Pravidelně padá na plochu

[lafiman]

Zdravim všechny, potřeboval bych poradit s problémem. Když hraju hry nebo prohlížim internet prostě počítač se chová po zhruba 50 vteřinách tak, jako bych stisknul klávesu windows na klávesnici. Prostě píšu a najednou nemůžu, musim kliknout zase zpátky na text a můžu pokračovat a hry se minimalizují a tak je prostě furt musim maximalizovat jak debil dokola a dokola. Nevítě čím to je? Jednou při hraní, než se zapla hra, tak jsem ji minimalizoval a od tý doby jako bych to nějak spustil... Děkuji předem za rady :?

PS: Po nějaké době to přestává, ale po opětovném zapnutí PC se to děje znovu. Skoro na měsíc jsem se toho zbavil, ale potom znovu.

[Rudy]

Zdravím!
Dejte log RSIT: http://forum.viry.cz/viewtopic.php?t=81939 RSIT.

[lafiman]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Filip at 2013-08-19 13:33:19
Microsoft Windows 7 Home Premium
System drive C: has 43 GB (19%) free of 233 GB
Total RAM: 3326 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:33:42, on 19.8.2013
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\OO Software\Defrag\oodag.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Origin\Origin.exe
C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Origin\OriginClientService.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Windows\System32\svchost.exe
C:\Users\Filip\Downloads\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Filip.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MIF5BA~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [hbcswx] C:\ProgramData\hbcswx.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [EADM] C:\Program Files\Origin\Origin.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: TP-LINK Wireless Configuration Utility.lnk = C:\Program Files\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra button: SimilarSites - {807DF5E0-4EF7-48a8-A405-239F3E29FFA9} - (no file)
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MIF5BA~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: O&O Defrag Agent (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 8350 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Filip\AppData\Roaming\Mozilla\Firefox\Profiles\f8cjikd3.default

"fe_3.6@nokia.com"=C:\Program Files\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_3.6


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.8.800.94 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@esn.me/esnsonar,version=0.70.4]
"Description"=ESN Sonar browser plugin
"Path"=C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@esn/esnlaunch,version=2.1.7]
"Description"=
"Path"=C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.11.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]

[Rudy]

Zkuste nejprve obnovu systému k datu, kdy korektně fungoval. Pokud se to zdaří, dejte nový log RSIT.

[lafiman]

Tak bohužel, žádná obnova už nejde, jde pouze asi o den... tak nevím jak dál.

[Rudy]

Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[MiliNess]

Omluva za vstup, já asi tuším.
V Ovládací panely->Nástroje pro správu->Prohlížeč událostí->Protokoly systému Windows->klikni pravým myšítkem na protokol Systém a Aplikace, vyber Uložit všechny události jako, ulož to jako .evtx soubory a ty upni na http://www.leteckaposta.cz

[lafiman]

Zdravim Vás, omlouvám se neměl jsem čas tak jsem to teď projel a tady je log Combofix a zatim to dělá pořád, takže ještě uvidim a zkusim ten protokol

ComboFix 13-09-13.03 - Filip 14.09.2013 14:35:21.1.4 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3326.2257 [GMT 2:00]
Spuštěný z: c:\users\Filip\Downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Outdated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Outdated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\vbdeu.exe
c:\users\Filip\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\windows\IsUn0405.exe
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\frapsvid.dll
c:\windows\system32\tmp7DD7.tmp
c:\windows\system32\tmp7DD8.tmp
c:\windows\system32\tmpED3B.tmp
c:\windows\system32\tmpED6B.tmp
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_WsysSvc
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-14 do 2013-09-14 )))))))))))))))))))))))))))))))
.
.
2013-09-14 12:41 . 2013-09-14 12:44 -------- d-----w- c:\users\Filip\AppData\Local\temp
2013-08-22 22:50 . 2013-09-14 12:21 -------- d-----w- c:\program files\WinZipper
2013-08-22 22:50 . 2013-08-25 11:41 -------- d-----w- c:\users\Filip\AppData\Roaming\WinZipper
2013-08-22 22:43 . 2013-08-22 22:43 -------- d-----w- c:\users\Filip\AppData\Local\EA Games
2013-08-19 18:07 . 2013-09-14 12:24 -------- d-----w- c:\programdata\eSafe
2013-08-19 18:02 . 2013-08-19 18:02 -------- d-----w- c:\program files\Seznam.cz
2013-08-19 18:00 . 2013-09-14 12:23 -------- d-----w- c:\users\Filip\AppData\Roaming\Seznam.cz
2013-08-19 17:59 . 2013-08-19 17:59 -------- d-----w- c:\users\Filip\AppData\Local\SwvUpdater
2013-08-19 11:33 . 2013-08-19 11:41 -------- d-----w- c:\program files\trend micro
2013-08-19 11:33 . 2013-08-19 11:33 -------- d-----w- C:\rsit
2013-08-19 09:22 . 2013-08-19 09:22 -------- d-----w- c:\users\Filip\AppData\Local\ESN
2013-08-19 09:22 . 2013-08-19 09:22 -------- d-----w- c:\program files\Battlelog Web Plugins
2013-08-19 09:17 . 2013-08-19 09:25 -------- d-----w- c:\programdata\EA Logs
2013-08-19 07:15 . 2013-08-22 20:17 -------- d--h--w- c:\program files\Common Files\EAInstaller
2013-08-18 19:06 . 2013-08-18 19:06 -------- d-----w- c:\users\Filip\AppData\Local\Criterion Games
2013-08-18 13:22 . 2013-08-18 18:13 -------- d-----w- C:\AdwCleaner
2013-08-18 09:53 . 2013-08-18 09:53 -------- d-sh--w- c:\programdata\DSS
2013-08-17 22:43 . 2013-08-17 22:12 2601752 ----a-w- c:\windows\system32\pbsvc_moh.exe
2013-08-17 22:41 . 2013-08-17 22:41 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2013-08-17 18:42 . 2013-08-17 18:42 -------- d-----w- c:\programdata\Package Cache
2013-08-16 08:10 . 2013-08-16 08:10 -------- d-----w- c:\users\Filip\AppData\Local\Electronic Arts
2013-08-15 19:39 . 2013-08-18 18:04 -------- d-----w- c:\program files\Origin Games
2013-08-15 19:38 . 2013-08-16 20:18 -------- d-----w- c:\users\Filip\AppData\Roaming\Origin
2013-08-15 19:37 . 2013-08-15 19:43 -------- d-----w- c:\users\Filip\AppData\Local\Origin
2013-08-15 19:33 . 2013-08-22 22:43 -------- d-----w- c:\programdata\Origin
2013-08-15 19:33 . 2013-09-14 12:44 -------- d-----w- c:\program files\Origin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-20 20:38 . 2008-12-31 23:24 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2013-08-20 20:37 . 2008-12-31 23:17 17488 ----a-w- c:\windows\gdrv.sys
2013-08-19 09:26 . 2010-05-23 18:19 140072 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2013-08-19 09:26 . 2010-12-12 17:07 280904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2013-08-19 09:26 . 2010-05-23 18:18 280904 ----a-w- c:\windows\system32\PnkBstrB.exe
2013-08-19 09:24 . 2010-05-23 18:18 280904 ----a-w- c:\windows\system32\PnkBstrB.ex0
2013-08-19 07:15 . 2010-05-23 18:19 138056 ----a-w- c:\users\Filip\AppData\Roaming\PnkBstrK.sys
2013-08-19 07:14 . 2010-05-23 18:18 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2013-07-23 14:16 . 2013-01-20 12:07 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-07-23 14:16 . 2012-05-20 17:53 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"Steam"="c:\program files\Steam\steam.exe" [2013-08-28 1811880]
"EADM"="c:\program files\Origin\Origin.exe" [2013-08-29 3549528]
"cz.seznam.software.autoupdate"="c:\users\Filip\AppData\Roaming\Seznam.cz\szninstall.exe" [2013-05-16 1062472]
"cz.seznam.software.szndesktop"="c:\users\Filip\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-04-12 92664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-02-22 8522272]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"seznam-listicka-distribuce"="c:\program files\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
"cdcbs"="c:\programdata\cdcbs.exe" [2013-09-14 82944]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TP-LINK Wireless Configuration Utility.lnk - c:\program files\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe -nogui [2013-5-2 788992]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMD AVT]
start AMD Accelerated Video Transcoding device initialization [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-09-23 19:43 926896 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-02-20 20:28 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51 691656 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVI]
2007-07-26 14:05 20480 ----a-w- c:\program files\GIGABYTE\ET6\ETcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-10-14 12:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
2005-06-08 13:44 196608 ----a-w- c:\program files\Logitech\Video\ManifestEngine.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
2005-06-08 14:24 458752 ----a-w- c:\program files\Logitech\Video\ISStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
2005-06-08 14:14 217088 ----a-w- c:\program files\Logitech\Video\LogiTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-08-29 10:03 1996200 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
2005-07-19 16:32 221184 ----a-w- c:\windows\System32\LVCOMSX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxtorOneTouch]
2003-05-21 14:30 45056 ----a-w- c:\progra~1\Maxtor\OneTouch\Utils\OneTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MXO Auto Loader]
2003-04-07 17:09 118784 ----a-w- c:\windows\MXOALDR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
2012-01-10 17:36 1083264 ----a-w- c:\program files\Nokia\Nokia Suite\NokiaSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2010-11-25 07:43 2781000 ----a-w- c:\program files\OO Software\Defrag\oodtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
2009-12-22 14:23 2647040 ----a-w- c:\program files\Anti-Vibrate Oscar Editor\OscarEditor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-18 19:56 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTuner]
2009-02-25 17:55 24576 ----a-w- c:\program files\RivaTuner v2.24\RivaTunerWrapper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2012-11-16 15:10 641704 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 08:04 252848 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-04-21 12:42 37888 ----a-w- c:\program files\Winamp\winampa.exe
.
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 30312]
R3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [2009-02-22 7168]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2013-01-13 17488]
R3 GVTDrv;GVTDrv;c:\windows\system32\Drivers\GVTDrv.sys [2013-08-20 24944]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-04-09 16472]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-04-09 11104]
R3 rt61x86;AirLive WT-2000PCI Driver for Windows Vista;c:\windows\system32\DRIVERS\netr61.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-11-16 217088]
R4 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-11-16 291840]
R4 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 1385896]
R4 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2011-12-12 751464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-05-22 721904]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-03-05 45184]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-04-28 96896]
S2 OODefragAgent;O&O Defrag Agent;c:\program files\OO Software\Defrag\oodag.exe [2010-11-25 2404168]
S2 winzipersvc;WinZiper service;c:\program files\WinZipper\winzipersvc.exe [2013-08-22 424104]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-02-23 86544]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-06 17:50 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.delta-homes.com/?utm_source=b&utm_m ... 1377211874
mStart Page = hxxp://www.delta-homes.com/?utm_source=b&utm_m ... 1377211874
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: {{807DF5E0-4EF7-48a8-A405-239F3E29FFA9} - {FE69C007-C452-4d3e-86D2-1730DF8BC871} -
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\www.etrading
Trusted Zone: mojebanka.cz\*
FF - ProfilePath - c:\users\Filip\AppData\Roaming\Mozilla\Firefox\Profiles\f8cjikd3.default\
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
MSConfigStartUp-dpkat - c:\programdata\dpkat.exe
MSConfigStartUp-vbdeu - c:\programdata\vbdeu.exe
AddRemove-Left 4 Dead_is1 - x:\program files\Left4Dead\unins000.exe
AddRemove-PokerStars - x:\pokerstars\PokerStarsUninstall.exe
AddRemove-{29790AD1-9193-583E-9FFE-4712B4E74718} - c:\progra~3\INSTAL~1\{25662~1\Setup.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-49597417-1313772407-204172057-1000\Software\SecuROM\License information*]
"datasecu"=hex:11,8f,21,bc,aa,e4,f8,24,61,ea,79,de,c4,e0,c2,8e,f0,30,26,11,5c,
e5,cc,97,8f,e3,b6,5d,22,01,60,63,62,6f,14,f1,f8,8f,2c,b9,bd,7a,e8,9e,54,e4,\
"rkeysecu"=hex:e3,40,81,25,ae,9f,59,f6,72,f8,a4,58,c3,da,c0,fe
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="AD236ACE9E559EACEB36CF3C17E83692D8B8EF9DCD4095AE861CA5FC71F7F9247EEE322F9488D0931F5474CFD4E5EFF885BE22FC08E059D60C09987580E81434CA4D3975638991673E9B5A6D82CEA236E8F6C288D86281BD13A9BCFE840C65B290632E3B60F4AAE99F264FCD214709B9D190E034898BD72206E37E68AE6D694CF1E9014D483BEA5440A5E4D914436168B4504EA3C7782E3471309535146E201DB4B0E62BB7A1A3CEBB5A712DA10DF019AA0FA2342216D519071CF61D2EC18FB7C21AD90A323FA97AD69D8F1B7743FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A2D97226D213B5555D575E7D6A3B9808A9C6AECB7A5D140797467026B344D5D124A31F5054BD2D807FB07B1E9B67A120C52438D0253ACB4DE6CC1F00E3C462D80AD8A5C40E539E200C711C3E9C812F2F7DACE6DED785B540404446137957E102A6A43627D7A70DAB32C9D29124206EEC526AD702BCFB60A1C176A839086AAEDA67DF6A47E2C27A394FBCB2FEA4082F14B32E39CFA4C2826F0C9F2B62611F864A3D54830827624EB3C7C172FCD5351FB1133CDAF8ABB0B37D4373D88FA1478C881DC263E05EF8545701467097B3D3542A6B4EB1BDAAD072749197DED8A3ED4622045C10DD06AA3C38E5292BEFFBC9C6B53690D772C263A0CE21A68F660B4F1F78EAC8B51DE05298B965BEC63AB22AD1DB73A50901D85C01DDA4ADDF76BA5A65BED7A2A3D2F37DE116F1CE0BBE1EC1B6FCA82126E615E0404450AEEADC5C35C97F4E7ACAC50BEC72DC0316E3584A0E994C5A8DB4B5624F6A7A5DA0ED00DDB76596D6D14350B316896E124461F985C104CF17E55E1172B5F04C06EBCA5870EEB0B58120C764BFA24C001EFD37A5E34460636B9C6E35B7D8A8D88DEF8775881B0BE0DED0B782C4F0BF1C2A593D74BCAE00346E97D56CEBAECB14B77FCDF8DF303670844215431F91D1A03C656F13A9509846B5AC2B990B6377C54C5FEB1A72D6D8918CC708D169C94FBF5F1FED408A2CC06FDC2CA5B1D3D5AC8A9A49D422036C7DC59329D9ED0A946D7DA2FC7DD203F7F4DB0456233E4B9B51516F6B1C6F960113613CA0FA6A249EC33598E404B07A1E1788CF5EA4DBB9F9AE5E23E87CF5F4596A0DABDC7DAD22C8CC95D6340F571B3E6AC9E56F4DBBAB6DF2490B5655B9ABEC3B450C0298343329E61D783B4D57552A9745F3A5682470A5ADFC07BEA6558D6920DB0B26268CC889D7251DBC14545BE72BF6A792E1ED1D06D5BA752097F82D3016F359D3A6DA9A67C5D5E67159852432152C363ACA8689A6C4153BEBF164E5D201872E0B3C5520F43CACFB06BA39EA782A89569657ED5151B6F442082370D21CA5E3413F2E481916AA7B8798F74F2F5C22044493E0BB5407CE9576CE"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\taskhost.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\conhost.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
c:\users\Filip\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2013-09-14 14:49:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-09-14 12:49
.
Před spuštěním: Volných bajtů: 42 110 251 008
Po spuštění: Volných bajtů: 40 403 230 720
.
- - End Of File - - 8E854E706EA6C2FB649521CD3996711A
A36C5E4F47E84449FF07ED3517B43A31

[lafiman]

A zde jsou protokoly http://leteckaposta.cz/185882341

[MiliNess]

Ztím nic nemám. Vyexportuj ještě protokol Aplikace.

[lafiman]

Ten je tam taky

[Rudy]

Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Regnull::
[HKEY_USERS\S-1-5-21-49597417-1313772407-204172057-1000\Software\SecuROM\License information*]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Uložte na plochu jako CFscript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[MiliNess]

Asi to způsobuje program C:\Windows\System32\LVCOMSX.EXE
Nevím k čemu to to patří, kolega na to mrkne a eventuelně odstřelí.
(pravděpodobně je to něco od Logitechu - soft k myši, klávesnici a pod.)

[lafiman]

Ok díky tady je log z combofixu, ale stále to padá

ComboFix 13-09-13.03 - Filip 14.09.2013 18:20:41.2.4 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3326.2104 [GMT 2:00]
Spuštěný z: c:\users\Filip\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Filip\Desktop\CFscript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Outdated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Outdated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\cdcbs.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-14 do 2013-09-14 )))))))))))))))))))))))))))))))
.
.
2013-09-14 16:26 . 2013-09-14 16:28 -------- d-----w- c:\users\Filip\AppData\Local\temp
2013-09-14 16:26 . 2013-09-14 16:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-14 16:26 . 2013-09-14 16:26 82944 ----a-w- c:\programdata\ybcswx.exe
2013-08-22 22:50 . 2013-09-14 16:27 -------- d-----w- c:\program files\WinZipper
2013-08-22 22:50 . 2013-08-25 11:41 -------- d-----w- c:\users\Filip\AppData\Roaming\WinZipper
2013-08-22 22:43 . 2013-08-22 22:43 -------- d-----w- c:\users\Filip\AppData\Local\EA Games
2013-08-19 18:07 . 2013-09-14 12:24 -------- d-----w- c:\programdata\eSafe
2013-08-19 18:02 . 2013-08-19 18:02 -------- d-----w- c:\program files\Seznam.cz
2013-08-19 18:00 . 2013-09-14 12:49 -------- d-----w- c:\users\Filip\AppData\Roaming\Seznam.cz
2013-08-19 17:59 . 2013-08-19 17:59 -------- d-----w- c:\users\Filip\AppData\Local\SwvUpdater
2013-08-19 11:33 . 2013-08-19 11:41 -------- d-----w- c:\program files\trend micro
2013-08-19 11:33 . 2013-08-19 11:33 -------- d-----w- C:\rsit
2013-08-19 09:22 . 2013-08-19 09:22 -------- d-----w- c:\users\Filip\AppData\Local\ESN
2013-08-19 09:22 . 2013-08-19 09:22 -------- d-----w- c:\program files\Battlelog Web Plugins
2013-08-19 09:17 . 2013-08-19 09:25 -------- d-----w- c:\programdata\EA Logs
2013-08-19 07:15 . 2013-08-22 20:17 -------- d--h--w- c:\program files\Common Files\EAInstaller
2013-08-18 19:06 . 2013-08-18 19:06 -------- d-----w- c:\users\Filip\AppData\Local\Criterion Games
2013-08-18 13:22 . 2013-08-18 18:13 -------- d-----w- C:\AdwCleaner
2013-08-18 09:53 . 2013-08-18 09:53 -------- d-sh--w- c:\programdata\DSS
2013-08-17 22:43 . 2013-08-17 22:12 2601752 ----a-w- c:\windows\system32\pbsvc_moh.exe
2013-08-17 22:41 . 2013-08-17 22:41 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2013-08-17 18:42 . 2013-08-17 18:42 -------- d-----w- c:\programdata\Package Cache
2013-08-16 08:10 . 2013-08-16 08:10 -------- d-----w- c:\users\Filip\AppData\Local\Electronic Arts
2013-08-15 19:39 . 2013-08-18 18:04 -------- d-----w- c:\program files\Origin Games
2013-08-15 19:38 . 2013-08-16 20:18 -------- d-----w- c:\users\Filip\AppData\Roaming\Origin
2013-08-15 19:37 . 2013-08-15 19:43 -------- d-----w- c:\users\Filip\AppData\Local\Origin
2013-08-15 19:33 . 2013-08-22 22:43 -------- d-----w- c:\programdata\Origin
2013-08-15 19:33 . 2013-09-14 16:28 -------- d-----w- c:\program files\Origin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-20 20:38 . 2008-12-31 23:24 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2013-08-20 20:37 . 2008-12-31 23:17 17488 ----a-w- c:\windows\gdrv.sys
2013-08-19 09:26 . 2010-05-23 18:19 140072 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2013-08-19 09:26 . 2010-12-12 17:07 280904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2013-08-19 09:26 . 2010-05-23 18:18 280904 ----a-w- c:\windows\system32\PnkBstrB.exe
2013-08-19 09:24 . 2010-05-23 18:18 280904 ----a-w- c:\windows\system32\PnkBstrB.ex0
2013-08-19 07:15 . 2010-05-23 18:19 138056 ----a-w- c:\users\Filip\AppData\Roaming\PnkBstrK.sys
2013-08-19 07:14 . 2010-05-23 18:18 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2013-07-23 14:16 . 2013-01-20 12:07 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-07-23 14:16 . 2012-05-20 17:53 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"Steam"="c:\program files\Steam\steam.exe" [2013-08-28 1811880]
"EADM"="c:\program files\Origin\Origin.exe" [2013-08-29 3549528]
"cz.seznam.software.autoupdate"="c:\users\Filip\AppData\Roaming\Seznam.cz\szninstall.exe" [2013-05-16 1062472]
"cz.seznam.software.szndesktop"="c:\users\Filip\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" [2013-04-12 92664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-02-22 8522272]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"seznam-listicka-distribuce"="c:\program files\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
"ybcswx"="c:\programdata\ybcswx.exe" [2013-09-14 82944]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TP-LINK Wireless Configuration Utility.lnk - c:\program files\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe -nogui [2013-5-2 788992]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMD AVT]
start AMD Accelerated Video Transcoding device initialization [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-09-23 19:43 926896 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-02-20 20:28 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51 691656 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneVI]
2007-07-26 14:05 20480 ----a-w- c:\program files\GIGABYTE\ET6\ETcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-10-14 12:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
2005-06-08 13:44 196608 ----a-w- c:\program files\Logitech\Video\ManifestEngine.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
2005-06-08 14:24 458752 ----a-w- c:\program files\Logitech\Video\ISStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
2005-06-08 14:14 217088 ----a-w- c:\program files\Logitech\Video\LogiTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2012-08-29 10:03 1996200 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
2005-07-19 16:32 221184 ----a-w- c:\windows\System32\LVCOMSX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxtorOneTouch]
2003-05-21 14:30 45056 ----a-w- c:\progra~1\Maxtor\OneTouch\Utils\OneTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MXO Auto Loader]
2003-04-07 17:09 118784 ----a-w- c:\windows\MXOALDR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
2012-01-10 17:36 1083264 ----a-w- c:\program files\Nokia\Nokia Suite\NokiaSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2010-11-25 07:43 2781000 ----a-w- c:\program files\OO Software\Defrag\oodtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
2009-12-22 14:23 2647040 ----a-w- c:\program files\Anti-Vibrate Oscar Editor\OscarEditor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-18 19:56 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTuner]
2009-02-25 17:55 24576 ----a-w- c:\program files\RivaTuner v2.24\RivaTunerWrapper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2012-11-16 15:10 641704 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 08:04 252848 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-04-21 12:42 37888 ----a-w- c:\program files\Winamp\winampa.exe
.
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 30312]
R3 AODDriver;AODDriver;c:\program files\GIGABYTE\ET6\i386\AODDriver.sys [2009-02-22 7168]
R3 etdrv;etdrv;c:\windows\etdrv.sys [2013-01-13 17488]
R3 GVTDrv;GVTDrv;c:\windows\system32\Drivers\GVTDrv.sys [2013-08-20 24944]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-04-09 16472]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-04-09 11104]
R3 rt61x86;AirLive WT-2000PCI Driver for Windows Vista;c:\windows\system32\DRIVERS\netr61.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-11-16 217088]
R4 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-11-16 291840]
R4 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 1385896]
R4 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2011-12-12 751464]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-05-22 721904]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-03-05 45184]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-06-24 136120]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-04-28 96896]
S2 OODefragAgent;O&O Defrag Agent;c:\program files\OO Software\Defrag\oodag.exe [2010-11-25 2404168]
S2 winzipersvc;WinZiper service;c:\program files\WinZipper\winzipersvc.exe [2013-08-22 424104]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-02-23 86544]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-06 17:50 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.delta-homes.com/?utm_source=b&utm_m ... 1377211874
mStart Page = hxxp://www.delta-homes.com/?utm_source=b&utm_m ... 1377211874
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: {{807DF5E0-4EF7-48a8-A405-239F3E29FFA9} - {FE69C007-C452-4d3e-86D2-1730DF8BC871} -
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\www.etrading
Trusted Zone: mojebanka.cz\*
FF - ProfilePath - c:\users\Filip\AppData\Roaming\Mozilla\Firefox\Profiles\f8cjikd3.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\users\Filip\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2013-09-14 18:32:00 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-09-14 16:31
ComboFix2.txt 2013-09-14 12:49
.
Před spuštěním: Volných bajtů: 41 993 969 664
Po spuštění: Volných bajtů: 41 810 505 728
.
- - End Of File - - 8AAA30FC1DDF1D374791C2B586363BAE
A36C5E4F47E84449FF07ED3517B43A31

[Rudy]

Log je již OK. Ten proces, o kterém píše kolega, patří Logitech webkameře. Zkuste přeinstalovat její ovladač.