Problém s svchost.exe

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz


Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
patap
Návštěvník
Návštěvník
Příspěvky: 17
Registrován: 03 Srp 2008 12:34

Problém s svchost.exe

#1 Příspěvek od patap »

Ahoj, prosím zkuste se někdo podívat na můj log.
Mám problém s svchost.exe (100% zatížení). Další projev je ten, že se mi občas odpojí net a hlavně mi nefunguje zvuk - systémové zvuky jedou, ale např media player hlasí že nemůže najít zvukové zařízení, nebo na youtube jedou videa bez zvuku.
Předem dík! :)

Logfile of random's system information tool 1.08 (written by random/random)
Run by Premio at 2010-12-12 20:23:52
Microsoft Windows XP Home Edition Service Pack 3
System drive E: has 10 GB (14%) free of 76 GB
Total RAM: 1006 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:24:18, on 12.12.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\WLTRYSVC.EXE
E:\WINDOWS\System32\bcmwltry.exe
E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\igfxtray.exe
E:\WINDOWS\system32\hkcmd.exe
E:\WINDOWS\system32\igfxpers.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\PROGRA~1\QUANTA~1\QtEwLMng.EXE
E:\Program Files\Synaptics\SynTP\SynTPLpr.exe
E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
E:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
E:\WINDOWS\system32\WLTRAY.exe
E:\Program Files\Common Files\Java\Java Update\jusched.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\DAEMON Tools Lite\DTLite.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\WINDOWS\system32\NlsSrv32.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\system32\wbem\wmiapsrv.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\QIP\qip.exe
E:\Documents and Settings\Premio\Plocha\RSIT.exe
E:\Program Files\trend micro\Premio.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] E:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] E:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] E:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UIUCU] E:\DOCUME~1\Premio\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP
O4 - HKLM\..\Run: [QtEwLMng] E:\PROGRA~1\QUANTA~1\QtEwLMng.EXE
O4 - HKLM\..\Run: [SynTPLpr] E:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] E:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] E:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - E:\WINDOWS\system32\NlsSrv32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - E:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: (no name) - file:///E:/DOCUME~1/Premio/LOCALS~1/Temp/msohtml1/01/clip_image001.jpg

--
End of file - 5279 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - E:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-11-20 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-11-20 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"=E:\WINDOWS\system32\igfxtray.exe [2005-09-20 94208]
"igfxhkcmd"=E:\WINDOWS\system32\hkcmd.exe [2005-09-20 77824]
"igfxpers"=E:\WINDOWS\system32\igfxpers.exe [2005-09-20 114688]
"SoundMan"=E:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"UIUCU"=E:\DOCUME~1\Premio\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP []
"QtEwLMng"=E:\PROGRA~1\QUANTA~1\QtEwLMng.EXE [2010-01-29 196608]
"SynTPLpr"=E:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2010-01-29 126976]
"SynTPEnh"=E:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-01-29 561152]
"Adobe Reader Speed Launcher"=E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"avast5"=E:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-09-07 2838912]
"Broadcom Wireless Manager UI"=E:\WINDOWS\system32\WLTRAY.exe [2005-11-12 1236992]
"SunJavaUpdateSched"=E:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=E:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"DAEMON Tools Lite"=E:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
E:\WINDOWS\system32\igfxdev.dll [2005-09-20 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\Valve\hl.exe"="E:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"E:\Program Files\Valve_net\hl.exe"="E:\Program Files\Valve_net\hl.exe:*:Enabled:Half-Life Launcher"
"E:\Program Files\VDOWNLOADER\VDownloader.exe"="E:\Program Files\VDOWNLOADER\VDownloader.exe:*:Enabled:VDownloader"
"E:\Program Files\TmNationsForever\TmForever.exe"="E:\Program Files\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"E:\Program Files\Soldat\Soldat.exe"="E:\Program Files\Soldat\Soldat.exe:*:Enabled:http://soldat.pl"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"E:\Program Files\uTorrent\uTorrent.exe"="E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"E:\Program Files\worms2\frontend.exe"="E:\Program Files\worms2\frontend.exe:*:Enabled:Worms 2 Frontend"
"E:\Documents and Settings\Premio\Plocha\bulanci.exe"="E:\Documents and Settings\Premio\Plocha\bulanci.exe:*:Enabled:bulanci"
"E:\old\w\Worms Armagedon\wa.exe"="E:\old\w\Worms Armagedon\wa.exe:*:Disabled:Worms Armageddon"
"E:\Program Files\Worms Armageddon - New Edition\WA.exe"="E:\Program Files\Worms Armageddon - New Edition\WA.exe:*:Enabled:Worms Armageddon"
"E:\Program Files\Totalcmd 6\TOTALCMD.EXE"="E:\Program Files\Totalcmd 6\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-12-12 20:23:53 ----D---- E:\Program Files\trend micro
2010-12-12 20:23:52 ----D---- E:\rsit
2010-12-06 16:02:11 ----SHD---- E:\Config.Msi
2010-12-06 15:38:40 ----A---- E:\WINDOWS\system32\muweb.dll
2010-12-06 15:38:40 ----A---- E:\WINDOWS\system32\mucltui.dll.mui
2010-12-06 15:38:40 ----A---- E:\WINDOWS\system32\mucltui.dll
2010-12-06 15:24:48 ----D---- E:\Program Files\aTube Catcher
2010-11-30 20:13:11 ----D---- E:\Program Files\Microsoft Silverlight
2010-11-26 18:59:55 ----A---- E:\WINDOWS\system32\javaws.exe
2010-11-26 18:59:55 ----A---- E:\WINDOWS\system32\javaw.exe
2010-11-26 18:59:55 ----A---- E:\WINDOWS\system32\java.exe

======List of files/folders modified in the last 1 months======

2010-12-12 20:23:53 ----RD---- E:\Program Files
2010-12-12 20:23:46 ----D---- E:\WINDOWS\Prefetch
2010-12-12 20:18:40 ----A---- E:\WINDOWS\WINCMD.INI
2010-12-12 20:18:01 ----D---- E:\WINDOWS\system32
2010-12-12 20:15:57 ----A---- E:\WINDOWS\SchedLgU.Txt
2010-12-12 20:14:55 ----HD---- E:\WINDOWS\inf
2010-12-12 20:14:48 ----D---- E:\WINDOWS\system32\CatRoot2
2010-12-12 20:14:44 ----D---- E:\WINDOWS\Temp
2010-12-12 20:14:43 ----AD---- E:\WINDOWS
2010-12-12 12:49:52 ----D---- E:\Program Files\Mozilla Firefox
2010-12-06 16:07:36 ----SHD---- E:\WINDOWS\Installer
2010-12-06 16:05:56 ----RSD---- E:\WINDOWS\assembly
2010-12-06 16:05:26 ----A---- E:\WINDOWS\win.ini
2010-12-06 16:04:06 ----RSD---- E:\WINDOWS\Fonts
2010-12-06 16:03:13 ----D---- E:\Program Files\Common Files\Microsoft Shared
2010-12-06 15:29:21 ----D---- E:\WINDOWS\SoftwareDistribution
2010-11-30 21:22:52 ----D---- E:\Program Files\Quanta Manager
2010-11-30 20:13:26 ----SD---- E:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-11-26 18:59:51 ----D---- E:\Program Files\Java
2010-11-20 17:28:29 ----A---- E:\WINDOWS\system32\MRT.exe
2010-11-20 16:07:17 ----A---- E:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; E:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 sptd;sptd; E:\WINDOWS\System32\Drivers\sptd.sys [2010-01-31 691696]
R1 Aavmker4;avast! Asynchronous Virus Monitor; E:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 aswSP;aswSP; E:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; E:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 intelppm;Řadič procesoru Intel; E:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 aswFsBlk;aswFsBlk; E:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMon2;avast! Standard Shield Support; E:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
R2 mdmxsdk;mdmxsdk; E:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2010-01-29 11044]
R2 StreamDispatcher;StreamDispatcher; E:\WINDOWS\system32\DRIVERS\strmdisp.sys [2010-01-29 22656]
R3 Arp1394;Protokol 1394 ARP Client; E:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 aswRdr;aswRdr; E:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; E:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2005-11-02 424320]
R3 CAMCAUD;Conexant AMC Audio; E:\WINDOWS\system32\drivers\camcaud.sys [2010-01-29 33408]
R3 CAMCHALA;CAMCHALA; E:\WINDOWS\system32\drivers\camchal.sys [2010-01-29 273536]
R3 DKbFltr;Dritek HotKey Keyboard Filter Driver; E:\WINDOWS\System32\Drivers\DKbFltr.sys [2010-01-29 16256]
R3 HidUsb;Ovladač třídy standardu HID; E:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DP;HSF_DP; E:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2010-01-29 1107200]
R3 HSFHWICH;HSFHWICH; E:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2010-01-29 165504]
R3 ialm;ialm; E:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-09-20 1302332]
R3 mouhid;Ovladač myši standardu HID; E:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; E:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; E:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 SynTP;Synaptics TouchPad Driver; E:\WINDOWS\system32\DRIVERS\SynTP.sys [2010-01-29 263536]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; E:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; E:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2010-01-29 622848]
S1 kbdhid;Ovladač klávesnice standardu HID; E:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 aj2t0qyh;aj2t0qyh; E:\WINDOWS\system32\drivers\aj2t0qyh.sys []
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); E:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-04-25 4030144]
S3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\E:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; E:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;Ovladač skeneru USB; E:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; E:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; E:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; E:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 JavaQuickStarterService;Java Quick Starter; E:\Program Files\Java\jre6\bin\jqs.exe [2010-09-15 153376]
R2 nlsX86cc;Nalpeiron Licensing Service; E:\WINDOWS\system32\NlsSrv32.exe [2009-06-07 61440]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; E:\WINDOWS\System32\WLTRYSVC.EXE [2005-11-12 18944]
R3 avast! Mail Scanner;avast! Mail Scanner; E:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; E:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 aspnet_state;Stavová služba ASP.NET; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; e:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; e:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; E:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; E:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; e:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Avatar uživatele
JaRon
Moderátor
Moderátor
Příspěvky: 15933
Registrován: 29 Bře 2005 13:39
Místo/Bydliště: BB-SK

Re: Problém s svchost.exe

#2 Příspěvek od JaRon »

ahoj
stiahni a uloz na plochu ComboFix

potom spust pod uctom s administratorskym opravnenim


akcia trva cca. 5-10 minut, niekedy i dlhsie -, Pocas scanu nespustaj ziadne ine aplikacie

Nie je dovod na paniku ak stroj bude restartovany
upozornenie: ak pouzivas antispyware s rezidentnim stitem, ten pred scanom vypni.

po restarte aplikacie vytvori log, ulozeny na C:\Combofix.txt (jeho obsah vloz sem)
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum
https://platba.viry.cz/payment/

patap
Návštěvník
Návštěvník
Příspěvky: 17
Registrován: 03 Srp 2008 12:34

Re: Problém s svchost.exe

#3 Příspěvek od patap »

ComboFix 10-12-12.03 - Premio 12.12.2010 20:34:17.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1006.661 [GMT 1:00]
Spuštěný z: e:\documents and settings\Premio\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-11-12 do 2010-12-12 )))))))))))))))))))))))))))))))
.

2010-12-12 19:23 . 2010-12-12 19:24 -------- d-----w- e:\program files\trend micro
2010-12-12 19:23 . 2010-12-12 19:24 -------- d-----w- E:\rsit
2010-12-12 19:18 . 2010-12-12 19:18 -------- d-----w- e:\documents and settings\Premio\Local Settings\Data aplikací\QuickStores
2010-12-06 14:38 . 2009-08-06 18:23 274288 ----a-w- e:\windows\system32\mucltui.dll
2010-12-06 14:38 . 2009-08-06 18:23 215920 ----a-w- e:\windows\system32\muweb.dll
2010-12-06 14:24 . 2010-12-12 19:17 -------- d-----w- e:\program files\aTube Catcher
2010-11-30 19:13 . 2010-11-30 19:13 -------- d-----w- e:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 10:23 . 2004-08-18 12:00 974848 ----a-w- e:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-18 12:00 974848 ----a-w- e:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-18 12:00 954368 ----a-w- e:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-18 12:00 953856 ----a-w- e:\windows\system32\mfc40u.dll
2010-09-15 03:50 . 2010-07-12 20:08 472808 ----a-w- e:\windows\system32\deployJava1.dll
2010-09-15 01:29 . 2010-03-23 00:41 73728 ----a-w- e:\windows\system32\javacpl.cpl
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="e:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="e:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="e:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="e:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"QtEwLMng"="e:\progra~1\QUANTA~1\QtEwLMng.EXE" [2010-01-29 196608]
"SynTPLpr"="e:\program files\Synaptics\SynTP\SynTPLpr.exe" [2010-01-29 126976]
"SynTPEnh"="e:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-01-29 561152]
"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="e:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avast5"="e:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"Broadcom Wireless Manager UI"="e:\windows\system32\WLTRAY.exe" [2005-11-12 1236992]
"SunJavaUpdateSched"="e:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Valve\\hl.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Program Files\\Valve_net\\hl.exe"=
"e:\\Program Files\\Soldat\\Soldat.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"e:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Documents and Settings\\Premio\\Plocha\\bulanci.exe"=
"e:\\old\\w\\Worms Armagedon\\wa.exe"=
"e:\\Program Files\\Worms Armageddon - New Edition\\WA.exe"=
"e:\\Program Files\\Totalcmd 6\\TOTALCMD.EXE"=

R0 sptd;sptd;e:\windows\system32\drivers\sptd.sys [31.1.2010 11:50 691696]
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [28.1.2010 18:51 165584]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [28.1.2010 18:51 17744]
R2 nlsX86cc;Nalpeiron Licensing Service;e:\windows\system32\NlsSrv32.exe [23.3.2010 13:50 61440]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;e:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [28.1.2010 19:24 26736]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - e:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - e:\documents and settings\Premio\Data aplikací\Mozilla\Firefox\Profiles\gvd0gv5q.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - e:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - e:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - e:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - e:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - e:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - e:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - e:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - e:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-12 20:38
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


e:\docume~1\Premio\LOCALS~1\Temp\pic8245.gif 3978 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\EverestDriver]
"ImagePath"="\??\e:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(720)
e:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(3848)
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-12-12 20:41:11
ComboFix-quarantined-files.txt 2010-12-12 19:40

Před spuštěním: Volných bajtů: 10 745 274 368
Po spuštění: Volných bajtů: 11 499 155 456

Current=6 Default=6 Failed=5 LastKnownGood=2 Sets=1,2,3,4,5,6
- - End Of File - - 6455B7CF2A624E49B6005C88933CE6C2

Avatar uživatele
JaRon
Moderátor
Moderátor
Příspěvky: 15933
Registrován: 29 Bře 2005 13:39
Místo/Bydliště: BB-SK

Re: Problém s svchost.exe

#4 Příspěvek od JaRon »

prescanuj PC s AVPTool
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum
https://platba.viry.cz/payment/

Odpovědět