Prosím o kontrolu, neustály download 27 KB/s

[raskar89]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Home at 2013-09-07 00:08:34
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 188 GB (82%) free of 230 GB
Total RAM: 3071 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:08:58, on 7.9.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16660)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\P4P\P4P.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Comodo\COMODO Internet Security\cistray.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Comodo\COMODO Internet Security\cis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Home\Desktop\RSIT.exe
C:\Program Files\trend micro\Home.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://intra.bibs.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Nvtmru] "C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-508139342-1987166193-3339863934-1032\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-508139342-1987166193-3339863934-1032\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [Symform Status] C:\Program Files\Symform\Node Service\symformstatus.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symform Status] C:\Program Files\Symform\Node Service\symformstatus.exe (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{E321DDC1-56AB-49C4-81A6-3D1F42525E9B}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{F124DAAB-A7F9-4CC2-B3F3-82E5342F7663}: NameServer = 156.154.70.22,156.154.71.22
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Riverbed Technology, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Symform Contribution Service (symformcontrib) - Symform, Inc. - C:\Program Files\Symform\Node Service\symformcontrib.exe
O23 - Service: Symform Synchronization Service (symformsync) - Symform, Inc. - C:\Program Files\Symform\Node Service\symformsync.exe
O23 - Service: Symform Software Updater Service (symformupdater) - Symform, Inc. - C:\Program Files\Symform\Node Service\symformupdater.exe

--
End of file - 8527 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\Defraggler Volume C Task.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\h0grir0t.default

prefs.js - "browser.startup.homepage" - "https://news.google.cz/nwshp?hl=cs&tab=wn"

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF
"smartwebprinting@hp.com"=C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.8.800.94 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.8]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\h0grir0t.default\extensions\
{3d7eb24f-2740-49df-8937-200b1cc08f8a}
{bee6eb20-01e0-ebd1-da83-080329fb9a3a}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-06-29 463272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-06-29 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"=C:\Program Files\ATKOSD2\ATKOSD2.exe [2007-10-17 7737344]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-01-15 4874240]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-12-06 1029416]
"PowerForPhone"=C:\Program Files\P4P\P4P.exe [2007-08-02 778240]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2013-05-09 4858968]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2013-07-08 1464536]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]
"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-04-21 59720]
"Nvtmru"=C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [2013-08-27 1028896]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2013-08-16 152392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-04-21 59720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gbrspcontrol]
C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe -controlservice -slave []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-07-22 150528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2013-08-16 152392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
C:\Windows\Skytel.exe [2007-11-20 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2006-11-22 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2013-08-24 5703920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2009-09-20 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Start GeekBuddy.lnk]
C:\PROGRA~1\Comodo\GEEKBU~1\launcher.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=serwvdrv.dll
"wave2"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-09-07 00:08:34 ----D---- C:\rsit
2013-09-07 00:02:49 ----D---- C:\Program Files\WinPcap
2013-09-06 23:57:17 ----D---- C:\Program Files\Wireshark
2013-09-06 22:28:05 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2013-09-06 22:17:31 ----A---- C:\Windows\system32\APEX_release.dll
2013-09-06 22:16:56 ----A---- C:\Windows\system32\steam_api.dll
2013-09-06 22:16:06 ----A---- C:\Windows\system32\binkw32.dll
2013-09-06 22:15:30 ----A---- C:\Windows\system32\d3dx9_42.dll
2013-09-06 22:14:21 ----A---- C:\Windows\system32\xinput1_3.dll
2013-09-06 22:10:57 ----D---- C:\Users\Home\AppData\Roaming\NVIDIA
2013-08-31 09:38:26 ----A---- C:\Windows\system32\drivers\nvvad32v.sys
2013-08-26 21:55:51 ----D---- C:\NvidiaLogging
2013-08-26 21:54:41 ----A---- C:\Windows\system32\nvaudcap32v.dll
2013-08-24 20:07:22 ----D---- C:\Program Files\Mozilla Firefox
2013-08-24 00:01:40 ----D---- C:\Windows\system32\MRT
2013-08-23 23:54:19 ----A---- C:\Windows\system32\jscript.dll
2013-08-23 23:54:17 ----A---- C:\Windows\system32\jscript9.dll
2013-08-23 23:54:16 ----A---- C:\Windows\system32\jsproxy.dll
2013-08-23 23:54:16 ----A---- C:\Windows\system32\iesetup.dll
2013-08-23 23:54:15 ----A---- C:\Windows\system32\ieui.dll
2013-08-23 23:54:13 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-23 23:54:13 ----A---- C:\Windows\system32\msfeeds.dll
2013-08-23 23:54:13 ----A---- C:\Windows\system32\iernonce.dll
2013-08-23 23:54:13 ----A---- C:\Windows\system32\ie4uinit.exe
2013-08-23 23:54:12 ----A---- C:\Windows\system32\urlmon.dll
2013-08-23 23:54:12 ----A---- C:\Windows\system32\iesysprep.dll
2013-08-23 23:54:11 ----A---- C:\Windows\system32\iertutil.dll
2013-08-23 23:54:08 ----A---- C:\Windows\system32\wininet.dll
2013-08-23 23:54:05 ----A---- C:\Windows\system32\ieframe.dll
2013-08-23 23:54:02 ----A---- C:\Windows\system32\mshtml.dll
2013-08-23 23:33:15 ----D---- C:\Program Files\iPod
2013-08-23 23:33:14 ----D---- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-23 23:33:14 ----D---- C:\Program Files\iTunes
2013-08-23 23:26:50 ----A---- C:\Windows\system32\rpcrt4.dll
2013-08-23 23:26:45 ----A---- C:\Windows\system32\crypt32.dll
2013-08-23 23:26:44 ----A---- C:\Windows\system32\wintrust.dll
2013-08-23 23:26:44 ----A---- C:\Windows\system32\cryptsvc.dll
2013-08-23 23:26:44 ----A---- C:\Windows\system32\cryptnet.dll
2013-08-23 23:26:23 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-08-23 23:26:22 ----A---- C:\Windows\system32\ntkrnlpa.exe
2013-08-23 23:26:21 ----A---- C:\Windows\system32\ntdll.dll
2013-08-23 23:26:17 ----A---- C:\Windows\system32\drivers\tcpip.sys
2013-08-23 23:26:14 ----A---- C:\Windows\system32\WMVDECOD.DLL
2013-08-23 23:25:40 ----A---- C:\Windows\system32\tzres.dll
2013-08-23 23:25:29 ----A---- C:\Windows\system32\drivers\tssecsrv.sys

======List of files/folders modified in the last 1 month======

2013-09-07 00:08:38 ----D---- C:\Program Files\trend micro
2013-09-07 00:02:49 ----RD---- C:\Program Files
2013-09-07 00:02:49 ----D---- C:\Windows\system32\drivers
2013-09-07 00:02:49 ----D---- C:\Windows\System32
2013-09-06 23:56:56 ----D---- C:\Windows\Prefetch
2013-09-06 23:45:10 ----D---- C:\Windows\Temp
2013-09-06 22:27:43 ----D---- C:\Windows\inf
2013-09-06 22:26:57 ----D---- C:\Windows
2013-09-06 22:26:57 ----D---- C:\ProgramData\NVIDIA
2013-09-06 22:25:54 ----D---- C:\Windows\system32\config
2013-09-06 22:25:32 ----A---- C:\Users\Home\AppData\Roaming\Network Meter_Usage.ini
2013-09-06 22:04:32 ----D---- C:\Windows\system32\Tasks
2013-09-06 21:51:09 ----D---- C:\Users\Home\AppData\Roaming\uTorrent
2013-09-06 21:44:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-09-06 21:12:21 ----D---- C:\Users\Home\AppData\Roaming\vlc
2013-09-06 20:16:50 ----SHD---- C:\System Volume Information
2013-09-06 20:10:50 ----A---- C:\Windows\system32\acovcnt.exe
2013-08-31 09:52:55 ----D---- C:\Program Files\Defraggler
2013-08-31 09:39:45 ----D---- C:\Program Files\NVIDIA Corporation
2013-08-31 09:39:44 ----RSD---- C:\Windows\assembly
2013-08-31 09:38:32 ----D---- C:\Windows\system32\DriverStore
2013-08-31 09:38:32 ----D---- C:\Windows\system32\catroot
2013-08-27 09:27:16 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-08-26 21:54:22 ----D---- C:\Windows\Panther
2013-08-26 21:54:21 ----D---- C:\Windows\debug
2013-08-24 17:16:37 ----D---- C:\Windows\rescache
2013-08-24 13:33:41 ----D---- C:\Windows\Microsoft.NET
2013-08-24 13:08:36 ----D---- C:\Program Files\SUPERAntiSpyware
2013-08-24 00:20:05 ----D---- C:\Windows\winsxs
2013-08-24 00:17:28 ----D---- C:\Windows\system32\cs-CZ
2013-08-24 00:17:28 ----D---- C:\Program Files\Internet Explorer
2013-08-24 00:01:34 ----A---- C:\Windows\system32\MRT.exe
2013-08-24 00:01:14 ----SHD---- C:\Windows\Installer
2013-08-24 00:01:13 ----D---- C:\ProgramData\Microsoft Help
2013-08-23 23:54:33 ----D---- C:\Windows\system32\catroot2
2013-08-23 23:33:15 ----D---- C:\Program Files\Common Files\Apple
2013-08-23 23:33:14 ----HD---- C:\ProgramData

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2013-05-09 49376]
R0 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2013-06-28 175176]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2007-09-29 308248]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2013-05-09 61680]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2013-06-28 770344]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2013-06-28 369584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2013-05-09 56080]
R1 cmderd;COMODO Internet Security Eradication Driver; C:\Windows\System32\DRIVERS\cmderd.sys [2013-06-18 20072]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\system32\DRIVERS\cmdguard.sys [2013-07-08 582936]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2013-06-18 43728]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2013-06-18 85464]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
R2 ASMMAP;ASMMAP; \??\C:\Program Files\ATKGFNEX\ASMMAP.sys [2007-07-24 13880]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2013-05-09 29816]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2013-05-09 66336]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-08-08 45568]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 26840]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-01-15 2047576]
R3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2007-06-20 49664]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2007-01-24 5632]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [2013-09-06 40776]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2009-07-14 18432]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 NETw4v32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-09-26 2251776]
R3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2013-03-01 36600]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad32v.sys [2013-08-20 33568]
R3 sdbus;sdbus; C:\Windows\system32\drivers\sdbus.sys [2010-11-20 84992]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-22 982272]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-12-06 196400]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 131072]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2010-11-20 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 36864]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-14 4231168]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2012-08-23 49664]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2012-12-13 45056]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-11 65640]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-12-21 57008]
R2 ASLDRService;ASLDR Service; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [2007-10-02 94208]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-05-09 46808]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 390504]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2013-07-08 4801304]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-06-01 647168]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-08-27 14573856]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-06-21 640288]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-08-27 2155296]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-06-01 327680]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-06-21 413472]
R2 symformcontrib;Symform Contribution Service; C:\Program Files\Symform\Node Service\symformcontrib.exe [2013-08-12 18872]
R2 symformsync;Symform Synchronization Service; C:\Program Files\Symform\Node Service\symformsync.exe [2013-08-12 19384]
R2 symformupdater;Symform Software Updater Service; C:\Program Files\Symform\Node Service\symformupdater.exe [2013-08-12 29112]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2013-08-16 553288]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-12 257416]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 cmdvirth;COMODO Virtual Service Manager; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2013-06-18 127192]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-08-24 117656]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2013-03-01 118520]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-04-14 1343400]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[Rudy]

Zdravím!
Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[raskar89]

ComboFix 13-09-06.01 - Home 07.09.2013 12:46:03.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3071.1794 [GMT 2:00]
Spuštěný z: c:\users\Home\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: COMODO Firewall *Enabled* {8F7746F7-FE68-E084-3B6C-7404A51E8FB3}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: COMODO Antivirus *Disabled/Outdated* {0C2D2636-923D-EE52-2A83-E643204A8275}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-07 do 2013-09-07 )))))))))))))))))))))))))))))))
.
.
2013-09-07 11:09 . 2013-09-07 11:09 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-09-07 11:09 . 2013-09-07 11:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-06 22:08 . 2013-09-06 22:09 -------- d-----w- C:\rsit
2013-09-06 22:02 . 2013-09-06 22:02 -------- d-----w- c:\program files\WinPcap
2013-09-06 21:57 . 2013-09-06 21:58 -------- d-----w- c:\program files\Wireshark
2013-09-06 20:17 . 2011-12-19 12:41 557056 ----a-w- c:\windows\system32\APEX_release.dll
2013-09-06 20:16 . 2013-04-02 09:27 105808 ----a-w- c:\windows\system32\steam_api.dll
2013-09-06 20:16 . 2012-03-26 14:38 226304 ----a-w- c:\windows\system32\binkw32.dll
2013-09-06 20:15 . 2009-09-30 11:08 1892184 ----a-w- c:\windows\system32\d3dx9_42.dll
2013-09-06 20:14 . 2012-07-06 10:12 81768 ----a-w- c:\windows\system32\xinput1_3.dll
2013-09-06 20:11 . 2013-09-06 20:11 -------- d-----w- c:\users\Home\AppData\Local\2K Games
2013-09-06 20:10 . 2013-09-06 20:22 -------- d-----w- c:\users\Home\AppData\Roaming\NVIDIA
2013-09-06 19:50 . 2013-09-07 10:32 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D71A771C-F20A-4347-920B-1349C61F0AEB}\offreg.dll
2013-09-06 18:17 . 2013-08-06 07:28 7166848 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D71A771C-F20A-4347-920B-1349C61F0AEB}\mpengine.dll
2013-08-31 07:38 . 2013-08-20 13:33 33568 ----a-w- c:\windows\system32\drivers\nvvad32v.sys
2013-08-26 19:55 . 2013-08-26 19:55 -------- d-----w- C:\NvidiaLogging
2013-08-26 19:54 . 2013-08-20 13:32 28448 ----a-w- c:\windows\system32\nvaudcap32v.dll
2013-08-23 22:01 . 2013-08-23 22:03 -------- d-----w- c:\windows\system32\MRT
2013-08-23 21:33 . 2013-08-23 21:33 -------- d-----w- c:\program files\iPod
2013-08-23 21:33 . 2013-08-23 21:33 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-23 21:33 . 2013-08-23 21:33 -------- d-----w- c:\program files\iTunes
2013-08-23 21:26 . 2013-07-09 04:50 652800 ----a-w- c:\windows\system32\rpcrt4.dll
2013-08-23 21:26 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\system32\crypt32.dll
2013-08-23 21:26 . 2013-07-09 04:52 175104 ----a-w- c:\windows\system32\wintrust.dll
2013-08-23 21:26 . 2013-07-09 04:46 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-23 21:26 . 2013-07-09 04:46 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-23 21:26 . 2013-07-09 05:03 3913664 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-23 21:26 . 2013-07-09 05:03 3968960 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-08-23 21:26 . 2013-07-09 04:53 1289096 ----a-w- c:\windows\system32\ntdll.dll
2013-08-23 21:26 . 2013-07-06 05:05 1293760 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-08-23 21:26 . 2013-07-25 08:57 1620992 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-08-23 21:25 . 2013-07-19 01:41 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-23 21:25 . 2013-06-15 03:38 31232 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-07 11:00 . 2013-04-14 16:00 17128 ----a-w- c:\users\Home\Network_Meter_Data.js
2013-09-06 18:10 . 2013-04-14 11:15 45056 ----a-w- c:\windows\system32\acovcnt.exe
2013-07-12 21:19 . 2013-04-14 15:37 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-12 21:19 . 2013-04-14 15:37 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-07-08 20:59 . 2013-01-16 17:51 582936 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2013-06-29 11:12 . 2013-06-29 11:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-06-29 11:12 . 2013-04-14 15:53 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-06-29 11:12 . 2013-04-14 15:53 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-06-28 11:15 . 2013-04-14 15:27 770344 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-06-28 11:15 . 2013-04-14 15:27 369584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-06-28 11:15 . 2013-04-14 15:27 175176 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-06-21 12:02 . 2013-07-06 12:10 13411896 ----a-w- c:\windows\system32\nvwgf2um.dll
2013-06-21 12:02 . 2013-07-06 12:10 9069344 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-06-21 12:02 . 2013-07-06 12:10 6324360 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:02 . 2013-07-06 12:10 21102368 ----a-w- c:\windows\system32\nvoglv32.dll
2013-06-21 12:02 . 2013-07-06 12:10 893728 ----a-w- c:\windows\system32\nvdispgenco3232049.dll
2013-06-21 12:02 . 2013-07-06 12:10 7687592 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:02 . 2013-07-06 12:10 467232 ----a-w- c:\windows\system32\NvIFR.dll
2013-06-21 12:02 . 2013-07-06 12:10 465184 ----a-w- c:\windows\system32\NvFBC.dll
2013-06-21 12:02 . 2013-07-06 12:10 2777888 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:02 . 2013-07-06 12:10 2002720 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:02 . 2013-07-06 12:10 12427240 ----a-w- c:\windows\system32\nvd3dum.dll
2013-06-21 12:02 . 2013-07-06 12:10 1024288 ----a-w- c:\windows\system32\nvdispco3232049.dll
2013-06-21 12:02 . 2013-07-06 12:10 2597856 ----a-w- c:\windows\system32\nvapi.dll
2013-06-21 12:02 . 2013-07-06 12:10 17560352 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:02 . 2013-04-14 15:23 53024 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-21 09:52 . 2013-07-06 12:16 4192544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 09:52 . 2013-07-06 12:16 3045664 ----a-w- c:\windows\system32\nvsvc.dll
2013-06-21 09:52 . 2013-07-06 12:16 640288 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 09:52 . 2013-07-06 12:16 62752 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 09:52 . 2013-07-06 12:16 2555168 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 09:52 . 2013-07-06 12:16 223008 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 03:16 . 2013-06-21 03:16 566048 ----a-w- c:\windows\system32\nvStreaming.exe
2013-06-18 15:16 . 2013-01-16 17:51 85464 ----a-w- c:\windows\system32\drivers\inspect.sys
2013-06-18 15:16 . 2013-01-16 17:51 43728 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2013-06-18 15:16 . 2013-01-16 17:51 20072 ----a-w- c:\windows\system32\drivers\cmderd.sys
2013-06-18 15:15 . 2013-01-24 20:43 35488 ----a-w- c:\windows\system32\cmdcsr.dll
2013-06-18 15:15 . 2013-01-24 20:43 348584 ----a-w- c:\windows\system32\guard32.dll
2013-06-18 15:15 . 2013-01-24 20:42 278232 ----a-w- c:\windows\system32\cmdvrt32.dll
2013-06-18 15:15 . 2013-01-24 20:42 40664 ----a-w- c:\windows\system32\cmdkbd32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-10-17 7737344]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"PowerForPhone"="c:\program files\P4P\P4P.exe" [2007-08-02 778240]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2013-07-08 1464536]
"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-08-27 1028896]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symform Status"="c:\program files\Symform\Node Service\symformstatus.exe" [2013-08-12 111544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Start GeekBuddy.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Start GeekBuddy.lnk
backup=c:\windows\pss\Start GeekBuddy.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-04-21 19:43 59720 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 14:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2008-07-22 16:33 150528 ----a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-08-16 07:07 152392 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-11-20 10:15 1826816 ----a-w- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2006-11-22 09:31 630784 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-03-12 05:32 253816 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2013-08-24 11:08 5703920 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
R3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [2013-06-18 127192]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2013-03-01 36600]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2013-04-14 1343400]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2013-06-18 20072]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2013-07-08 582936]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2013-06-18 43728]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 66336]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-08-27 14573856]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-06-21 413472]
S2 symformcontrib;Symform Contribution Service;c:\program files\Symform\Node Service\symformcontrib.exe [2013-08-12 18872]
S2 symformsync;Symform Synchronization Service;c:\program files\Symform\Node Service\symformsync.exe [2013-08-12 19384]
S2 symformupdater;Symform Software Updater Service;c:\program files\Symform\Node Service\symformupdater.exe [2013-08-12 29112]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2013-08-20 33568]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-14 21:19]
.
2013-09-07 c:\windows\Tasks\Defraggler Volume C Task.job
- c:\program files\Defraggler\df.exe [2013-04-19 12:43]
.
.
------- Doplňkový sken -------
.
uStart Page = https://intra.bibs.cz/
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{E321DDC1-56AB-49C4-81A6-3D1F42525E9B}: NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{F124DAAB-A7F9-4CC2-B3F3-82E5342F7663}: NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{F124DAAB-A7F9-4CC2-B3F3-82E5342F7663}\651305732427E6F6: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{F124DAAB-A7F9-4CC2-B3F3-82E5342F7663}\75962E0819649602134363: NameServer = 156.154.70.22,156.154.71.22
FF - ProfilePath - c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\h0grir0t.default\
FF - prefs.js: browser.startup.homepage - hxxps://news.google.cz/nwshp?hl=cs&tab=wn
FF - ExtSQL: !HIDDEN! 2013-04-14 23:11; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-gbrspcontrol - c:\program files\Common Files\COMODO\GeekBuddyRSP.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\guard32.dll
.
Celkový čas: 2013-09-07 13:12:08
ComboFix-quarantined-files.txt 2013-09-07 11:12
.
Před spuštěním: Volných bajtů: 196 956 037 120
Po spuštění: Volných bajtů: 196 876 447 744
.
- - End Of File - - 14B0F4C4409B3052063266DE4536F1DE
A36C5E4F47E84449FF07ED3517B43A31

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\windows\system32\acovcnt.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[raskar89]

ComboFix 13-09-06.01 - Home 07.09.2013 14:08:31.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3071.1969 [GMT 2:00]
Spuštěný z: c:\users\Home\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Home\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: COMODO Firewall *Enabled* {8F7746F7-FE68-E084-3B6C-7404A51E8FB3}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: COMODO Antivirus *Disabled/Outdated* {0C2D2636-923D-EE52-2A83-E643204A8275}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
file zipped: c:\windows\system32\acovcnt.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-07 do 2013-09-07 )))))))))))))))))))))))))))))))
.
.
2013-09-07 12:32 . 2013-09-07 12:33 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-09-06 22:08 . 2013-09-06 22:09 -------- d-----w- C:\rsit
2013-09-06 22:02 . 2013-09-06 22:02 -------- d-----w- c:\program files\WinPcap
2013-09-06 21:57 . 2013-09-06 21:58 -------- d-----w- c:\program files\Wireshark
2013-09-06 20:17 . 2011-12-19 12:41 557056 ----a-w- c:\windows\system32\APEX_release.dll
2013-09-06 20:16 . 2013-04-02 09:27 105808 ----a-w- c:\windows\system32\steam_api.dll
2013-09-06 20:16 . 2012-03-26 14:38 226304 ----a-w- c:\windows\system32\binkw32.dll
2013-09-06 20:15 . 2009-09-30 11:08 1892184 ----a-w- c:\windows\system32\d3dx9_42.dll
2013-09-06 20:14 . 2012-07-06 10:12 81768 ----a-w- c:\windows\system32\xinput1_3.dll
2013-09-06 20:11 . 2013-09-06 20:11 -------- d-----w- c:\users\Home\AppData\Local\2K Games
2013-09-06 20:10 . 2013-09-06 20:22 -------- d-----w- c:\users\Home\AppData\Roaming\NVIDIA
2013-09-06 19:50 . 2013-09-07 12:08 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D71A771C-F20A-4347-920B-1349C61F0AEB}\offreg.dll
2013-09-06 18:17 . 2013-08-06 07:28 7166848 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D71A771C-F20A-4347-920B-1349C61F0AEB}\mpengine.dll
2013-08-31 07:38 . 2013-08-20 13:33 33568 ----a-w- c:\windows\system32\drivers\nvvad32v.sys
2013-08-26 19:55 . 2013-08-26 19:55 -------- d-----w- C:\NvidiaLogging
2013-08-26 19:54 . 2013-08-20 13:32 28448 ----a-w- c:\windows\system32\nvaudcap32v.dll
2013-08-23 22:01 . 2013-08-23 22:03 -------- d-----w- c:\windows\system32\MRT
2013-08-23 21:33 . 2013-08-23 21:33 -------- d-----w- c:\program files\iPod
2013-08-23 21:33 . 2013-08-23 21:33 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-23 21:33 . 2013-08-23 21:33 -------- d-----w- c:\program files\iTunes
2013-08-23 21:26 . 2013-07-09 04:50 652800 ----a-w- c:\windows\system32\rpcrt4.dll
2013-08-23 21:26 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\system32\crypt32.dll
2013-08-23 21:26 . 2013-07-09 04:52 175104 ----a-w- c:\windows\system32\wintrust.dll
2013-08-23 21:26 . 2013-07-09 04:46 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-23 21:26 . 2013-07-09 04:46 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-23 21:26 . 2013-07-09 05:03 3913664 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-23 21:26 . 2013-07-09 05:03 3968960 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-08-23 21:26 . 2013-07-09 04:53 1289096 ----a-w- c:\windows\system32\ntdll.dll
2013-08-23 21:26 . 2013-07-06 05:05 1293760 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-08-23 21:26 . 2013-07-25 08:57 1620992 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-08-23 21:25 . 2013-07-19 01:41 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-23 21:25 . 2013-06-15 03:38 31232 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-07 12:33 . 2013-04-14 11:15 45056 ----a-w- c:\windows\system32\acovcnt.exe
2013-09-07 12:00 . 2013-04-14 16:00 17164 ----a-w- c:\users\Home\Network_Meter_Data.js
2013-07-12 21:19 . 2013-04-14 15:37 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-12 21:19 . 2013-04-14 15:37 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-07-08 20:59 . 2013-01-16 17:51 582936 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2013-06-29 11:12 . 2013-06-29 11:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-06-29 11:12 . 2013-04-14 15:53 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-06-29 11:12 . 2013-04-14 15:53 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-06-28 11:15 . 2013-04-14 15:27 770344 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-06-28 11:15 . 2013-04-14 15:27 369584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-06-28 11:15 . 2013-04-14 15:27 175176 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-06-21 12:02 . 2013-07-06 12:10 13411896 ----a-w- c:\windows\system32\nvwgf2um.dll
2013-06-21 12:02 . 2013-07-06 12:10 9069344 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-06-21 12:02 . 2013-07-06 12:10 6324360 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:02 . 2013-07-06 12:10 21102368 ----a-w- c:\windows\system32\nvoglv32.dll
2013-06-21 12:02 . 2013-07-06 12:10 893728 ----a-w- c:\windows\system32\nvdispgenco3232049.dll
2013-06-21 12:02 . 2013-07-06 12:10 7687592 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:02 . 2013-07-06 12:10 467232 ----a-w- c:\windows\system32\NvIFR.dll
2013-06-21 12:02 . 2013-07-06 12:10 465184 ----a-w- c:\windows\system32\NvFBC.dll
2013-06-21 12:02 . 2013-07-06 12:10 2777888 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:02 . 2013-07-06 12:10 2002720 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:02 . 2013-07-06 12:10 12427240 ----a-w- c:\windows\system32\nvd3dum.dll
2013-06-21 12:02 . 2013-07-06 12:10 1024288 ----a-w- c:\windows\system32\nvdispco3232049.dll
2013-06-21 12:02 . 2013-07-06 12:10 2597856 ----a-w- c:\windows\system32\nvapi.dll
2013-06-21 12:02 . 2013-07-06 12:10 17560352 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:02 . 2013-04-14 15:23 53024 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-21 09:52 . 2013-07-06 12:16 4192544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 09:52 . 2013-07-06 12:16 3045664 ----a-w- c:\windows\system32\nvsvc.dll
2013-06-21 09:52 . 2013-07-06 12:16 640288 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 09:52 . 2013-07-06 12:16 62752 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 09:52 . 2013-07-06 12:16 2555168 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 09:52 . 2013-07-06 12:16 223008 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 03:16 . 2013-06-21 03:16 566048 ----a-w- c:\windows\system32\nvStreaming.exe
2013-06-18 15:16 . 2013-01-16 17:51 85464 ----a-w- c:\windows\system32\drivers\inspect.sys
2013-06-18 15:16 . 2013-01-16 17:51 43728 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2013-06-18 15:16 . 2013-01-16 17:51 20072 ----a-w- c:\windows\system32\drivers\cmderd.sys
2013-06-18 15:15 . 2013-01-24 20:43 35488 ----a-w- c:\windows\system32\cmdcsr.dll
2013-06-18 15:15 . 2013-01-24 20:43 348584 ----a-w- c:\windows\system32\guard32.dll
2013-06-18 15:15 . 2013-01-24 20:42 278232 ----a-w- c:\windows\system32\cmdvrt32.dll
2013-06-18 15:15 . 2013-01-24 20:42 40664 ----a-w- c:\windows\system32\cmdkbd32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-10-17 7737344]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"PowerForPhone"="c:\program files\P4P\P4P.exe" [2007-08-02 778240]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2013-07-08 1464536]
"Nvtmru"="c:\program files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-08-27 1028896]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symform Status"="c:\program files\Symform\Node Service\symformstatus.exe" [2013-08-12 111544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Start GeekBuddy.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Start GeekBuddy.lnk
backup=c:\windows\pss\Start GeekBuddy.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-04-21 19:43 59720 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 14:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2008-07-22 16:33 150528 ----a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-08-16 07:07 152392 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-11-20 10:15 1826816 ----a-w- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2006-11-22 09:31 630784 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2013-08-24 11:08 5703920 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
R3 CFcatchme;CFcatchme;c:\users\Home\AppData\Local\Temp\CFcatchme.sys [x]
R3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [2013-06-18 127192]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2013-03-01 36600]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2013-04-14 1343400]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2013-06-18 20072]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2013-07-08 582936]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2013-06-18 43728]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 66336]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-08-27 14573856]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-06-21 413472]
S2 symformcontrib;Symform Contribution Service;c:\program files\Symform\Node Service\symformcontrib.exe [2013-08-12 18872]
S2 symformsync;Symform Synchronization Service;c:\program files\Symform\Node Service\symformsync.exe [2013-08-12 19384]
S2 symformupdater;Symform Software Updater Service;c:\program files\Symform\Node Service\symformupdater.exe [2013-08-12 29112]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad32v.sys [2013-08-20 33568]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-14 21:19]
.
2013-09-07 c:\windows\Tasks\Defraggler Volume C Task.job
- c:\program files\Defraggler\df.exe [2013-04-19 12:43]
.
.
------- Doplňkový sken -------
.
uStart Page = https://intra.bibs.cz/
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{E321DDC1-56AB-49C4-81A6-3D1F42525E9B}: NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{F124DAAB-A7F9-4CC2-B3F3-82E5342F7663}: NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{F124DAAB-A7F9-4CC2-B3F3-82E5342F7663}\651305732427E6F6: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{F124DAAB-A7F9-4CC2-B3F3-82E5342F7663}\75962E0819649602134363: NameServer = 156.154.70.22,156.154.71.22
FF - ProfilePath - c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\h0grir0t.default\
FF - prefs.js: browser.startup.homepage - hxxps://news.google.cz/nwshp?hl=cs&tab=wn
FF - ExtSQL: !HIDDEN! 2013-04-14 23:11; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(732)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(3472)
c:\windows\system32\guard32.dll
c:\windows\System32\wer.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\FXSRESM.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\ATK Hotkey\ASLDRSrv.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\ATK Hotkey\Hcontrol.exe
c:\program files\ATK Hotkey\MsgTranAgt.exe
c:\program files\Wireless Console 2\wcourier.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\Splendid\ACMON.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\program files\ATK Hotkey\KBFiltr.exe
c:\program files\ATK Hotkey\WDC.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\conhost.exe
c:\windows\system32\conhost.exe
c:\windows\RtHDVCpl.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\WmiApSrv.exe
.
**************************************************************************
.
Celkový čas: 2013-09-07 14:39:08 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-09-07 12:39
ComboFix2.txt 2013-09-07 11:12
.
Před spuštěním: Volných bajtů: 196 154 159 104
Po spuštění: Volných bajtů: 196 105 162 752
.
- - End Of File - - 4DC9B03B6060EEC4DAB2B428D47F7F75
A36C5E4F47E84449FF07ED3517B43A31
Nahr nˇ probŘhlo ŁspŘçnŘ

[raskar89]

bohuzel download porad pokracuje

[raskar89]

zkusil jsem pres firewall zablokovat veskera sitova spojeni, ale porad to bezi, tak nevim co si o tom myslet, posilam v priloze screen network meteru

[Rudy]

Pak to ale nemá ne svědomí vir, ale nějaká regulérní aplikace, která má přístup na net (což je dnes téměř každá).

[raskar89]

da se to nejak resit? Mam treba stazeny wireshark, jestli se z toho nejak daji exportovat data

[Rudy]

Budte muset po jedné vypínat aplikace s přístupem na net, až přijdete na tu, která to způsobuje.

[raskar89]

ted nevim jestli do dobre rozumime, ale kdyz dam pres firewall blokovat vse, tak to porad bezi, tzn firewall ma vliv na vsechny aplikace, protoze pro ne plati nastavena pravidla, ale toto neovlivnuje, zacalo to vcera vecer po pokusu crackovani neceho... (ja vim... :/ ) predtim to nedelalo

[raskar89]

zkusil jsem exporotovat pakety pres wireshark do txt
http://leteckaposta.cz/446457923

nestale to navazuje nekam spojeni cyklicky

[Rudy]

Zjistil jsem spojení s IP 173.193.191.132, což je USA: http://whois.domaintools.com/173.193.191.132. Vy sám musíte vědět, zda je toto spojení korektní, či ne. Spojení se opakovalo vícekrát. Která aplikace to způsobuje, mi log neprozradil.

[raskar89]

to by melo byt v poradku, jedna se o program symform, ktery slouzi ke cloudove zaloze, po pretazeni souboru do vybrane slozky sam zalohuje na cloud, vzdycky to ale akorat soubor uploadovalo, nyni (pokud je toto ten problem) tak to bezi porad a downloaduje to. Za pul dne to stahne i 1GB, pricemz moje zaloha je pouze 160mb

[raskar89]

zkusil jsem to odinstalovat a smazat zalohu ale porad pokracuje download