Prosím o kontrolu logu - Padání her Vyřešeno

[Paulek155]

ComboFix 13-08-20.01 - Paulek 21.08.2013 12:52:39.5.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.8145.6609 [GMT 2:00]
Spuštěný z: c:\users\Paulek\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-07-21 do 2013-08-21 )))))))))))))))))))))))))))))))
.
.
2013-08-21 10:54 . 2013-08-21 10:54 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-08-21 10:54 . 2013-08-21 10:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-20 17:28 . 2013-08-20 17:28 -------- d-----w- C:\AdwCleaner
2013-08-20 12:16 . 2013-08-20 14:39 -------- d-----w- c:\program files (x86)\Ubisoft
2013-08-20 06:43 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3C2A2979-A431-47E0-92AF-902956781376}\mpengine.dll
2013-08-18 13:11 . 2013-08-18 13:11 -------- d-----w- c:\users\Paulek\AppData\Local\EMU
2013-08-18 12:54 . 2013-08-18 12:54 -------- d-----w- c:\users\Paulek\AppData\Local\PAYDAY 2
2013-08-18 12:53 . 2013-08-18 12:53 -------- d-----w- c:\programdata\Package Cache
2013-08-17 17:12 . 2013-08-20 08:01 -------- d-----w- c:\users\Paulek\AppData\Local\Ubisoft Game Launcher
2013-08-14 19:36 . 2013-08-14 19:36 -------- d-----w- c:\users\Paulek\AppData\Local\Skyrim
2013-08-14 15:33 . 2013-08-14 15:33 -------- d-----w- c:\users\Paulek\AppData\Local\SCE
2013-08-13 18:15 . 2013-08-13 18:19 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-11 15:16 . 2013-08-11 15:16 -------- d-----w- C:\SuperChargerProfile
2013-08-09 21:21 . 2013-08-09 21:21 -------- d-----w- c:\windows\ERUNT
2013-08-06 17:05 . 2013-08-06 17:05 -------- d-----w- c:\program files\ESET
2013-07-31 13:22 . 2013-07-31 13:22 -------- d-----w- c:\program files (x86)\AMD APP
2013-07-31 13:21 . 2013-07-31 13:22 -------- d-----w- c:\windows\usersettings
2013-07-31 13:21 . 2013-07-31 13:21 715253 ----a-w- c:\windows\unins000.exe
2013-07-30 16:22 . 2013-07-30 16:22 234010 -c--a-w- c:\windows\SysWow64\poclbm130302GeForce GTX 660 Tigv1w256l4.bin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-20 14:27 . 2012-11-18 08:40 281688 -c--a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-08-20 14:24 . 2012-11-18 08:34 281688 -c--a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-08-13 18:16 . 2012-11-07 10:56 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-08-13 18:15 . 2013-08-13 18:15 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-10 06:45 . 2013-07-10 06:39 624128 ----a-w- c:\windows\system32\qedit.dll
2013-07-10 06:45 . 2013-07-10 06:39 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-07-10 06:42 . 2013-07-10 06:39 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-07-10 06:41 . 2013-07-10 06:39 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-07-10 06:41 . 2013-07-10 06:39 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-06-21 12:06 . 2013-07-07 08:50 925648 -c--a-w- c:\windows\SysWow64\nvumdshim.dll
2013-06-21 12:06 . 2013-07-07 08:50 9239344 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:06 . 2013-07-07 08:50 7687592 -c--a-w- c:\windows\SysWow64\nvcuda.dll
2013-06-21 12:06 . 2013-07-07 08:50 7641832 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:06 . 2013-07-07 08:50 6324360 -c--a-w- c:\windows\SysWow64\nvopencl.dll
2013-06-21 12:06 . 2013-07-07 08:50 572704 ----a-w- c:\windows\system32\NvFBC64.dll
2013-06-21 12:06 . 2013-07-07 08:50 570656 ----a-w- c:\windows\system32\NvIFR64.dll
2013-06-21 12:06 . 2013-07-07 08:50 467232 -c--a-w- c:\windows\SysWow64\NvIFR.dll
2013-06-21 12:06 . 2013-07-07 08:50 465184 -c--a-w- c:\windows\SysWow64\NvFBC.dll
2013-06-21 12:06 . 2013-07-07 08:50 432928 ----a-w- c:\windows\system32\nvEncodeAPI64.dll
2013-06-21 12:06 . 2013-07-07 08:50 372000 -c--a-w- c:\windows\SysWow64\nvEncodeAPI.dll
2013-06-21 12:06 . 2013-07-07 08:50 2953504 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:06 . 2013-07-07 08:50 27781920 ----a-w- c:\windows\system32\nvoglv64.dll
2013-06-21 12:06 . 2013-07-07 08:50 2777888 -c--a-w- c:\windows\SysWow64\nvcuvid.dll
2013-06-21 12:06 . 2013-07-07 08:50 266448 ----a-w- c:\windows\system32\nvinitx.dll
2013-06-21 12:06 . 2013-07-07 08:50 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:06 . 2013-07-07 08:50 2363680 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:06 . 2013-07-07 08:50 218592 ----a-w- c:\windows\system32\nvoglshim64.dll
2013-06-21 12:06 . 2013-07-07 08:50 214448 -c--a-w- c:\windows\SysWow64\nvinit.dll
2013-06-21 12:06 . 2013-07-07 08:50 21102368 -c--a-w- c:\windows\SysWow64\nvoglv32.dll
2013-06-21 12:06 . 2013-07-07 08:50 2002720 -c--a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-06-21 12:06 . 2013-07-07 08:50 1832224 ----a-w- c:\windows\system32\nvdispco6432049.dll
2013-06-21 12:06 . 2013-07-07 08:50 181488 -c--a-w- c:\windows\SysWow64\nvoglshim32.dll
2013-06-21 12:06 . 2013-07-07 08:50 17560352 -c--a-w- c:\windows\SysWow64\nvcompiler.dll
2013-06-21 12:06 . 2013-07-07 08:50 15144928 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-06-21 12:06 . 2013-07-07 08:50 1511712 ----a-w- c:\windows\system32\nvdispgenco6432049.dll
2013-06-21 12:06 . 2013-07-07 08:50 13411896 -c--a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-06-21 12:06 . 2013-07-07 08:50 11235104 -c--a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-06-21 12:06 . 2013-06-02 07:06 2597856 -c--a-w- c:\windows\SysWow64\nvapi.dll
2013-06-21 12:06 . 2012-12-01 13:18 2936208 -c--a-w- c:\windows\system32\nvapi64.dll
2013-06-21 12:06 . 2012-12-01 13:18 15920536 -c--a-w- c:\windows\system32\nvwgf2umx.dll
2013-06-21 12:06 . 2012-12-01 13:18 12427240 -c--a-w- c:\windows\SysWow64\nvd3dum.dll
2013-06-21 12:06 . 2012-12-01 13:18 1059560 -c--a-w- c:\windows\system32\nvumdshimx.dll
2013-06-21 10:23 . 2013-02-03 13:15 6496544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 10:23 . 2013-02-03 13:15 3514656 -c--a-w- c:\windows\system32\nvsvc64.dll
2013-06-21 10:23 . 2013-02-03 13:15 884512 -c--a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 10:23 . 2013-02-03 13:15 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 10:23 . 2013-02-03 13:15 2555680 -c--a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 10:23 . 2013-02-03 13:15 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 03:16 . 2013-06-21 03:16 566048 -c--a-w- c:\windows\SysWow64\nvStreaming.exe
2013-06-20 04:17 . 2013-02-03 13:15 3253909 ----a-w- c:\windows\system32\nvcoproc.bin
2013-06-12 13:27 . 2013-06-12 13:25 751104 ----a-w- c:\windows\system32\win32spl.dll
2013-06-12 13:27 . 2013-06-12 13:25 492544 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-06-12 13:27 . 2013-06-12 13:25 30720 ----a-w- c:\windows\system32\cryptdlg.dll
2013-06-12 13:27 . 2013-06-12 13:25 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll
2013-06-12 13:27 . 2013-06-12 13:25 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2013-06-12 13:27 . 2013-06-12 13:25 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2013-06-12 13:27 . 2013-06-12 13:25 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-06-12 13:27 . 2013-06-12 13:25 52224 ----a-w- c:\windows\system32\certenc.dll
2013-06-12 13:27 . 2013-06-12 13:25 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-06-12 13:27 . 2013-06-12 13:25 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-06-12 13:27 . 2013-06-12 13:25 1887232 ----a-w- c:\windows\system32\d3d11.dll
2013-06-12 13:27 . 2013-06-12 13:25 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll
2013-06-07 11:45 . 2013-08-19 16:47 84992 --s-a-w- c:\windows\inf\msgpainj\zlib1.dll
2013-06-07 11:45 . 2013-08-19 16:47 612352 --s-a-w- c:\windows\inf\msgpainj\libcurl.dll
2013-06-07 11:45 . 2013-08-19 16:47 568334 --s-a-w- c:\windows\inf\msgpainj\msgpainj.exe
2013-06-07 11:45 . 2013-08-19 16:47 364544 --s-a-w- c:\windows\inf\msgpainj\ssleay32.dll
2013-06-07 11:45 . 2013-08-19 16:47 279955 --s-a-w- c:\windows\inf\msgpainj\libidn-11.dll
2013-06-07 11:45 . 2013-08-19 16:47 183382 --s-a-w- c:\windows\inf\msgpainj\librtmp.dll
2013-06-07 11:45 . 2013-08-19 16:47 171008 --s-a-w- c:\windows\inf\msgpainj\libssh2.dll
2013-06-07 11:45 . 2013-08-19 16:47 1704448 --s-a-w- c:\windows\inf\msgpainj\libeay32.dll
2013-06-07 11:45 . 2013-08-19 16:47 110094 --s-a-w- c:\windows\inf\msgpainj\libusb-1.0.dll
2013-06-07 11:45 . 2013-07-30 17:41 84992 --s-a-w- c:\windows\inf\msxxqpnh\zlib1.dll
2013-06-07 11:45 . 2013-07-30 17:41 612352 --s-a-w- c:\windows\inf\msxxqpnh\libcurl.dll
2013-06-07 11:45 . 2013-07-30 17:41 364544 --s-a-w- c:\windows\inf\msxxqpnh\ssleay32.dll
2013-06-07 11:45 . 2013-07-30 17:41 279955 --s-a-w- c:\windows\inf\msxxqpnh\libidn-11.dll
2013-06-07 11:45 . 2013-07-30 17:41 183382 --s-a-w- c:\windows\inf\msxxqpnh\librtmp.dll
2013-06-07 11:45 . 2013-07-30 17:41 171008 --s-a-w- c:\windows\inf\msxxqpnh\libssh2.dll
2013-06-07 11:45 . 2013-07-30 17:41 1704448 --s-a-w- c:\windows\inf\msxxqpnh\libeay32.dll
2013-06-07 11:45 . 2013-07-30 17:41 110094 --s-a-w- c:\windows\inf\msxxqpnh\libusb-1.0.dll
2013-06-07 11:45 . 2013-07-30 16:21 84992 --s-a-w- c:\windows\inf\mspepxl\zlib1.dll
2013-06-07 11:45 . 2013-07-30 16:21 612352 --s-a-w- c:\windows\inf\mspepxl\libcurl.dll
2013-06-07 11:45 . 2013-07-30 16:21 568334 --s-a-w- c:\windows\inf\mspepxl\mspepxl.exe
2013-06-07 11:45 . 2013-07-30 16:21 364544 --s-a-w- c:\windows\inf\mspepxl\ssleay32.dll
2013-06-07 11:45 . 2013-07-30 16:21 279955 --s-a-w- c:\windows\inf\mspepxl\libidn-11.dll
2013-06-07 11:45 . 2013-07-30 16:21 183382 --s-a-w- c:\windows\inf\mspepxl\librtmp.dll
2013-06-07 11:45 . 2013-07-30 16:21 171008 --s-a-w- c:\windows\inf\mspepxl\libssh2.dll
2013-06-07 11:45 . 2013-07-30 16:21 1704448 --s-a-w- c:\windows\inf\mspepxl\libeay32.dll
2013-06-07 11:45 . 2013-07-30 16:21 110094 --s-a-w- c:\windows\inf\mspepxl\libusb-1.0.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="e:\programy\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE" [2012-11-11 241280]
"Steam"="e:\programy\Steam\steam.exe" [2013-07-26 1807272]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2013-06-22 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608]
"Super-Charger"="c:\program files (x86)\MSI\Super-Charger\Super-Charger.exe" [2012-01-03 502288]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Content Manager Assistant for PlayStation(R).lnk - c:\program files (x86)\Sony\Content Manager Assistant\CMA.exe [2013-6-18 3505048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ALSysIO;ALSysIO;c:\users\Paulek\AppData\Local\Temp\ALSysIO64.sys;c:\users\Paulek\AppData\Local\Temp\ALSysIO64.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys;c:\windows\SYSNATIVE\DRIVERS\MijXfilt.sys [x]
R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]
R3 NTIOLib_1_0_C;NTIOLib_1_0_C;d:\ntiolib_x64.sys;d:\NTIOLib_X64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 NTIOLib_1_0_3;NTIOLib_1_0_3;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [x]
S0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfpr.sys [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 MSI_OTPService;MSI_OTPService;c:\program files (x86)\MSI\OTPService\OTPService.exe;c:\program files (x86)\MSI\OTPService\OTPService.exe [x]
S2 MSI_SuperCharger;MSI_SuperCharger;c:\program files (x86)\MSI\Super-Charger\ChargeService.exe;c:\program files (x86)\MSI\Super-Charger\ChargeService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 NTIOLib_1_0_T;NTIOLib_1_0_T;c:\program files (x86)\MSI\OTPService\NTIOLib_X64.sys;c:\program files (x86)\MSI\OTPService\NTIOLib_X64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-01-15 6963272]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2013-03-21 6330568]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 10.152.101.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{7473B6BD-4691-4744-A82B-7854EB3D70B6} - (no file)
AddRemove-{ECFE533F-8A0E-46D5-FD31-E7A998344F58} - c:\progra~3\INSTAL~1\{63C1E~1\Setup.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2013-08-21 12:55:31
ComboFix-quarantined-files.txt 2013-08-21 10:55
.
Před spuštěním: Volných bajtů: 65 007 587 328
Po spuštění: Volných bajtů: 64 699 977 728
.
- - End Of File - - 48530CAFD79F449E4BA07830E4BADB99
A36C5E4F47E84449FF07ED3517B43A31

[Reklama]

[Paulek155]

# AdwCleaner v3.000 - Report created 21/08/2013 at 12:56:45
# Updated 20/08/2013 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Paulek - PAULEK-PC
# Running from : C:\Users\Paulek\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Mozilla Firefox v

-\\ Google Chrome v

[ File : C:\Users\Paulek\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : icon_url
Deleted : search_url
Deleted : keyword

*************************

AdwCleaner[R1].txt - [828 octets] - [20/08/2013 19:28:30]
AdwCleaner[R2].txt - [887 octets] - [21/08/2013 12:56:20]
AdwCleaner[S0].txt - [815 octets] - [21/08/2013 12:56:45]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [874 octets] ##########

[memphisto]

Toto otestuj na Virustotal
c:\windows\inf\msgpainj\msgpainj.exe
c:\windows\inf\mspepxl\mspepxl.exe

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

[Paulek155]

https://www.virustotal.com/cs/file/26c7 ... 377109260/

https://www.virustotal.com/cs/file/26c7 ... 377109392/

[memphisto]

Znáš tuhle IP? Pokud ne, tak přidej do skriptu pod DDS ještě:
TCP: DhcpNameServer = 10.152.101.1

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::

DirLook::
c:\users\Paulek\AppData\Local\EMU
c:\windows\usersettings

Folder::
c:\windows\inf\msgpainj
c:\windows\inf\msxxqpnh
c:\windows\inf\mspepxl

DDS::
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upus.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[Paulek155]

ComboFix 13-08-20.01 - Paulek 21.08.2013 21:43:27.6.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.8145.6722 [GMT 2:00]
Spuštěný z: c:\users\Paulek\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Paulek\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\inf\msgpainj
c:\windows\inf\msgpainj\bitstreams\fpgaminer_top_fixed7_197MHz.ncd
c:\windows\inf\msgpainj\bitstreams\ztex_ufm1_15b1.bit
c:\windows\inf\msgpainj\bitstreams\ztex_ufm1_15d1.bit
c:\windows\inf\msgpainj\bitstreams\ztex_ufm1_15d3.bit
c:\windows\inf\msgpainj\bitstreams\ztex_ufm1_15d4.bin
c:\windows\inf\msgpainj\bitstreams\ztex_ufm1_15d4.bit
c:\windows\inf\msgpainj\bitstreams\ztex_ufm1_15y1.bin
c:\windows\inf\msgpainj\bitstreams\ztex_ufm1_15y1.bit
c:\windows\inf\msgpainj\diablo130302.cl
c:\windows\inf\msgpainj\diakgcn121016.cl
c:\windows\inf\msgpainj\libcurl.dll
c:\windows\inf\msgpainj\libeay32.dll
c:\windows\inf\msgpainj\libidn-11.dll
c:\windows\inf\msgpainj\librtmp.dll
c:\windows\inf\msgpainj\libssh2.dll
c:\windows\inf\msgpainj\libusb-1.0.dll
c:\windows\inf\msgpainj\msgpainj.exe
c:\windows\inf\msgpainj\phatk121016.cl
c:\windows\inf\msgpainj\poclbm130302.cl
c:\windows\inf\msgpainj\scrypt130511.cl
c:\windows\inf\msgpainj\ssleay32.dll
c:\windows\inf\msgpainj\zlib1.dll
c:\windows\inf\mspepxl
c:\windows\inf\mspepxl\bitstreams\fpgaminer_top_fixed7_197MHz.ncd
c:\windows\inf\mspepxl\bitstreams\ztex_ufm1_15b1.bit
c:\windows\inf\mspepxl\bitstreams\ztex_ufm1_15d1.bit
c:\windows\inf\mspepxl\bitstreams\ztex_ufm1_15d3.bit
c:\windows\inf\mspepxl\bitstreams\ztex_ufm1_15d4.bin
c:\windows\inf\mspepxl\bitstreams\ztex_ufm1_15d4.bit
c:\windows\inf\mspepxl\bitstreams\ztex_ufm1_15y1.bin
c:\windows\inf\mspepxl\bitstreams\ztex_ufm1_15y1.bit
c:\windows\inf\mspepxl\diablo130302.cl
c:\windows\inf\mspepxl\diakgcn121016.cl
c:\windows\inf\mspepxl\libcurl.dll
c:\windows\inf\mspepxl\libeay32.dll
c:\windows\inf\mspepxl\libidn-11.dll
c:\windows\inf\mspepxl\librtmp.dll
c:\windows\inf\mspepxl\libssh2.dll
c:\windows\inf\mspepxl\libusb-1.0.dll
c:\windows\inf\mspepxl\mspepxl.exe
c:\windows\inf\mspepxl\phatk121016.cl
c:\windows\inf\mspepxl\poclbm130302.cl
c:\windows\inf\mspepxl\scrypt130511.cl
c:\windows\inf\mspepxl\ssleay32.dll
c:\windows\inf\mspepxl\zlib1.dll
c:\windows\inf\msxxqpnh
c:\windows\inf\msxxqpnh\bitstreams\fpgaminer_top_fixed7_197MHz.ncd
c:\windows\inf\msxxqpnh\bitstreams\ztex_ufm1_15b1.bit
c:\windows\inf\msxxqpnh\bitstreams\ztex_ufm1_15d1.bit
c:\windows\inf\msxxqpnh\bitstreams\ztex_ufm1_15d3.bit
c:\windows\inf\msxxqpnh\bitstreams\ztex_ufm1_15d4.bin
c:\windows\inf\msxxqpnh\bitstreams\ztex_ufm1_15d4.bit
c:\windows\inf\msxxqpnh\bitstreams\ztex_ufm1_15y1.bin
c:\windows\inf\msxxqpnh\bitstreams\ztex_ufm1_15y1.bit
c:\windows\inf\msxxqpnh\diablo130302.cl
c:\windows\inf\msxxqpnh\diakgcn121016.cl
c:\windows\inf\msxxqpnh\libcurl.dll
c:\windows\inf\msxxqpnh\libeay32.dll
c:\windows\inf\msxxqpnh\libidn-11.dll
c:\windows\inf\msxxqpnh\librtmp.dll
c:\windows\inf\msxxqpnh\libssh2.dll
c:\windows\inf\msxxqpnh\libusb-1.0.dll
c:\windows\inf\msxxqpnh\phatk121016.cl
c:\windows\inf\msxxqpnh\poclbm130302.cl
c:\windows\inf\msxxqpnh\scrypt130511.cl
c:\windows\inf\msxxqpnh\ssleay32.dll
c:\windows\inf\msxxqpnh\zlib1.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-07-21 do 2013-08-21 )))))))))))))))))))))))))))))))
.
.
2013-08-21 19:45 . 2013-08-21 19:45 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-08-21 19:45 . 2013-08-21 19:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-20 17:28 . 2013-08-21 10:56 -------- d-----w- C:\AdwCleaner
2013-08-20 12:16 . 2013-08-20 14:39 -------- d-----w- c:\program files (x86)\Ubisoft
2013-08-20 06:43 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3C2A2979-A431-47E0-92AF-902956781376}\mpengine.dll
2013-08-18 13:11 . 2013-08-18 13:11 -------- d-----w- c:\users\Paulek\AppData\Local\EMU
2013-08-18 12:54 . 2013-08-18 12:54 -------- d-----w- c:\users\Paulek\AppData\Local\PAYDAY 2
2013-08-18 12:53 . 2013-08-18 12:53 -------- d-----w- c:\programdata\Package Cache
2013-08-17 17:12 . 2013-08-20 08:01 -------- d-----w- c:\users\Paulek\AppData\Local\Ubisoft Game Launcher
2013-08-14 19:36 . 2013-08-14 19:36 -------- d-----w- c:\users\Paulek\AppData\Local\Skyrim
2013-08-14 15:33 . 2013-08-14 15:33 -------- d-----w- c:\users\Paulek\AppData\Local\SCE
2013-08-13 18:15 . 2013-08-13 18:19 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-11 15:16 . 2013-08-11 15:16 -------- d-----w- C:\SuperChargerProfile
2013-08-09 21:21 . 2013-08-09 21:21 -------- d-----w- c:\windows\ERUNT
2013-08-06 17:05 . 2013-08-06 17:05 -------- d-----w- c:\program files\ESET
2013-07-31 13:22 . 2013-07-31 13:22 -------- d-----w- c:\program files (x86)\AMD APP
2013-07-31 13:21 . 2013-07-31 13:22 -------- d-----w- c:\windows\usersettings
2013-07-31 13:21 . 2013-07-31 13:21 715253 ----a-w- c:\windows\unins000.exe
2013-07-30 16:22 . 2013-07-30 16:22 234010 -c--a-w- c:\windows\SysWow64\poclbm130302GeForce GTX 660 Tigv1w256l4.bin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-20 14:27 . 2012-11-18 08:40 281688 -c--a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-08-20 14:24 . 2012-11-18 08:34 281688 -c--a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-08-13 18:16 . 2012-11-07 10:56 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-08-13 18:15 . 2013-08-13 18:15 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-10 06:45 . 2013-07-10 06:39 624128 ----a-w- c:\windows\system32\qedit.dll
2013-07-10 06:45 . 2013-07-10 06:39 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-07-10 06:42 . 2013-07-10 06:39 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-07-10 06:41 . 2013-07-10 06:39 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-07-10 06:41 . 2013-07-10 06:39 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-06-21 12:06 . 2013-07-07 08:50 925648 -c--a-w- c:\windows\SysWow64\nvumdshim.dll
2013-06-21 12:06 . 2013-07-07 08:50 9239344 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:06 . 2013-07-07 08:50 7687592 -c--a-w- c:\windows\SysWow64\nvcuda.dll
2013-06-21 12:06 . 2013-07-07 08:50 7641832 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:06 . 2013-07-07 08:50 6324360 -c--a-w- c:\windows\SysWow64\nvopencl.dll
2013-06-21 12:06 . 2013-07-07 08:50 572704 ----a-w- c:\windows\system32\NvFBC64.dll
2013-06-21 12:06 . 2013-07-07 08:50 570656 ----a-w- c:\windows\system32\NvIFR64.dll
2013-06-21 12:06 . 2013-07-07 08:50 467232 -c--a-w- c:\windows\SysWow64\NvIFR.dll
2013-06-21 12:06 . 2013-07-07 08:50 465184 -c--a-w- c:\windows\SysWow64\NvFBC.dll
2013-06-21 12:06 . 2013-07-07 08:50 432928 ----a-w- c:\windows\system32\nvEncodeAPI64.dll
2013-06-21 12:06 . 2013-07-07 08:50 372000 -c--a-w- c:\windows\SysWow64\nvEncodeAPI.dll
2013-06-21 12:06 . 2013-07-07 08:50 2953504 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:06 . 2013-07-07 08:50 27781920 ----a-w- c:\windows\system32\nvoglv64.dll
2013-06-21 12:06 . 2013-07-07 08:50 2777888 -c--a-w- c:\windows\SysWow64\nvcuvid.dll
2013-06-21 12:06 . 2013-07-07 08:50 266448 ----a-w- c:\windows\system32\nvinitx.dll
2013-06-21 12:06 . 2013-07-07 08:50 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:06 . 2013-07-07 08:50 2363680 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:06 . 2013-07-07 08:50 218592 ----a-w- c:\windows\system32\nvoglshim64.dll
2013-06-21 12:06 . 2013-07-07 08:50 214448 -c--a-w- c:\windows\SysWow64\nvinit.dll
2013-06-21 12:06 . 2013-07-07 08:50 21102368 -c--a-w- c:\windows\SysWow64\nvoglv32.dll
2013-06-21 12:06 . 2013-07-07 08:50 2002720 -c--a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-06-21 12:06 . 2013-07-07 08:50 1832224 ----a-w- c:\windows\system32\nvdispco6432049.dll
2013-06-21 12:06 . 2013-07-07 08:50 181488 -c--a-w- c:\windows\SysWow64\nvoglshim32.dll
2013-06-21 12:06 . 2013-07-07 08:50 17560352 -c--a-w- c:\windows\SysWow64\nvcompiler.dll
2013-06-21 12:06 . 2013-07-07 08:50 15144928 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-06-21 12:06 . 2013-07-07 08:50 1511712 ----a-w- c:\windows\system32\nvdispgenco6432049.dll
2013-06-21 12:06 . 2013-07-07 08:50 13411896 -c--a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-06-21 12:06 . 2013-07-07 08:50 11235104 -c--a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-06-21 12:06 . 2013-06-02 07:06 2597856 -c--a-w- c:\windows\SysWow64\nvapi.dll
2013-06-21 12:06 . 2012-12-01 13:18 2936208 -c--a-w- c:\windows\system32\nvapi64.dll
2013-06-21 12:06 . 2012-12-01 13:18 15920536 -c--a-w- c:\windows\system32\nvwgf2umx.dll
2013-06-21 12:06 . 2012-12-01 13:18 12427240 -c--a-w- c:\windows\SysWow64\nvd3dum.dll
2013-06-21 12:06 . 2012-12-01 13:18 1059560 -c--a-w- c:\windows\system32\nvumdshimx.dll
2013-06-21 10:23 . 2013-02-03 13:15 6496544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 10:23 . 2013-02-03 13:15 3514656 -c--a-w- c:\windows\system32\nvsvc64.dll
2013-06-21 10:23 . 2013-02-03 13:15 884512 -c--a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 10:23 . 2013-02-03 13:15 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 10:23 . 2013-02-03 13:15 2555680 -c--a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 10:23 . 2013-02-03 13:15 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 03:16 . 2013-06-21 03:16 566048 -c--a-w- c:\windows\SysWow64\nvStreaming.exe
2013-06-20 04:17 . 2013-02-03 13:15 3253909 ----a-w- c:\windows\system32\nvcoproc.bin
2013-06-12 13:27 . 2013-06-12 13:25 751104 ----a-w- c:\windows\system32\win32spl.dll
2013-06-12 13:27 . 2013-06-12 13:25 492544 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-06-12 13:27 . 2013-06-12 13:25 30720 ----a-w- c:\windows\system32\cryptdlg.dll
2013-06-12 13:27 . 2013-06-12 13:25 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll
2013-06-12 13:27 . 2013-06-12 13:25 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2013-06-12 13:27 . 2013-06-12 13:25 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2013-06-12 13:27 . 2013-06-12 13:25 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-06-12 13:27 . 2013-06-12 13:25 52224 ----a-w- c:\windows\system32\certenc.dll
2013-06-12 13:27 . 2013-06-12 13:25 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-06-12 13:27 . 2013-06-12 13:25 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-06-12 13:27 . 2013-06-12 13:25 1887232 ----a-w- c:\windows\system32\d3d11.dll
2013-06-12 13:27 . 2013-06-12 13:25 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\Paulek\AppData\Local\EMU ----
.
2013-08-18 13:34 . 2013-08-18 13:34 1677 ----a-w- c:\users\Paulek\AppData\Local\EMU\Steam\218620\remote\save000.sav
2013-08-18 13:12 . 2013-08-21 19:36 13091 ----a-w- c:\users\Paulek\AppData\Local\EMU\Steam\218620\remote\save098.sav
.
---- Directory of c:\windows\usersettings ----
.
2013-07-31 13:22 . 2012-02-15 00:28 11982 ----a-w- c:\windows\usersettings\plugins\phatk2\kernel.cl
2013-07-31 13:22 . 2013-01-27 16:22 6763 ----a-w- c:\windows\usersettings\plugins\phatk2\__init__.pyo
2013-07-31 13:22 . 2012-02-26 05:01 9587 ----a-w- c:\windows\usersettings\plugins\phatk2\__init__.py
2013-07-31 13:22 . 2012-02-21 20:47 30967 ----a-w- c:\windows\usersettings\plugins\opencl\kernel.cl
2013-07-31 13:22 . 2013-01-27 16:22 13876 ----a-w- c:\windows\usersettings\plugins\opencl\__init__.pyo
2013-07-31 13:22 . 2012-04-07 00:26 20185 ----a-w- c:\windows\usersettings\plugins\opencl\__init__.py
2013-07-31 13:22 . 2012-04-07 00:30 6639870 ----a-w- c:\windows\usersettings\svchost.exe
2013-07-31 13:22 . 2013-06-03 15:23 555 ----a-w- c:\windows\usersettings\phoenix.cfg
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="e:\programy\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE" [2012-11-11 241280]
"Steam"="e:\programy\Steam\steam.exe" [2013-07-26 1807272]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2013-06-22 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608]
"Super-Charger"="c:\program files (x86)\MSI\Super-Charger\Super-Charger.exe" [2012-01-03 502288]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Content Manager Assistant for PlayStation(R).lnk - c:\program files (x86)\Sony\Content Manager Assistant\CMA.exe [2013-6-18 3505048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 ALSysIO;ALSysIO;c:\users\Paulek\AppData\Local\Temp\ALSysIO64.sys;c:\users\Paulek\AppData\Local\Temp\ALSysIO64.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys;c:\windows\SYSNATIVE\DRIVERS\MijXfilt.sys [x]
R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]
R3 NTIOLib_1_0_C;NTIOLib_1_0_C;d:\ntiolib_x64.sys;d:\NTIOLib_X64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 NTIOLib_1_0_3;NTIOLib_1_0_3;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [x]
S0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfpr.sys [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 MSI_OTPService;MSI_OTPService;c:\program files (x86)\MSI\OTPService\OTPService.exe;c:\program files (x86)\MSI\OTPService\OTPService.exe [x]
S2 MSI_SuperCharger;MSI_SuperCharger;c:\program files (x86)\MSI\Super-Charger\ChargeService.exe;c:\program files (x86)\MSI\Super-Charger\ChargeService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 NTIOLib_1_0_T;NTIOLib_1_0_T;c:\program files (x86)\MSI\OTPService\NTIOLib_X64.sys;c:\program files (x86)\MSI\OTPService\NTIOLib_X64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-01-15 6963272]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2013-03-21 6330568]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.152.101.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{7473B6BD-4691-4744-A82B-7854EB3D70B6} - (no file)
AddRemove-{ECFE533F-8A0E-46D5-FD31-E7A998344F58} - c:\progra~3\INSTAL~1\{63C1E~1\Setup.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Sony\Content Manager Assistant\CMAWatcher.exe
.
**************************************************************************
.
Celkový čas: 2013-08-21 21:47:13 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-08-21 19:47
.
Před spuštěním: Volných bajtů: 64 768 409 600
Po spuštění: Volných bajtů: 64 678 404 096
.
- - End Of File - - 3EEB0A29C2357100866DE6DF563850AC
A36C5E4F47E84449FF07ED3517B43A31

[memphisto]

Otestuj na virustotalu: www.virustotal.com

c:\windows\usersettings\svchost.exe

[Paulek155]

https://www.virustotal.com/cs/file/50a4 ... 377154876/

[Žbeky]

Tento skript udělej v nouzovém režimu

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::

Folder::
c:\windows\usersettings

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[Paulek155]

Mám menší problém než Combofix začne pracovat, tak mě upozorní že mám zapnutý antivirus, konkrétně NOD 32, ale v nouzovém režimu ho na liště nevidím a když si ho na disku C najdu a poklikám na něj tak se mě to zeptá zda chci ho chci spustit, ale nespustí se. A po odkliknutí prvního varování které Combofix vyhodí se objeví druhé že antivir stále běží. Nechci si něco poškodit.

[Orcus]

Pokud to dělá takovéhle problémy, bude jistější ten NOD dočasně odinstalovat a po použítí CF zase nainstalovat.

[Paulek155]

Taky mě to napadlo, ale nevěděl jsem zda je i jiný způsob.