9,a8,72,b1,55,38,49,8a,a6,16,a2,
28,28,eb,ee,eb,0f,d6,d6,b8,f4,df,4a,8d,b5,18,4f,2a,0d,c4,ee,cf,81,df,fe,df,\
"8"=hex:c3,6e,bb,a2,c5,9e,59,6f,a2,cd,49,1f,fd,00,ae,43,d3,82,7c,99,67,5f,2e,
44,48,42,af,41,f5,b2,3d,3c,f5,13,cf,5c,4c,10,69,4a,c9,00,16,14,26,79,06,12,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:b6,dd,00,4d,9d,38,11,d1
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-20 15:43:31
ComboFix-quarantined-files.txt 2013-05-20 13:43
.
Pre-Run: 6 245 392 384 bytes free
Post-Run: 6 607 577 088 bytes free
.
- - End Of File - - 707BC63C93349C6B13E8F240957205A7

[memphisto]

Málo místa na systémovém disku...

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
Driver::
SkypeUpdate

Folder::
c:\program files (x86)\Skype\Updater

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce4db74a4e1861.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\AutoKMS.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoKMS"=-

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upus.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[cobr4in]

ComboFix 13-05-18.04 - CoBain_SK . 05. 2013 1:26.3.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.8159.6020 [GMT 2:00]
Running from: c:\users\CoBain_SK\Desktop\ComboFix.exe
Command switches used :: c:\users\CoBain_SK\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\AutoKMS.exe"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce4db74a4e1861.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Skype\Updater
c:\program files (x86)\Skype\Updater\Updater.dll
c:\program files (x86)\Skype\Updater\Updater.exe
c:\windows\AutoKMS.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce4db74a4e1861.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SkypeUpdate
.
.
((((((((((((((((((((((((( Files Created from 2013-04-20 to 2013-05-20 )))))))))))))))))))))))))))))))
.
.
2013-05-20 23:28 . 2013-05-20 23:28 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-05-20 23:28 . 2013-05-20 23:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-20 10:27 . 2013-05-20 10:36 -------- d-----w- c:\program files\WhoCrashed
2013-05-19 23:59 . 2013-05-19 23:59 -------- d-----w- c:\users\CoBain_SK\AppData\Local\Adobe
2013-05-19 16:15 . 2013-05-19 16:15 -------- d-----w- c:\users\CoBain_SK\AppData\Local\ESN
2013-05-17 08:56 . 2013-05-17 08:56 388096 ----a-r- c:\users\CoBain_SK\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-05-17 07:01 . 2013-05-17 08:48 -------- d-----w- C:\Boot
2013-05-16 19:23 . 2013-05-13 23:48 9460464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE445AB2-D1A3-4F70-AA5F-1004CCED10EA}\mpengine.dll
2013-05-16 19:14 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-05-16 19:14 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-16 19:14 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-16 19:14 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-16 19:14 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-16 19:14 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-15 23:10 . 2013-05-15 23:10 -------- d-----w- c:\users\CoBain_SK\AppData\Local\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{1CEDDDD4-56D2-463F-BC4E-C5DFFD3533C9}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files (x86)\Common Files\Digidesign
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{DCC412E7-393B-4016-91FB-9307F059AFB6}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files\Common Files\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\programdata\Native Instruments
2013-04-26 11:52 . 2013-04-26 11:52 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-22 10:22 . 2013-04-22 10:22 -------- d-----w- c:\programdata\NVIDIA
2013-04-22 10:21 . 2013-04-22 10:21 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2013-04-22 10:16 . 2013-05-15 19:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-22 10:16 . 2013-05-15 19:40 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-20 15:35 . 2013-01-15 18:40 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-05-20 15:35 . 2012-10-15 09:57 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-05-20 15:30 . 2013-01-15 18:40 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-05-16 19:22 . 2012-10-14 20:30 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-02 00:06 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-19 02:00 . 2013-04-19 02:00 25600 ----a-w- c:\windows\system32\drivers\rzdaendpt.sys
2013-04-19 02:00 . 2013-04-19 02:00 23040 ----a-w- c:\windows\system32\drivers\rzvkeyboard.sys
2013-04-19 02:00 . 2013-04-19 02:00 119808 ----a-w- c:\windows\system32\drivers\rzudd.sys
2013-04-19 01:56 . 2013-04-19 01:56 56832 ----a-w- c:\windows\SysWow64\rzdevinfo.dll
2013-04-19 01:56 . 2013-04-19 01:56 148480 ----a-w- c:\windows\SysWow64\rztouchdll.dll
2013-04-19 01:56 . 2013-04-19 01:56 724480 ----a-w- c:\windows\SysWow64\rzdevicedll.dll
2013-04-19 01:56 . 2013-04-19 01:56 288256 ----a-w- c:\windows\SysWow64\rzaudiodll.dll
2013-04-13 05:49 . 2013-05-16 19:15 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 19:15 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 19:15 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 19:15 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 19:15 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 19:15 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-04 03:35 . 2013-03-09 15:38 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-19 06:04 . 2013-04-11 00:35 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-11 00:35 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-11 00:35 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-11 00:35 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-11 00:35 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-11 00:35 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-09 15:38 . 2012-10-14 22:31 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-03-09 15:38 . 2012-10-14 22:31 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"DAEMON Tools Lite"="d:\programy\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-04-22 608104]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-11-30 56128]
.
c:\users\CoBain_SK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Fences.lnk - d:\programy\Stardock\Fences\Fences.exe [2012-10-9 4011736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-11-19 14904]
R3 ALSysIO;ALSysIO;c:\users\COBAIN~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RTCore64;RTCore64;d:\programy\MSI Afterburner\RTCore64.sys [2013-01-23 13368]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-10-14 1255736]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys [2012-11-19 652344]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys [2012-11-19 28216]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-10-14 283200]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2012-10-08 211344]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2012-10-08 149592]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2012-10-23 1329304]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2012-10-08 138744]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2011-06-29 171688]
S2 LicCtrlService;LicCtrl Service;c:\windows\runservice.exe [2013-01-17 16384]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-02-26 3560800]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-09-14 129000]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-09-14 394216]
S3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2011-03-10 2725376]
S3 rzdaendpt;Razer DeathAdder end point;c:\windows\system32\DRIVERS\rzdaendpt.sys [2013-04-19 25600]
S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys [2013-04-19 119808]
S3 rzvkeyboard;Razer Virtual Keyboard Driver;c:\windows\system32\DRIVERS\rzvkeyboard.sys [2013-04-19 23040]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-10 11:48 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-22 19:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio8788GX"="c:\windows\syswow64\HsMgr.exe" [2008-07-11 200704]
"Cmaudio8788GX64"="c:\windows\system\HsMgr64.exe" [2008-07-11 282112]
"BCSSync"="d:\programy\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"Fences"="d:\programy\Stardock\Fences\Fences.exe" [2012-10-09 4011736]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2012-10-23 6325424]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "d:\programy\Stardock\Fences\FencesMenu64.dll" [2012-10-09 551640]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.sk/
mLocal Page = c:\windows\SYSTEM32\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - d:\programy\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\CoBain_SK\AppData\Roaming\Mozilla\Firefox\Profiles\p9tbya7x.default\
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3713588044-2388146318-2309624440-1000\Software\SecuROM\License information*]
"datasecu"=hex:d0,09,ba,06,4b,08,16,89,95,08,4e,87,14,58,56,1e,f9,7b,19,f4,9e,
27,fc,08,9c,23,63,4e,64,9a,5b,5b,c0,07,82,55,0e,0c,a1,66,34,1d,18,f3,78,cc,\
"rkeysecu"=hex:d6,3f,ba,92,db,82,3d,6b,6f,a7,64,6e,3a,0a,30,6c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\0BB4AB33ED50D261F5C8A2C244CF5435]
"1"=hex:df,c7,3a,96,ab,66,13,d2,36,78,6c,b8,10,1c,c4,b0,41,14,92,53,8b,f4,9f,
53,ff,8f,6c,08,d5,ab,f1,06
"2"=hex:7d,73,4a,d4,1d,ee,c7,5a
"3"=hex:81,20,8f,ab,28,6a,52,9c
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:97,e4,84,cd,95,83,bf,82,bd,04,75,27,c9,a8,72,b1,55,38,49,8a,a6,16,a2,
28,28,eb,ee,eb,0f,d6,d6,b8,f4,df,4a,8d,b5,18,4f,2a,0d,c4,ee,cf,81,df,fe,df,\
"8"=hex:c3,6e,bb,a2,c5,9e,59,6f,a2,cd,49,1f,fd,00,ae,43,d3,82,7c,99,67,5f,2e,
44,48,42,af,41,f5,b2,3d,3c,f5,13,cf,5c,4c,10,69,4a,c9,00,16,14,26,79,06,12,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:b6,dd,00,4d,9d,38,11,d1
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
d:\programy\Fraps\fraps.exe
.
**************************************************************************
.
Completion time: 2013-05-21 01:30:36 - machine was rebooted
ComboFix-quarantined-files.txt 2013-05-20 23:30
ComboFix2.txt 2013-05-20 13:43
.
Pre-Run: 6 223 867 904 bytes free
Post-Run: 6 041 505 792 bytes free
.
- - End Of File - - FDB765FFB7420BDD92B4F134D1275035

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

DirLook::
C:\Boot

RegLog::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
 25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
 c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
 8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\0BB4AB33ED50D261F5C8A2C244CF5435]
"1"=hex:df,c7,3a,96,ab,66,13,d2,36,78,6c,b8,10,1c,c4,b0,41,14,92,53,8b,f4,9f,
 53,ff,8f,6c,08,d5,ab,f1,06
"2"=hex:7d,73,4a,d4,1d,ee,c7,5a
"3"=hex:81,20,8f,ab,28,6a,52,9c
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
 51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:97,e4,84,cd,95,83,bf,82,bd,04,75,27,c9,a8,72,b1,55,38,49,8a,a6,16,a2,
 28,28,eb,ee,eb,0f,d6,d6,b8,f4,df,4a,8d,b5,18,4f,2a,0d,c4,ee,cf,81,df,fe,df,\
"8"=hex:c3,6e,bb,a2,c5,9e,59,6f,a2,cd,49,1f,fd,00,ae,43,d3,82,7c,99,67,5f,2e,
 44,48,42,af,41,f5,b2,3d,3c,f5,13,cf,5c,4c,10,69,4a,c9,00,16,14,26,79,06,12,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:b6,dd,00,4d,9d,38,11,d1
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

Stáhni si a nainstaluj WhoCrashed
otevři ho a klikni na Analyze.
Program vytvoří zprávu , zkopíruj celou a vlož prosím sem.

c:\users\CoBain_SK\AppData\Local\ESN znáš ten program?

[cobr4in]

Ten ESN je program potrebný pre fungovanie Battlefieldu 3 v súvislosti s Battlelogom, je to v pohode.

---

ComboFix 13-05-21.01 - CoBain_SK . 05. 2013 18:41:01.4.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.8159.6095 [GMT 2:00]
Running from: c:\users\CoBain_SK\Desktop\ComboFix.exe
Command switches used :: c:\users\CoBain_SK\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2013-04-21 to 2013-05-21 )))))))))))))))))))))))))))))))
.
.
2013-05-21 16:43 . 2013-05-21 16:43 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-05-21 16:43 . 2013-05-21 16:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-20 10:27 . 2013-05-20 10:36 -------- d-----w- c:\program files\WhoCrashed
2013-05-19 23:59 . 2013-05-19 23:59 -------- d-----w- c:\users\CoBain_SK\AppData\Local\Adobe
2013-05-19 16:15 . 2013-05-19 16:15 -------- d-----w- c:\users\CoBain_SK\AppData\Local\ESN
2013-05-17 08:56 . 2013-05-17 08:56 388096 ----a-r- c:\users\CoBain_SK\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-05-17 07:01 . 2013-05-17 08:48 -------- d-----w- C:\Boot
2013-05-16 19:23 . 2013-05-13 23:48 9460464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE445AB2-D1A3-4F70-AA5F-1004CCED10EA}\mpengine.dll
2013-05-16 19:14 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-05-16 19:14 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-16 19:14 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-16 19:14 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-16 19:14 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-16 19:14 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-15 23:10 . 2013-05-15 23:10 -------- d-----w- c:\users\CoBain_SK\AppData\Local\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{1CEDDDD4-56D2-463F-BC4E-C5DFFD3533C9}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files (x86)\Common Files\Digidesign
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{DCC412E7-393B-4016-91FB-9307F059AFB6}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files\Common Files\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- dc-h--w- c:\programdata\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\program files\Native Instruments
2013-05-15 23:01 . 2013-05-15 23:01 -------- d-----w- c:\programdata\Native Instruments
2013-04-26 11:52 . 2013-04-26 11:52 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-04-22 10:22 . 2013-04-22 10:22 -------- d-----w- c:\programdata\NVIDIA
2013-04-22 10:21 . 2013-04-22 10:21 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2013-04-22 10:16 . 2013-05-15 19:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-22 10:16 . 2013-05-15 19:40 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-21 16:03 . 2013-01-15 18:40 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-05-21 16:03 . 2012-10-15 09:57 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-05-21 15:42 . 2013-01-15 18:40 291088 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-05-16 19:22 . 2012-10-14 20:30 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-02 00:06 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-19 02:00 . 2013-04-19 02:00 25600 ----a-w- c:\windows\system32\drivers\rzdaendpt.sys
2013-04-19 02:00 . 2013-04-19 02:00 23040 ----a-w- c:\windows\system32\drivers\rzvkeyboard.sys
2013-04-19 02:00 . 2013-04-19 02:00 119808 ----a-w- c:\windows\system32\drivers\rzudd.sys
2013-04-19 01:56 . 2013-04-19 01:56 56832 ----a-w- c:\windows\SysWow64\rzdevinfo.dll
2013-04-19 01:56 . 2013-04-19 01:56 148480 ----a-w- c:\windows\SysWow64\rztouchdll.dll
2013-04-19 01:56 . 2013-04-19 01:56 724480 ----a-w- c:\windows\SysWow64\rzdevicedll.dll
2013-04-19 01:56 . 2013-04-19 01:56 288256 ----a-w- c:\windows\SysWow64\rzaudiodll.dll
2013-04-13 05:49 . 2013-05-16 19:15 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 19:15 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 19:15 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 19:15 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 19:15 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 19:15 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-04 03:35 . 2013-03-09 15:38 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-19 06:04 . 2013-04-11 00:35 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-11 00:35 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-11 00:35 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-11 00:35 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-11 00:35 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-11 00:35 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-09 15:38 . 2012-10-14 22:31 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-03-09 15:38 . 2012-10-14 22:31 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\Boot ----
.
2013-05-17 07:04 . 2013-05-17 07:04 0 --sha-w- c:\boot\BCD.LOG1
2013-05-17 07:04 . 2013-05-17 07:04 0 --sha-w- c:\boot\BCD.LOG2
2013-05-17 07:04 . 2013-05-21 16:40 21504 --sha-w- c:\boot\BCD.LOG
2013-05-17 07:04 . 2013-05-21 16:40 24576 --sha-w- c:\boot\BCD
2013-05-17 07:01 . 2009-06-10 20:31 47452 ----a-w- c:\boot\Fonts\wgl4_boot.ttf
2013-05-17 07:01 . 2009-06-10 20:31 2371360 ----a-w- c:\boot\Fonts\kor_boot.ttf
2013-05-17 07:01 . 2009-06-10 20:31 1984228 ----a-w- c:\boot\Fonts\jpn_boot.ttf
2013-05-17 07:01 . 2009-06-10 20:31 3876772 ----a-w- c:\boot\Fonts\cht_boot.ttf
2013-05-17 07:01 . 2009-06-10 20:31 3694080 ----a-w- c:\boot\Fonts\chs_boot.ttf
2013-05-17 07:01 . 2013-05-17 07:01 65536 --sha-w- c:\boot\BOOTSTAT.DAT
2013-05-17 07:01 . 2009-07-14 01:17 70208 ----a-w- c:\boot\zh-TW\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 70224 ----a-w- c:\boot\zh-HK\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 70720 ----a-w- c:\boot\zh-CN\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 87104 ----a-w- c:\boot\tr-TR\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 87616 ----a-w- c:\boot\sv-SE\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 90192 ----a-w- c:\boot\ru-RU\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 89664 ----a-w- c:\boot\pt-PT\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 90176 ----a-w- c:\boot\pt-BR\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 90704 ----a-w- c:\boot\pl-PL\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 90704 ----a-w- c:\boot\nl-NL\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 88144 ----a-w- c:\boot\nb-NO\bootmgr.exe.mui
2013-05-17 07:01 . 2010-11-21 03:24 485760 ----a-w- c:\boot\memtest.exe
2013-05-17 07:01 . 2009-07-14 01:17 75344 ----a-w- c:\boot\ko-KR\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 76352 ----a-w- c:\boot\ja-JP\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 90704 ----a-w- c:\boot\it-IT\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 90688 ----a-w- c:\boot\hu-HU\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 93248 ----a-w- c:\boot\fr-FR\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 89152 ----a-w- c:\boot\fi-FI\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 90192 ----a-w- c:\boot\es-ES\bootmgr.exe.mui
2013-05-17 07:01 . 2010-11-21 15:00 43600 ----a-w- c:\boot\en-US\memtest.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 85056 ----a-w- c:\boot\en-US\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 94800 ----a-w- c:\boot\el-GR\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 91712 ----a-w- c:\boot\de-DE\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 87616 ----a-w- c:\boot\da-DK\bootmgr.exe.mui
2013-05-17 07:01 . 2009-07-14 01:17 89168 ----a-w- c:\boot\cs-CZ\bootmgr.exe.mui
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"DAEMON Tools Lite"="d:\programy\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-04-22 608104]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-11-30 56128]
.
c:\users\CoBain_SK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Fences.lnk - d:\programy\Stardock\Fences\Fences.exe [2012-10-9 4011736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 LicCtrlService;LicCtrl Service;c:\windows\runservice.exe [2013-01-17 16384]
R3 ALSysIO;ALSysIO;c:\users\COBAIN~1\AppData\Local\Temp\ALSysIO64.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RTCore64;RTCore64;d:\programy\MSI Afterburner\RTCore64.sys [2013-01-23 13368]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-10-14 1255736]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys [2012-11-19 652344]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys [2012-11-19 28216]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-10-14 283200]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2012-10-08 211344]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2012-10-08 149592]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2012-10-23 1329304]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2012-10-08 138744]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-11-19 14904]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2011-06-29 171688]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-02-26 3560800]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-09-14 129000]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-09-14 394216]
S3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2011-03-10 2725376]
S3 rzdaendpt;Razer DeathAdder end point;c:\windows\system32\DRIVERS\rzdaendpt.sys [2013-04-19 25600]
S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys [2013-04-19 119808]
S3 rzvkeyboard;Razer Virtual Keyboard Driver;c:\windows\system32\DRIVERS\rzvkeyboard.sys [2013-04-19 23040]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-10 11:48 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-22 19:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio8788GX"="c:\windows\syswow64\HsMgr.exe" [2008-07-11 200704]
"Cmaudio8788GX64"="c:\windows\system\HsMgr64.exe" [2008-07-11 282112]
"BCSSync"="d:\programy\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"Fences"="d:\programy\Stardock\Fences\Fences.exe" [2012-10-09 4011736]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2012-10-23 6325424]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "d:\programy\Stardock\Fences\FencesMenu64.dll" [2012-10-09 551640]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.sk/
mLocal Page = c:\windows\SYSTEM32\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - d:\programy\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\CoBain_SK\AppData\Roaming\Mozilla\Firefox\Profiles\p9tbya7x.default\
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3713588044-2388146318-2309624440-1000\Software\SecuROM\License information*]
"datasecu"=hex:d0,09,ba,06,4b,08,16,89,95,08,4e,87,14,58,56,1e,f9,7b,19,f4,9e,
27,fc,08,9c,23,63,4e,64,9a,5b,5b,c0,07,82,55,0e,0c,a1,66,34,1d,18,f3,78,cc,\
"rkeysecu"=hex:d6,3f,ba,92,db,82,3d,6b,6f,a7,64,6e,3a,0a,30,6c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\0BB4AB33ED50D261F5C8A2C244CF5435]
"1"=hex:df,c7,3a,96,ab,66,13,d2,36,78,6c,b8,10,1c,c4,b0,41,14,92,53,8b,f4,9f,
53,ff,8f,6c,08,d5,ab,f1,06
"2"=hex:7d,73,4a,d4,1d,ee,c7,5a
"3"=hex:81,20,8f,ab,28,6a,52,9c
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:97,e4,84,cd,95,83,bf,82,bd,04,75,27,c9,a8,72,b1,55,38,49,8a,a6,16,a2,
28,28,eb,ee,eb,0f,d6,d6,b8,f4,df,4a,8d,b5,18,4f,2a,0d,c4,ee,cf,81,df,fe,df,\
"8"=hex:c3,6e,bb,a2,c5,9e,59,6f,a2,cd,49,1f,fd,00,ae,43,d3,82,7c,99,67,5f,2e,
44,48,42,af,41,f5,b2,3d,3c,f5,13,cf,5c,4c,10,69,4a,c9,00,16,14,26,79,06,12,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:b6,dd,00,4d,9d,38,11,d1
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
Completion time: 2013-05-21 18:44:00
ComboFix-quarantined-files.txt 2013-05-21 16:44
ComboFix2.txt 2013-05-20 23:30
ComboFix3.txt 2013-05-20 13:43
.
Pre-Run: 6 070 808 576 bytes free
Post-Run: 6 026 874 880 bytes free
.
- - End Of File - - 7DF024B8805D4E55A47EC8C48156FA56

---

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-21 18:44:11
-----------------------------
18:44:11.640 OS Version: Windows x64 6.1.7601 Service Pack 1
18:44:11.640 Number of processors: 8 586 0x2A07
18:44:11.641 ComputerName: COBR4IN-PC UserName: CoBain_SK
18:44:11.827 Initialize success
18:44:23.390 Disk 0 \Device\Harddisk0\DR0 -> \Device\00000068
18:44:23.392 Disk 0 Vendor: ATA_____ 1D05 Size: 953869MB BusType: 11
18:44:23.394 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\00000069
18:44:23.397 Disk 1 Vendor: ATA_____ 2.25 Size: 57241MB BusType: 11
18:44:23.405 Disk 1 MBR read successfully
18:44:23.408 Disk 1 MBR scan
18:44:23.410 Disk 1 Windows 7 default MBR code
18:44:23.413 Disk 1 Partition 1 80 (A) 07 HPFS/NTFS NTFS 57246 MB offset 2048
18:44:23.421 Disk 1 scanning C:\windows\system32\drivers
18:44:24.075 Service scanning
18:44:26.231 Modules scanning
18:44:26.238 Disk 1 trace - called modules:
18:44:26.246 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorF.sys storport.sys hal.dll iaStorA.sys
18:44:26.250 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0xfffffa80077e6790]
18:44:26.256 3 CLASSPNP.SYS[fffff8800107543f] -> nt!IofCallDriver -> [0xfffffa80076e1c50]
18:44:26.258 5 iaStorF.sys[fffff880018139a0] -> nt!IofCallDriver -> \Device\00000069[0xfffffa800714e060]
18:44:26.261 Scan finished successfully
18:44:32.264 Disk 1 MBR has been saved successfully to "C:\Users\CoBain_SK\Desktop\MBR.dat"
18:44:32.267 The log file has been saved successfully to "C:\Users\CoBain_SK\Desktop\aswMBR.txt"

---

System Information (local)
--------------------------------------------------------------------------------

computer name: COBR4IN-PC
windows version: Windows 7 Service Pack 1, 6.1, build: 7601
windows dir: C:\windows
CPU: GenuineIntel Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz Intel586, level: 6
8 logical processors, active mask: 255
RAM: 8555479040 total
VM: 2147352576, free: 1996206080




--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\windows\Minidump

Crash dumps are enabled on your computer.

No valid crash dumps have been found on your computer

--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

Crash dumps are enabled but no valid crash dumps have been found. It may be that there are problems which prevent crash dumps from being written out. Check out the following article for possible causes: If crash dumps are not written out.

In case your computer does experience sudden reboots it is likely these are caused by malfunctioning hardware, power failure or a thermal issue. To troubleshoot a thermal issue, check the temperature using your BIOS setup program, check for dust in CPU and motherboard fans and if your computer is portable make sure it's located on a hard surface. Otherwise it's suggested you contact the support department of the manufacturer of your system or test your system with a memory test utility for further investigation.

Check out the following articles for more information: Troubleshooting sudden resets and shut downs.

Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is actually responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

[jaro3]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.


Vlož nový log z HJT + info o problémech

[cobr4in]

No, tie problémy sú takéto občasného razenia, takže vlastne asi ani nejde povedať či je to lepšie alebo horšie.
Skôr by som sa ale spýtal, čo si vlastne našiel v PC, keď bolo potrebné až také množstvo krokov?
Inak čím ďalej tým viac mám chuť úplne reinstallovať Win, len nechcem aby Tvoja práca vyšla nazmar. Okrem problémov (teda snáď) by sa zrejme anulovalo aj všetko, čo si spravil? A bol by to veci prospešný krok?

---

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:02:23, on 21. 5. 2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
D:\Programy\Fraps\fraps.exe
C:\Windows\SysWOW64\HsMgr.exe
C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
C:\windows\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programy\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Startup: Fences.lnk = D:\Programy\Stardock\Fences\Fences.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\Programy\MICROS~1\Office14\EXCEL.EXE/3000
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\Windows\runservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6837 bytes

[jaro3]

Co se smazalo , je v lozích...

BSOD -- do té doby žádný BSOD nebyl..

Zkus tohle:
OCCT
http://www.slunecnice.cz/sw/occt/
stáhni a spusť ,pokud program nabídne aktualizaci , stáhni novou verzi .
Pokud se ukáže žádost o fin. Pomoc /PayPal) odškrtni jí (2x).
Klikni na CPU:OCCT a pak na "ON"..pokud Ti to nespadne , po pár minutách zastav (OFF) , program Ti naskenuje několik obrázků , ten poslední sem vlož.
klikni na GPU a na "ON" , zase nech pár minut , pokud to nespadne dřív..zase poslední obázek.
Můžeš otestovat i zdroj.
CPU:OCCT
CPU: Linpack
GPU: 3D
Power Supply

S viry to nesouvisí , spíš do jiné sekce , nebo kontaktovat uživatele MiliNess.

[cobr4in]

Co se smazalo , je v lozích...

Prepáč, ale nejak nerozumiem význam tejto... frázy? Lozích?

---

---

Počas tohto testu vypísalo túto chybu a po pár minútach prestal reagovať a následne spadol prehliadač, ktorý som však mal otvorený i pri všetkých ostatných testoch.

---

---

[memphisto]

Že výsledky a smazané soubory byly vidět v logu z programů