Problém s virem

[KAREL.CZ]

Zdravím. Jak začít. Dneska mi volali z helpdesl čsob že prý mám v PC vir který umí načís moje přihlačovací údaje pro intenetové bakovnictví dost nemilé. Jaké ksou možnosti:1. přeinstalovat celé PC
2. vyřešit to tu s vaší pomocí. 3. čsob mi nabýdlo odkup PC stím že mi zajistí jiné aby toto mohli prozkoumat. Ta první možnost je dost radikální a vzhledem k tomu že jsem přeinstalaci dělal celkem nedávno a hlavně tím nezjistím kde jsem ten problém nabral. Takže co mi poradíte pro jistotu zasílám log. Předem děkuji za rady.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Karel at 2013-10-07 15:43:22
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 865 GB (91%) free of 954 GB
Total RAM: 3198 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:43:24, on 7.10.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16686)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\DAODx.exe
C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Users\Karel\AppData\Roaming\Seznam.cz\szninstall.exe
C:\Users\Karel\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
C:\Users\Karel\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mumble\mumble.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
C:\Users\Karel\Desktop\RSIT.exe
C:\Program Files\trend micro\Karel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/?clid=13415
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\Karel\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Karel\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\Run: [AppsHat] C:\Users\Karel\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: PandoraService (PanService) - Pandora.TV - C:\Program Files\PANDORA.TV\PanService\KMPService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 4120 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Karel\AppData\Roaming\Mozilla\Firefox\Profiles\0ae98g9e.default

prefs.js - "browser.search.useDBForOrder" - "false"
prefs.js - "browser.startup.homepage" - "http://www.google.cz/"

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.8.800.168 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


C:\Users\Karel\AppData\Roaming\Mozilla\Firefox\Profiles\0ae98g9e.default\extensions\
WebSiteRecommendation@weliketheweb.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-08-30 201784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-08-30 201784]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"=C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2010-04-27 113288]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-09-30 98304]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2013-08-30 4858968]
"seznam-listicka-distribuce"=C:\Program Files\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2013-07-03 3673184]
"cz.seznam.software.autoupdate"=C:\Users\Karel\AppData\Roaming\Seznam.cz\szninstall.exe [2013-05-16 1062472]
"cz.seznam.software.szndesktop"=C:\Users\Karel\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2013-04-12 92664]
"AppsHat"=C:\Users\Karel\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe [2012-10-26 202752]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"VIDC.XVID"=xvidvfw.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"VIDC.FFDS"=ff_vfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2013-10-04 16:46:32 ----D---- C:\Program Files\SMPlayer
2013-10-04 15:12:58 ----D---- C:\ProgramData\TEMP
2013-10-04 15:08:08 ----D---- C:\Program Files\SimilarSites
2013-10-04 15:08:03 ----D---- C:\Users\Karel\AppData\Roaming\SimilarSites
2013-10-04 15:07:48 ----D---- C:\Program Files\Optimizer Pro
2013-10-04 15:07:27 ----D---- C:\Users\Karel\AppData\Roaming\Babylon
2013-10-04 15:07:27 ----D---- C:\ProgramData\Babylon
2013-10-04 15:07:10 ----D---- C:\Program Files\PANDORA.TV
2013-10-04 15:06:53 ----D---- C:\Users\Karel\AppData\Roaming\OpenCandy
2013-09-30 11:13:41 ----RSH---- C:\ProgramData\E177B642D3.sys
2013-09-30 11:13:41 ----ASH---- C:\ProgramData\KGyGaAvL.sys
2013-09-30 11:13:40 ----D---- C:\Users\Karel\AppData\Roaming\Corel
2013-09-30 11:12:24 ----D---- C:\ProgramData\Corel
2013-09-30 11:12:24 ----D---- C:\Program Files\Common Files\Protexis
2013-09-30 11:10:58 ----D---- C:\Program Files\Common Files\Corel
2013-09-30 11:10:39 ----D---- C:\Program Files\Corel
2013-09-30 10:56:56 ----D---- C:\PROGRAM1
2013-09-29 17:49:07 ----D---- C:\Users\Karel\AppData\Roaming\Mozilla
2013-09-29 17:49:00 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-09-29 17:41:06 ----D---- C:\Program Files\MozBackup
2013-09-29 12:04:30 ----D---- C:\Users\Karel\AppData\Roaming\SUPERAntiSpyware.com
2013-09-28 23:42:33 ----A---- C:\ComboFix.txt
2013-09-28 23:40:58 ----D---- C:\$RECYCLE.BIN
2013-09-28 22:19:18 ----A---- C:\Windows\zip.exe
2013-09-28 22:19:18 ----A---- C:\Windows\SWSC.exe
2013-09-28 22:19:18 ----A---- C:\Windows\SWREG.exe
2013-09-28 22:19:18 ----A---- C:\Windows\sed.exe
2013-09-28 22:19:18 ----A---- C:\Windows\PEV.exe
2013-09-28 22:19:18 ----A---- C:\Windows\NIRCMD.exe
2013-09-28 22:19:18 ----A---- C:\Windows\MBR.exe
2013-09-28 22:19:18 ----A---- C:\Windows\grep.exe
2013-09-28 22:19:13 ----D---- C:\Qoobox
2013-09-28 22:19:01 ----D---- C:\Windows\erdnt
2013-09-27 22:25:45 ----D---- C:\_OTL
2013-09-27 19:33:41 ----D---- C:\Program Files\trend micro
2013-09-27 19:33:40 ----D---- C:\rsit
2013-09-19 17:07:58 ----D---- C:\Users\Karel\AppData\Roaming\Mumble
2013-09-19 17:06:35 ----D---- C:\Program Files\Mumble
2013-09-12 13:20:13 ----A---- C:\Windows\system32\D3DX9_40.dll
2013-09-12 13:20:13 ----A---- C:\Windows\system32\d3dx10_40.dll
2013-09-12 13:20:13 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2013-09-12 13:06:09 ----D---- C:\Program Files\Atari
2013-09-12 12:41:37 ----D---- C:\HRY
2013-09-12 12:37:18 ----D---- C:\Program Files\Seznam.cz
2013-09-12 12:37:06 ----D---- C:\Users\Karel\AppData\Roaming\Seznam.cz
2013-09-12 12:35:44 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2013-09-12 12:35:42 ----D---- C:\Users\Karel\AppData\Roaming\DAEMON Tools Lite
2013-09-12 12:35:40 ----D---- C:\Program Files\DAEMON Tools Lite
2013-09-12 12:35:03 ----D---- C:\ProgramData\DAEMON Tools Lite
2013-09-12 12:28:31 ----D---- C:\Program Files\Elaborate Bytes
2013-09-12 12:20:17 ----A---- C:\Windows\system32\WNASPI32.DLL
2013-09-12 12:20:17 ----A---- C:\Windows\system32\drivers\ASPI32.SYS
2013-09-12 12:00:14 ----A---- C:\Windows\system32\drivers\sptd.sys
2013-09-12 09:24:09 ----D---- C:\Games
2013-09-11 14:42:48 ----A---- C:\Windows\system32\jscript.dll
2013-09-11 14:42:47 ----A---- C:\Windows\system32\jsproxy.dll
2013-09-11 14:42:47 ----A---- C:\Windows\system32\jscript9.dll
2013-09-11 14:42:47 ----A---- C:\Windows\system32\iesetup.dll
2013-09-11 14:42:46 ----A---- C:\Windows\system32\ieui.dll
2013-09-11 14:42:42 ----A---- C:\Windows\system32\urlmon.dll
2013-09-11 14:42:42 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-11 14:42:42 ----A---- C:\Windows\system32\msfeeds.dll
2013-09-11 14:42:42 ----A---- C:\Windows\system32\iesysprep.dll
2013-09-11 14:42:42 ----A---- C:\Windows\system32\iernonce.dll
2013-09-11 14:42:42 ----A---- C:\Windows\system32\ie4uinit.exe
2013-09-11 14:42:41 ----A---- C:\Windows\system32\iertutil.dll
2013-09-11 14:42:40 ----A---- C:\Windows\system32\wininet.dll
2013-09-11 14:42:39 ----A---- C:\Windows\system32\ieframe.dll
2013-09-11 14:42:37 ----A---- C:\Windows\system32\mshtml.dll
2013-09-11 12:25:33 ----A---- C:\Windows\system32\shell32.dll
2013-09-11 12:25:33 ----A---- C:\Windows\system32\shdocvw.dll
2013-09-11 12:25:32 ----A---- C:\Windows\system32\drivers\ataport.sys
2013-09-11 12:25:31 ----A---- C:\Windows\system32\win32k.sys
2013-09-11 12:25:30 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 12:25:30 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 12:25:30 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 12:25:30 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 12:25:30 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 12:25:30 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 12:25:30 ----A---- C:\Windows\system32\winsrv.dll
2013-09-11 12:25:30 ----A---- C:\Windows\system32\KernelBase.dll
2013-09-11 12:25:30 ----A---- C:\Windows\system32\kernel32.dll
2013-09-11 12:25:30 ----A---- C:\Windows\system32\conhost.exe
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 12:25:29 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 12:25:28 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 12:25:28 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 12:25:28 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

======List of files/folders modified in the last 1 month======

2013-10-07 15:43:24 ----D---- C:\Windows\Prefetch
2013-10-07 15:43:23 ----D---- C:\Windows\Temp
2013-10-07 15:41:24 ----D---- C:\Windows\Minidump
2013-10-07 15:41:20 ----D---- C:\Windows
2013-10-07 13:57:06 ----D---- C:\Windows\LiveKernelReports
2013-10-07 12:39:15 ----D---- C:\Windows\System32
2013-10-07 12:39:15 ----D---- C:\Windows\inf
2013-10-07 12:39:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-10-07 07:21:15 ----D---- C:\Windows\system32\config
2013-10-05 23:27:23 ----D---- C:\FILM
2013-10-04 17:24:42 ----D---- C:\Windows\system32\Tasks
2013-10-04 17:24:41 ----D---- C:\Windows\Tasks
2013-10-04 17:24:41 ----D---- C:\Program Files\Google
2013-10-04 17:23:44 ----RD---- C:\Program Files
2013-10-04 17:23:19 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-10-04 15:12:58 ----D---- C:\ProgramData
2013-10-01 09:32:28 ----SHD---- C:\System Volume Information
2013-09-30 11:20:05 ----D---- C:\Windows\system32\LogFiles
2013-09-30 11:12:56 ----SHD---- C:\Windows\Installer
2013-09-30 11:12:31 ----D---- C:\Program Files\Common Files\microsoft shared
2013-09-30 11:12:24 ----D---- C:\Program Files\Common Files
2013-09-30 11:11:39 ----RSD---- C:\Windows\Fonts
2013-09-30 11:11:34 ----D---- C:\Windows\winsxs
2013-09-29 21:13:05 ----D---- C:\Users\Karel\AppData\Roaming\TS3Client
2013-09-29 17:48:59 ----D---- C:\Program Files\Mozilla Firefox
2013-09-29 00:08:11 ----D---- C:\Windows\system32\drivers
2013-09-28 23:41:01 ----A---- C:\Windows\system.ini
2013-09-28 23:40:56 ----D---- C:\Windows\system32\drivers\etc
2013-09-28 23:37:36 ----D---- C:\Windows\AppPatch
2013-09-27 20:05:48 ----D---- C:\Windows\Logs
2013-09-14 01:16:32 ----D---- C:\Windows\system32\catroot2
2013-09-14 00:12:49 ----D---- C:\Windows\system32\directx
2013-09-12 13:20:05 ----RSD---- C:\Windows\assembly
2013-09-12 12:35:53 ----D---- C:\Windows\system32\catroot
2013-09-12 12:35:52 ----D---- C:\Windows\system32\DriverStore
2013-09-11 20:58:00 ----D---- C:\Windows\rescache
2013-09-11 20:00:37 ----D---- C:\Windows\Microsoft.NET
2013-09-11 17:22:16 ----D---- C:\Program Files\Internet Explorer
2013-09-11 17:22:14 ----D---- C:\Windows\system32\cs-CZ
2013-09-11 14:42:17 ----D---- C:\Windows\system32\MRT
2013-09-11 14:41:24 ----A---- C:\Windows\system32\MRT.exe
2013-09-11 09:16:51 ----SD---- C:\ProgramData\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2013-08-30 49376]
R0 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2013-08-30 177864]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2013-08-30 61680]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2013-08-30 770344]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2013-08-30 369584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2013-08-30 56080]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-09-12 243128]
R2 Aspi32;Aspi32; C:\Windows\System32\drivers\aspi32.sys [2002-07-17 16877]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2013-08-30 29816]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2013-08-30 66336]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-09-29 6472192]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-09-29 228352]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW73.sys [2010-08-16 101904]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 13216]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 64904]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 146568]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2010-05-31 267880]
S0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-09-12 643072]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Karel\AppData\Local\Temp\catchme.sys []
S3 CFcatchme;CFcatchme; \??\C:\Users\Karel\AppData\Local\Temp\CFcatchme.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2013-03-11 30208]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2010-03-09 2116480]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-09-29 176128]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-08-30 46808]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 PanService;PandoraService; C:\Program Files\PANDORA.TV\PanService\KMPService.exe [2013-07-08 1922600]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-09-11 118680]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-08-07 1343400]

-----------------EOF-----------------

[Rudy]

Zdravím!
Jste si opravdu jist, že vám volala ČSOB? Nějak se mi nelíbí nabídka toho odkupu. Udělejte sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 a dejte log. Tato akce je na delší čas, záleží na velikosti disku.

[KAREL.CZ]

To čsob asi nelže byl jsem u nás na pobočse a tam mi potvrdili že ta pracovnice u nich pracuje tada na tý lince help.

[Rudy]

Dejme tomu. Nějak nechápu, co by dělala banka se zavirovaným PC. Udělejte ten sken.

[KAREL.CZ]

Tak jsem provedl ten scan AVP Tool ale žadnej jog mi to nevitvořilo. Psalo to no detekt jako by to nic nenaslo pro jistotu jsem to delal dvakrát se stejným výsledkem všeč jsem dělal dle návodu.

[Rudy]

Pak v PC virus nemáte. AVP je téměř stoprocentní skener.

[KAREL.CZ]

Todle našel ESET online scanner

C:\Users\Karel\AppData\Local\temp\5FBF8E6E-BAB0-7891-BBFC-9EAE55B3BC34\Latest\Optimizer.exe varianta infiltrace Win32/SpeedingUpMyPC.B aplikace vylé?en smazáním - ulo?en do karantény

[Rudy]

Tak vám ho smazal. Když myslíte, že online skener je lepší, než AVP, pak OK. Jen, abyste ho nepotřeboval.

[KAREL.CZ]

To si nemyslím to AVP jsem použl jak bylo doporučeno ten ESET jsem použl až dnes spíše jen ze zvědavosti, ale pokud tam nic nemám tak jsem rád a děkuji za pomoc, pokud mám ještě něco udělat stačí říct vždy se řídím radama které tu dostávám.

[Rudy]

Nic by tam nemělo být. Už párkrát jsem zažil to, že jeden AV označil soubor za virus, další ne a nakonec to virus nebyl. V tomhle případě si opravdu nejsem jist, zda to virus je, nebo ne. Různé optimizéry, mazací utility, jednoúčelové antivirové skenery některé AV označují za vir, jiné ne. Dokonce utilitu OTM mi nějaký AV označil za vir a my ji tu zcela běžně a bez problémů používáme.