Mallware v počítači..urgentní Vyřešeno

[MemeEme]

Zdravím, na Facebooku mě někdo nevědomky označil v příspěvku... A nedošlo mi že ten odkaz na který sem klikl byl mallware. Nainstalovalo se mi nějaké rozšíření, které nejde odinstalovat a teď muj profil Sdílí hromadně zas ten samý odkaz a Laikuje všechny možné stránky. Nevíte jak se toho zbavit?
Zde přikládám log+screen z MBAM:

Malwarebytes Anti-Malware 1.75.0.1300
http://www.malwarebytes.org

Verze: v2013.08.26.05

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Uživatel :: ONDRA [administrátor]

26.8.2013 20:02:29
MBAM-log-2013-08-26 (20-06-53).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 225506
Uplynulý čas: 3 minut, 28 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 1
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Nebyla provedena žádná instrukce.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 3
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge (PUP.Spyware.MarketScore) -> Nebyla provedena žádná instrukce.
C:\Users\Uživatel\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
C:\Users\Uživatel\AppData\Roaming\OpenCandy\9E21DBB702964573B7204BF9F6474069 (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.

Nalezené soubory: 6
C:\Users\Uživatel\AppData\Roaming\PowerISO\Upgrade\PowerISO5.exe (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk (PUP.Spyware.MarketScore) -> Nebyla provedena žádná instrukce.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Member of GRID - Goodware Repository Information Database.lnk (PUP.Spyware.MarketScore) -> Nebyla provedena žádná instrukce.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk (PUP.Spyware.MarketScore) -> Nebyla provedena žádná instrukce.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Support.lnk (PUP.Spyware.MarketScore) -> Nebyla provedena žádná instrukce.
C:\Users\Uživatel\AppData\Roaming\OpenCandy\9E21DBB702964573B7204BF9F6474069\PCSU_SL_3.1.2.exe (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.

(konec)

[Reklama]

[memphisto]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.

Stáhni AdwCleaner
Ulož si ho na svojí plochu
Ukonči všechny programy, okna a prohlížeče
Spusť program poklepáním a klikni na „Search“
Po skenu se objeví log (jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

[MemeEme]

Zde Log z AdwCleaner :

# AdwCleaner v3.001 - Report created 26/08/2013 at 21:11:12
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium (64 bits)
# Username : Uživatel - ONDRA
# Running from : C:\Users\Uživatel\Desktop\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\user.js
Folder Found C:\Program Files (x86)\Conduit
Folder Found C:\ProgramData\apn
Folder Found C:\ProgramData\DeviceVM
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
Folder Found C:\ProgramData\ParetoLogic
Folder Found C:\Users\Uživatel\AppData\LocalLow\Conduit
Folder Found C:\Users\Uživatel\AppData\Roaming\DeviceVM
Folder Found C:\Users\Uživatel\AppData\Roaming\DriverCure
Folder Found C:\Users\Uživatel\AppData\Roaming\OpenCandy
Folder Found C:\Users\Uživatel\AppData\Roaming\optimizer pro
Folder Found C:\Users\Uživatel\AppData\Roaming\ParetoLogic

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\1ClickDownload
Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\BI
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Optimizer Pro
Key Found : HKCU\Software\Softonic
Key Found : [x64] HKCU\Software\1ClickDownload
Key Found : [x64] HKCU\Software\APN PIP
Key Found : [x64] HKCU\Software\BI
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\Optimizer Pro
Key Found : [x64] HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\InstallIQ
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_hamachi_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_hamachi_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Key Found : HKLM\Software\PIP
Key Found : HKLM\Software\systweak
Key Found : [x64] HKLM\SOFTWARE\Uniblue\DriverScanner
Key Found : [x64] HKLM\SOFTWARE\Uniblue\SpeedUpMyPC

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16455


-\\ Mozilla Firefox v13.0.1 (cs)

[ File : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\prefs.js ]

Line Found : user_pref("browser.search.defaultthis.engineName", "BitTorrentBar Customized Web Search");
Line Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}");
Line Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=2&q=");

-\\ Google Chrome v

[ File : C:\Users\Uživatel\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3294 octets] - [26/08/2013 21:11:12]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3354 octets] ##########

[memphisto]

Tak v Mbam i adw nech vše smazat a dodej logy po smazání

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

Stáhni si Junkware Removal Tool

na svojí plochu.
Deaktivuj si svůj antivirový program.
Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

[MemeEme]

Takže tady jsou všechny ty logy...

/////////////AdwCleaner LOG:
# AdwCleaner v3.001 - Report created 26/08/2013 at 21:27:13
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium (64 bits)
# Username : Uživatel - ONDRA
# Running from : C:\Users\Uživatel\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\DeviceVM
Folder Deleted : C:\ProgramData\ParetoLogic
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Users\Uživatel\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Uživatel\AppData\Roaming\DeviceVM
Folder Deleted : C:\Users\Uživatel\AppData\Roaming\DriverCure
Folder Deleted : C:\Users\Uživatel\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Uživatel\AppData\Roaming\optimizer pro
Folder Deleted : C:\Users\Uživatel\AppData\Roaming\ParetoLogic
File Deleted : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\user.js

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_hamachi_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_hamachi_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\BI
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\InstallIQ
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\Software\systweak
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Key Deleted : [x64] HKLM\SOFTWARE\Uniblue\DriverScanner
Key Deleted : [x64] HKLM\SOFTWARE\Uniblue\SpeedUpMyPC

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16455


-\\ Mozilla Firefox v13.0.1 (cs)

[ File : C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\prefs.js ]

Line Deleted : user_pref("browser.search.defaultthis.engineName", "BitTorrentBar Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=2&q=");

-\\ Google Chrome v

[ File : C:\Users\Uživatel\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3466 octets] - [26/08/2013 21:11:12]
AdwCleaner[S0].txt - [3224 octets] - [26/08/2013 21:27:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3284 octets] ##########



///////////////MBAM LOG:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verze: v2013.08.26.05

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Uživatel :: ONDRA [administrátor]

26.8.2013 22:33:09
mbam-log-2013-08-26 (22-33-09).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 225318
Uplynulý čas: 3 minut, 32 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\Users\Uživatel\AppData\Roaming\PowerISO\Upgrade\PowerISO5.exe (PUP.Optional.OpenCandy) -> Přesun do karantény a smazání se zdařilo.

(konec)

///////////////////Rogue Killer LOG:
RogueKiller V8.6.6 _x64_ [Aug 19 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows 7 (6.1.7600 ) 64 bits version
Spuštěno v : Normální režim
Uživatel : Uživatel [Práva správce]
Mód : Kontrola -- Datum : 08/26/2013 22:49:37
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 4 ¤¤¤
[SUSP UNIC][DLL] explorer.exe -- C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\29918libfoxloader-x64.dll [x] -> ODEBRÁNO
[SUSP UNIC] szndesktop.exe -- C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\szndesktop.exe [7] -> SMAZÁNO [TermProc]
[SUSP UNIC] listicka-x64.exe -- C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe [7] -> SMAZÁNO [TermThr]
[SUSP UNIC] Sound_Blaster_X-Fi_MB_Cleanup.0001 -- C:\Users\Uživatel\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001 [-] -> SMAZÁNO [TermProc]

¤¤¤ ¤¤¤ Záznamy Registrů: : 13 ¤¤¤
[RUN][SUSP UNIC] HKCU\[...]\Run : Google Update ("C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> NALEZENO
[RUN][SUSP UNIC] HKCU\[...]\Run : cz.seznam.software.autoupdate ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\szninstall.exe" -c [7]) -> NALEZENO
[RUN][SUSP UNIC] HKCU\[...]\Run : cz.seznam.software.szndesktop ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q [7]) -> NALEZENO
[RUN][SUSP UNIC] HKUS\S-1-5-21-1800223682-3901935553-3731950667-1000\[...]\Run : Google Update ("C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> NALEZENO
[RUN][SUSP UNIC] HKUS\S-1-5-21-1800223682-3901935553-3731950667-1000\[...]\Run : cz.seznam.software.autoupdate ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\szninstall.exe" -c [7]) -> NALEZENO
[RUN][SUSP UNIC] HKUS\S-1-5-21-1800223682-3901935553-3731950667-1000\[...]\Run : cz.seznam.software.szndesktop ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q [7]) -> NALEZENO
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\RunOnce : Malwarebytes Anti-Malware (cleanup) (rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [x][7][x]) -> NALEZENO
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> NALEZENO
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> NALEZENO
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> NALEZENO
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO

¤¤¤ naplánované úlohy : 4 ¤¤¤
[V1][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000UA.job : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> NALEZENO
[V1][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000Core.job : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> NALEZENO
[V2][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000Core : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> NALEZENO
[V2][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000UA : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> NALEZENO

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NENAHRÁNO 0x0] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: WDC WD7500AALX-009BA0 ATA Device +++++
--- User ---
[MBR] 493aa2f2474254077dcb692220bf928f
[BSP] 3da91719ab84f4db24c2ffc1198470f3 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 299900 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 614402048 | Size: 415402 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_S_08262013_224937.txt >>
RKreport[0]_S_08262013_224756.txt


////////////////////JRT LOG:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.4 (08.22.2013:1)
OS: Windows 7 Home Premium x64
Ran by U§ivatel on po 26.08.2013 at 22:53:38.94
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\uniblue
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{605701DE-4D2D-499A-A73C-B5B8ED59D6FE}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\splashtop"
Successfully deleted: [Folder] "C:\Users\U§ivatel\AppData\Roaming\splashtop"
Successfully deleted: [Folder] "C:\Program Files (x86)\dll-files.com fixer"



~~~ FireFox

Emptied folder: C:\Users\U§ivatel\AppData\Roaming\mozilla\firefox\profiles\u9bso1a1.default\minidumps [9 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 26.08.2013 at 22:57:58.56
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[memphisto]

Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "
- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje "Smazání- Finished "
- Klikni na "Zprávy " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je oznaèen pro odstranění, stačí restartovat počítač.

[MemeEme]

/////////////// LOG z RogueKiller
RogueKiller V8.6.6 _x64_ [Aug 19 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows 7 (6.1.7600 ) 64 bits version
Spuštěno v : Normální režim
Uživatel : Uživatel [Práva správce]
Mód : Odebrat -- Datum : 08/27/2013 09:10:49
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 4 ¤¤¤
[SUSP UNIC][DLL] explorer.exe -- C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\29918libfoxloader-x64.dll [x] -> ODEBRÁNO
[SUSP UNIC] szndesktop.exe -- C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\szndesktop.exe [7] -> SMAZÁNO [TermProc]
[SUSP UNIC] listicka-x64.exe -- C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe [7] -> SMAZÁNO [TermThr]
[SUSP UNIC] Sound_Blaster_X-Fi_MB_Cleanup.0001 -- C:\Users\Uživatel\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001 [-] -> SMAZÁNO [TermProc]

¤¤¤ ¤¤¤ Záznamy Registrů: : 14 ¤¤¤
[RUN][SUSP UNIC] HKCU\[...]\Run : Google Update ("C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> VYMAZÁNO
[RUN][SUSP UNIC] HKCU\[...]\Run : cz.seznam.software.autoupdate ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\szninstall.exe" -c [7]) -> VYMAZÁNO
[RUN][SUSP UNIC] HKCU\[...]\Run : cz.seznam.software.szndesktop ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q [7]) -> VYMAZÁNO
[RUN][SUSP UNIC] HKUS\S-1-5-21-1800223682-3901935553-3731950667-1000\[...]\Run : Google Update ("C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> [0x2] Systém nemůže nalézt uvedený soubor.
[RUN][SUSP UNIC] HKUS\S-1-5-21-1800223682-3901935553-3731950667-1000\[...]\Run : cz.seznam.software.autoupdate ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\szninstall.exe" -c [7]) -> [0x2] Systém nemůže nalézt uvedený soubor.
[RUN][SUSP UNIC] HKUS\S-1-5-21-1800223682-3901935553-3731950667-1000\[...]\Run : cz.seznam.software.szndesktop ("C:\Users\Uživatel\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q [7]) -> [0x2] Systém nemůže nalézt uvedený soubor.
[HJ POL] HKCU\[...]\System : DisableTaskMgr (0) -> VYMAZÁNO
[HJ POL] HKCU\[...]\System : DisableRegistryTools (0) -> VYMAZÁNO
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> NAHRAZENO (2)
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> NAHRAZENO (1)
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> NAHRAZENO (2)
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> NAHRAZENO (1)
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NAHRAZENO (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NAHRAZENO (0)

¤¤¤ naplánované úlohy : 4 ¤¤¤
[V1][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000UA.job : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> VYMAZÁNO
[V1][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000Core.job : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> VYMAZÁNO
[V2][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000Core : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> VYMAZÁNO
[V2][SUSP UNIC] GoogleUpdateTaskUserS-1-5-21-1800223682-3901935553-3731950667-1000UA : C:\Users\Uživatel\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> ERROR DELETING TASK

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NENAHRÁNO 0x0] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: WDC WD7500AALX-009BA0 ATA Device +++++
--- User ---
[MBR] 493aa2f2474254077dcb692220bf928f
[BSP] 3da91719ab84f4db24c2ffc1198470f3 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 299900 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 614402048 | Size: 415402 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_D_08272013_091049.txt >>
RKreport[0]_S_08272013_091040.txt



////////////////LOG z ComboFix
ComboFix 13-08-25.01 - Uživatel 27.08.2013 9:16.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.5119.3580 [GMT 2:00]
Spuštěný z: c:\users\U×ivatel\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\0.bak
c:\programdata\ntuser.dat
c:\windows\inf\ntvdm.vbe
c:\windows\PFRO.log
c:\windows\SysWow64\frapsvid.dll
c:\windows\SysWow64\tmpB538.tmp
c:\windows\SysWow64\tmpB539.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-07-27 do 2013-08-27 )))))))))))))))))))))))))))))))
.
.
2013-08-27 07:20 . 2013-08-27 07:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-26 20:59 . 2013-08-06 08:58 9515512 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F80C7745-756E-45C2-9596-31FC83156167}\mpengine.dll
2013-08-26 20:53 . 2013-08-26 20:53 -------- d-----w- c:\windows\ERUNT
2013-08-26 20:21 . 2013-08-26 20:21 -------- d-----w- c:\users\Uživatel\AppData\Local\Black_Tree_Gaming
2013-08-26 19:11 . 2013-08-26 19:27 -------- d-----w- C:\AdwCleaner
2013-08-25 10:24 . 2013-08-06 08:58 9515512 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-08-22 12:50 . 2013-08-22 12:49 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55B4FA10-2F02-4DF5-97F7-DFDDEDDDEF74}\gapaengine.dll
2013-08-21 15:36 . 2013-08-21 15:36 -------- d-----w- c:\programdata\Caphyon
2013-08-21 15:36 . 2013-08-21 16:29 -------- d-----w- c:\program files (x86)\QuadCoreM2
2013-08-18 16:43 . 2013-08-18 16:43 -------- d-----w- c:\users\Uživatel\AppData\Local\EMU
2013-08-18 16:43 . 2013-08-18 16:43 -------- d-----w- c:\users\Uživatel\AppData\Local\PAYDAY 2
2013-08-18 12:58 . 2013-08-18 12:58 571168 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-08-16 20:10 . 2013-08-26 17:56 -------- d-----w- c:\users\Uživatel\AppData\Local\Deployment
2013-08-16 19:54 . 2013-08-16 19:54 234010 ----a-w- c:\windows\SysWow64\poclbm130302GeForce GTX 650gv1w256l4.bin
2013-08-15 16:31 . 2013-08-15 16:31 -------- d-----w- c:\programdata\SystemRequirementsLab
2013-08-04 08:32 . 2013-08-04 08:32 -------- d-----w- c:\program files\TeamSpeak 3 Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-20 21:25 . 2012-07-12 17:47 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-20 21:25 . 2012-07-12 17:47 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-18 21:02 . 2013-07-04 19:37 6329552 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-08-18 21:02 . 2013-04-24 19:47 2630304 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-08-18 21:02 . 2013-04-24 19:47 12946848 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-08-18 21:02 . 2013-01-08 17:57 1412832 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-08-18 21:02 . 2013-01-08 17:57 2986672 ----a-w- c:\windows\system32\nvapi64.dll
2013-08-18 21:02 . 2012-11-29 13:21 15900936 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-08-18 21:02 . 2012-07-04 01:30 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-08-18 21:02 . 2012-07-04 01:30 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-08-18 19:34 . 2012-11-29 13:23 6599968 ----a-w- c:\windows\system32\nvcpl.dll
2013-08-18 19:34 . 2012-11-29 13:23 3452192 ----a-w- c:\windows\system32\nvsvc64.dll
2013-08-18 19:34 . 2012-11-29 13:23 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-08-18 19:34 . 2012-11-29 13:23 920864 ----a-w- c:\windows\system32\nvvsvc.exe
2013-08-18 19:34 . 2012-11-29 13:23 219424 ----a-w- c:\windows\system32\nvmctray.dll
2013-08-17 05:30 . 2012-11-29 13:23 3319709 ----a-w- c:\windows\system32\nvcoproc.bin
2013-08-14 19:29 . 2013-01-25 13:53 214520 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-08-14 19:29 . 2012-07-16 11:59 214520 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-07-24 07:32 . 2013-01-25 13:53 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-07-24 07:31 . 2012-07-16 11:59 280600 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-07-21 19:38 . 2013-07-21 19:38 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-07-17 12:45 . 2012-10-03 06:21 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-06-21 12:06 . 2013-07-04 19:37 1832224 ----a-w- c:\windows\system32\nvdispco6432049.dll
2013-06-21 12:06 . 2013-07-04 19:37 1511712 ----a-w- c:\windows\system32\nvdispgenco6432049.dll
2013-06-07 11:45 . 2013-08-16 19:54 84992 --s-a-w- c:\windows\inf\mseals\zlib1.dll
2013-06-07 11:45 . 2013-08-16 19:54 568334 --s-a-w- c:\windows\inf\mseals\mseals.exe
2013-06-07 11:45 . 2013-08-16 19:54 364544 --s-a-w- c:\windows\inf\mseals\ssleay32.dll
2013-06-07 11:45 . 2013-08-16 19:54 279955 --s-a-w- c:\windows\inf\mseals\libidn-11.dll
2013-06-07 11:45 . 2013-08-16 19:54 183382 --s-a-w- c:\windows\inf\mseals\librtmp.dll
2013-06-07 11:45 . 2013-08-16 19:54 171008 --s-a-w- c:\windows\inf\mseals\libssh2.dll
2013-06-07 11:45 . 2013-08-16 19:54 110094 --s-a-w- c:\windows\inf\mseals\libusb-1.0.dll
2013-06-07 11:45 . 2013-08-16 19:54 612352 --s-a-w- c:\windows\inf\mseals\libcurl.dll
2013-06-07 11:45 . 2013-08-16 19:54 1704448 --s-a-w- c:\windows\inf\mseals\libeay32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bloody2"="c:\program files (x86)\Bloody2\Bloody2\Bloody2.exe" [2012-08-10 4255232]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-21 2583040]
"CTSyncService"="c:\program files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe" [2009-07-08 1233195]
"VolPanel"="c:\program files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" [2009-05-04 241789]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-06-28 2255184]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GamePark klient 2.lnk - c:\hry\GamePark2\gpcl.exe [2013-8-14 442880]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SmartViewService;SmartView service; [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 EagleX64;EagleX64; [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files (x86)\IObit\Advanced SystemCare 6\ASCService.exe;c:\program files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [x]
S2 Dokan;Dokan;c:\windows\system32\drivers\dokan.sys;c:\windows\SYSNATIVE\drivers\dokan.sys [x]
S2 DokanMounter;DokanMounter;c:\program files (x86)\Dokan\DokanLibrary\mounter.exe;c:\program files (x86)\Dokan\DokanLibrary\mounter.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2013-08-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:25]
.
2013-08-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-01 15:56]
.
2013-08-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-01 15:56]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"EPSON Stylus DX5000 Series"="c:\windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE" [2006-02-14 131072]
"EPSON Stylus DX5000 Series (kopie 1)"="c:\windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE" [2006-02-14 131072]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/?clid=13415
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
FF - ProfilePath - c:\users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - ExtSQL: 2013-07-21 21:40; {ea614400-e918-4741-9a97-7a972ff7c30b}; c:\users\UĂ…Âľivatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-ASRockOCTuner - (no file)
Wow6432Node-HKCU-Run-ASRockIES - (no file)
Wow6432Node-HKCU-Run-zASRockInstantBoot - (no file)
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
AddRemove-Dll-Files Fixer_is1 - c:\program files (x86)\Dll-Files.com Fixer\unins001.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:bf,84,02,4f,61,c1,cd,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,d8,46,86,48,db,0c,48,85,c6,22,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,d8,46,86,48,db,0c,48,85,c6,22,\
.
[HKEY_USERS\S-1-5-21-1800223682-3901935553-3731950667-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bb,fe,24,0d,08,18,cb,33,f1,58,cb,2d,f9,5f,1e,30,93,65,50,a9,f7,89,fb,
32,4f,e4,20,57,9c,19,40,bf,99,c5,de,c0,07,9a,c3,5d,64,24,6b,82,b1,9f,5f,e7,\
"??"=hex:92,af,6a,b3,5b,09,7d,52,34,9f,97,b3,47,05,ca,2c
.
[HKEY_USERS\S-1-5-21-1800223682-3901935553-3731950667-1000\Software\SecuROM\License information*]
"datasecu"=hex:04,8f,f5,c4,d4,85,c8,92,16,1a,ca,66,22,74,b9,ca,f5,0e,63,47,a2,
36,5a,d0,81,18,13,99,57,3a,dc,85,d4,c7,64,18,a1,3a,e5,40,2f,8a,ca,ae,23,f9,\
"rkeysecu"=hex:6f,83,83,40,7e,52,5d,16,13,91,e7,e3,a6,27,78,75
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\IObit\Advanced SystemCare 6\Monitor.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\users\UIVATE~1\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
.
**************************************************************************
.
Celkový čas: 2013-08-27 09:24:24 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-08-27 07:24
.
Před spuštěním: 13696921600
Po spuštění: 13378678784
.
- - End Of File - - E8450FD3489B8ABD10AC6D6CED71B764
A36C5E4F47E84449FF07ED3517B43A31

[memphisto]

Toto otestuj na Virustotal
c:\windows\inf\mseals\mseals.exe

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

[MemeEme]

A tady je ten problém, když kliknu na odkaz Virustotal tak mi akorát naskočí - Webová stránka byla zablokována rozšířením. Takže jsem si to stáhl odjinud ale nevím jestli je to přesně to sáme. Otestoval jsem mseals.exe a vyskočilo mi :

SHA256: 26c7282daa667210785080f0dbe8e6f85c8a3949e433b198ee91d9ebffd1b5b5
SHA1: 046f5aa70b57b21115e0f6172e10083210668144
MD5: e57480c40edcd3f824a4d0ff4c24f78a
File size: 555.0 KB ( 568334 bytes )
File name: msumtemj.exe
File type: Win32 EXE
Tags: peexe
Detection ratio: 22 / 46
Analysis date: 2013-08-26 12:20:07 UTC ( 20 hodin, 31 minut ago )
2 9
More details

Agnitum RiskTool.BitCoinMiner!LarROoGy7Jw 20130825
AhnLab-V3 Trojan/Win32.BitMiner 20130826
AntiVir SPR/BitCoin.few.11 20130826
Antiy-AVL RiskTool/Win32.BitCoinMiner 20130826
Avast Win32:PUP-gen [PUP] 20130826
AVG 20130825
BitDefender 20130826
ByteHero 20130819
CAT-QuickHeal 20130826
ClamAV Win.Trojan.Bitcoinminer-29 20130826
Commtouch W32/Trojan.IJXX-3394 20130826
Comodo UnclassifiedMalware 20130826
DrWeb Trojan.BtcMine.115 20130826
Emsisoft 20130826
ESET-NOD32 a variant of Win32/BitCoinMiner.AF 20130826
F-Prot 20130826
F-Secure 20130826
Fortinet W32/BitCoinMiner.N 20130826
GData 20130826
Ikarus Trojan.SuspectCRC 20130826
Jiangmin 20130826
K7AntiVirus 20130823
K7GW 20130823
Kaspersky not-a-virus:RiskTool.Win32.BitCoinMiner.dhq 20130826
Kingsoft 20130723
Malwarebytes BitcoinMiner 20130826
McAfee RDN/Generic PUP.x!bc3 20130826
McAfee-GW-Edition Heuristic.LooksLike.Win32.Suspicious.J!89 20130825
Microsoft 20130826
MicroWorld-eScan 20130826
NANO-Antivirus 20130826
Norman 20130826
nProtect 20130826
Panda Trj/CI.A 20130825
PCTools 20130826
Rising 20130826
Sophos Bitcoin Miner 20130826
SUPERAntiSpyware 20130826
Symantec 20130826
TheHacker 20130825
TotalDefense 20130823
TrendMicro TROJ_SPNR.29FR13 20130826
TrendMicro-HouseCall TROJ_SPNR.29FR13 20130824
VBA32 Win32.BitCoinMiner 20130826
VIPRE Trojan.Win32.Generic!BT 20130826
ViRobot



Ale nechápu co mám dělat v tom Exploreru.

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::

KillAll::
Collect::
c:\windows\inf\mseals\mseals.exe

File::
c:\program files (x86)\Seznam.cz\distribution\szninstall.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Folder::
c:\program files (x86)\Skype\Updater
c:\program files (x86)\Google\Update

Driver::
SkypeUpdate

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"=-

RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
 76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
 72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
 b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
 df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
 2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:bf,84,02,4f,61,c1,cd,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,d8,46,86,48,db,0c,48,85,c6,22,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,d8,46,86,48,db,0c,48,85,c6,22,\


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[MemeEme]

/////////////// Nový log z Combofix:
ComboFix 13-08-25.01 - Uživatel 27.08.2013 11:55:14.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.5119.3678 [GMT 2:00]
Spuštěný z: c:\users\Uživatel\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Uživatel\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\Seznam.cz\distribution\szninstall.exe"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Google\Update
c:\program files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleUpdate.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleUpdateBroker.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleUpdateHelper.msi
c:\program files (x86)\Google\Update\1.3.21.153\GoogleUpdateOnDemand.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleUpdateSetup.exe
c:\program files (x86)\Google\Update\1.3.21.153\goopdate.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_am.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ar.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_bg.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_bn.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ca.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_cs.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_da.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_de.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_el.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_en-GB.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_en.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_es-419.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_es.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_et.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_fa.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_fi.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_fil.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_fr.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_gu.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_hi.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_hr.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_hu.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_id.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_is.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_it.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_iw.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ja.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_kn.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ko.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_lt.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_lv.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ml.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_mr.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ms.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_nl.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_no.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_pl.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_pt-BR.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_pt-PT.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ro.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ru.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_sk.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_sl.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_sr.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_sv.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_sw.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ta.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_te.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_th.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_tr.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_uk.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_ur.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_vi.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_zh-CN.dll
c:\program files (x86)\Google\Update\1.3.21.153\goopdateres_zh-TW.dll
c:\program files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
c:\program files (x86)\Google\Update\1.3.21.153\psmachine.dll
c:\program files (x86)\Google\Update\1.3.21.153\psuser.dll
c:\program files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.21.153\GoogleUpdateSetup.exe
c:\program files (x86)\Google\Update\Download\{74AF07D8-FB8F-4D51-8AC7-927721D56EBB}\0.0.0.0\GoogleEarth-Win-Bundle-7.1.1.1580.exe
c:\program files (x86)\Google\Update\Download\{74AF07D8-FB8F-4D51-8AC7-927721D56EBB}\7.1.1.1888\GoogleEarth-Win-Bundle-7.1.1.1888.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\Seznam.cz\distribution\szninstall.exe
c:\program files (x86)\Skype\Updater
c:\program files (x86)\Skype\Updater\Updater.dll
c:\program files (x86)\Skype\Updater\Updater.exe
c:\windows\inf\mseals\mseals.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SkypeUpdate
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-07-27 do 2013-08-27 )))))))))))))))))))))))))))))))
.
.
2013-08-27 10:00 . 2013-08-27 10:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-27 08:41 . 2013-08-27 08:41 -------- d-----w- c:\program files (x86)\SecurityXploded
2013-08-27 07:28 . 2013-08-06 08:58 9515512 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D752770A-C3F8-4994-8701-F168E972D4C4}\mpengine.dll
2013-08-26 20:53 . 2013-08-26 20:53 -------- d-----w- c:\windows\ERUNT
2013-08-26 20:21 . 2013-08-26 20:21 -------- d-----w- c:\users\Uživatel\AppData\Local\Black_Tree_Gaming
2013-08-26 19:11 . 2013-08-26 19:27 -------- d-----w- C:\AdwCleaner
2013-08-25 10:24 . 2013-08-06 08:58 9515512 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-08-22 12:50 . 2013-08-22 12:49 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55B4FA10-2F02-4DF5-97F7-DFDDEDDDEF74}\gapaengine.dll
2013-08-21 15:36 . 2013-08-21 15:36 -------- d-----w- c:\programdata\Caphyon
2013-08-21 15:36 . 2013-08-21 16:29 -------- d-----w- c:\program files (x86)\QuadCoreM2
2013-08-18 16:43 . 2013-08-18 16:43 -------- d-----w- c:\users\Uživatel\AppData\Local\EMU
2013-08-18 16:43 . 2013-08-18 16:43 -------- d-----w- c:\users\Uživatel\AppData\Local\PAYDAY 2
2013-08-18 12:58 . 2013-08-18 12:58 571168 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-08-16 20:10 . 2013-08-26 17:56 -------- d-----w- c:\users\Uživatel\AppData\Local\Deployment
2013-08-16 19:54 . 2013-08-16 19:54 234010 ----a-w- c:\windows\SysWow64\poclbm130302GeForce GTX 650gv1w256l4.bin
2013-08-15 16:31 . 2013-08-15 16:31 -------- d-----w- c:\programdata\SystemRequirementsLab
2013-08-04 08:32 . 2013-08-04 08:32 -------- d-----w- c:\program files\TeamSpeak 3 Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-20 21:25 . 2012-07-12 17:47 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-20 21:25 . 2012-07-12 17:47 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-18 21:02 . 2013-07-04 19:37 6329552 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-08-18 21:02 . 2013-04-24 19:47 2630304 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-08-18 21:02 . 2013-04-24 19:47 12946848 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-08-18 21:02 . 2013-01-08 17:57 1412832 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-08-18 21:02 . 2013-01-08 17:57 2986672 ----a-w- c:\windows\system32\nvapi64.dll
2013-08-18 21:02 . 2012-11-29 13:21 15900936 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-08-18 21:02 . 2012-07-04 01:30 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-08-18 21:02 . 2012-07-04 01:30 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-08-18 19:34 . 2012-11-29 13:23 6599968 ----a-w- c:\windows\system32\nvcpl.dll
2013-08-18 19:34 . 2012-11-29 13:23 3452192 ----a-w- c:\windows\system32\nvsvc64.dll
2013-08-18 19:34 . 2012-11-29 13:23 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-08-18 19:34 . 2012-11-29 13:23 920864 ----a-w- c:\windows\system32\nvvsvc.exe
2013-08-18 19:34 . 2012-11-29 13:23 219424 ----a-w- c:\windows\system32\nvmctray.dll
2013-08-17 05:30 . 2012-11-29 13:23 3319709 ----a-w- c:\windows\system32\nvcoproc.bin
2013-08-14 19:29 . 2013-01-25 13:53 214520 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-08-14 19:29 . 2012-07-16 11:59 214520 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-07-24 07:32 . 2013-01-25 13:53 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-07-24 07:31 . 2012-07-16 11:59 280600 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-07-21 19:38 . 2013-07-21 19:38 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-07-17 12:45 . 2012-10-03 06:21 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-06-21 12:06 . 2013-07-04 19:37 1832224 ----a-w- c:\windows\system32\nvdispco6432049.dll
2013-06-21 12:06 . 2013-07-04 19:37 1511712 ----a-w- c:\windows\system32\nvdispgenco6432049.dll
2013-06-07 11:45 . 2013-08-16 19:54 84992 --s-a-w- c:\windows\inf\mseals\zlib1.dll
2013-06-07 11:45 . 2013-08-16 19:54 364544 --s-a-w- c:\windows\inf\mseals\ssleay32.dll
2013-06-07 11:45 . 2013-08-16 19:54 279955 --s-a-w- c:\windows\inf\mseals\libidn-11.dll
2013-06-07 11:45 . 2013-08-16 19:54 183382 --s-a-w- c:\windows\inf\mseals\librtmp.dll
2013-06-07 11:45 . 2013-08-16 19:54 171008 --s-a-w- c:\windows\inf\mseals\libssh2.dll
2013-06-07 11:45 . 2013-08-16 19:54 110094 --s-a-w- c:\windows\inf\mseals\libusb-1.0.dll
2013-06-07 11:45 . 2013-08-16 19:54 612352 --s-a-w- c:\windows\inf\mseals\libcurl.dll
2013-06-07 11:45 . 2013-08-16 19:54 1704448 --s-a-w- c:\windows\inf\mseals\libeay32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bloody2"="c:\program files (x86)\Bloody2\Bloody2\Bloody2.exe" [2012-08-10 4255232]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-21 2583040]
"CTSyncService"="c:\program files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe" [2009-07-08 1233195]
"VolPanel"="c:\program files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" [2009-05-04 241789]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-06-28 2255184]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GamePark klient 2.lnk - c:\hry\GamePark2\gpcl.exe [2013-8-14 442880]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SmartViewService;SmartView service; [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 EagleX64;EagleX64; [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files (x86)\IObit\Advanced SystemCare 6\ASCService.exe;c:\program files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [x]
S2 Dokan;Dokan;c:\windows\system32\drivers\dokan.sys;c:\windows\SYSNATIVE\drivers\dokan.sys [x]
S2 DokanMounter;DokanMounter;c:\program files (x86)\Dokan\DokanLibrary\mounter.exe;c:\program files (x86)\Dokan\DokanLibrary\mounter.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-08-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"EPSON Stylus DX5000 Series"="c:\windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE" [2006-02-14 131072]
"EPSON Stylus DX5000 Series (kopie 1)"="c:\windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE" [2006-02-14 131072]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/?clid=13415
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
FF - ProfilePath - c:\users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - ExtSQL: 2013-07-21 21:40; {ea614400-e918-4741-9a97-7a972ff7c30b}; c:\users\UĂ…Âľivatel\AppData\Roaming\Mozilla\Firefox\Profiles\u9bso1a1.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Dll-Files Fixer_is1 - c:\program files (x86)\Dll-Files.com Fixer\unins001.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1800223682-3901935553-3731950667-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bb,fe,24,0d,08,18,cb,33,f1,58,cb,2d,f9,5f,1e,30,93,65,50,a9,f7,89,fb,
32,4f,e4,20,57,9c,19,40,bf,99,c5,de,c0,07,9a,c3,5d,64,24,6b,82,b1,9f,5f,e7,\
"??"=hex:92,af,6a,b3,5b,09,7d,52,34,9f,97,b3,47,05,ca,2c
.
[HKEY_USERS\S-1-5-21-1800223682-3901935553-3731950667-1000\Software\SecuROM\License information*]
"datasecu"=hex:04,8f,f5,c4,d4,85,c8,92,16,1a,ca,66,22,74,b9,ca,f5,0e,63,47,a2,
36,5a,d0,81,18,13,99,57,3a,dc,85,d4,c7,64,18,a1,3a,e5,40,2f,8a,ca,ae,23,f9,\
"rkeysecu"=hex:6f,83,83,40,7e,52,5d,16,13,91,e7,e3,a6,27,78,75
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\IObit\Advanced SystemCare 6\Monitor.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\users\UIVATE~1\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
.
**************************************************************************
.
Celkový čas: 2013-08-27 12:04:12 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-08-27 10:04
.
Před spuštěním: 13135605760
Po spuštění: 12609843200
.
- - End Of File - - 89F2813A27AD94B0F2056424C51A6045
A36C5E4F47E84449FF07ED3517B43A31
Nahr nˇ probŘhlo ŁspŘçnŘ




///////////////// Log z HJT:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:15, on 27.8.2013
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16455)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\IObit\Advanced SystemCare 6\Monitor.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\Bloody2\Bloody2\Bloody2.exe
C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe
C:\Users\UIVATE~1\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
C:\Program Files (x86)\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/?clid=13415
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [CTSyncService] C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe /StartRunKey
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [Bloody2] C:\Program Files (x86)\Bloody2\Bloody2\Bloody2.exe Minimum
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Global Startup: GamePark klient 2.lnk = C:\Hry\GamePark2\gpcl.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Advanced SystemCare Service 6 (AdvancedSystemCareService6) - IObit - C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: DokanMounter - Unknown owner - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SmartView service (SmartViewService) - Unknown owner - (no file)
O23 - Service: Sound Blaster X-Fi MB Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 9000 bytes




///////////////////Log z aswMBR:
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-08-27 12:12:44
-----------------------------
12:12:44.567 OS Version: Windows x64 6.1.7600
12:12:44.583 Number of processors: 4 586 0xF0B
12:12:44.583 ComputerName: ONDRA UserName:
12:12:45.458 Initialize success
12:12:55.919 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
12:12:55.935 Disk 0 Vendor: WDC_WD7500AALX-009BA0 15.01H15 Size: 715404MB BusType: 3
12:12:55.982 Disk 0 MBR read successfully
12:12:55.982 Disk 0 MBR scan
12:12:55.998 Disk 0 Windows 7 default MBR code
12:12:55.998 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
12:12:55.998 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 299900 MB offset 206848
12:12:56.013 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 415402 MB offset 614402048
12:12:56.029 Disk 0 scanning C:\Windows\system32\drivers
12:12:59.966 Service scanning
12:13:08.544 Modules scanning
12:13:08.544 Disk 0 trace - called modules:
12:13:08.560 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
12:13:08.560 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005440060]
12:13:08.560 3 CLASSPNP.SYS[fffff880018c943f] -> nt!IofCallDriver -> [0xfffffa80051b7e40]
12:13:08.560 5 ACPI.sys[fffff88000e1b781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0xfffffa80051c7680]
12:13:08.576 Scan finished successfully
12:13:18.044 Disk 0 MBR has been saved successfully to "C:\Users\Uživatel\Desktop\MBR.dat"
12:13:18.060 The log file has been saved successfully to "C:\Users\Uživatel\Desktop\aswMBR LOG.txt"

[memphisto]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.

Jak se chová PC?