pravdepodobne vir, ktery zpusobuje BSOD

[achiles]

zdravim, se zavirovanymi PC si vetsinou poradim, nicmene se mi dostal jeden do rukou s kterym si hraju uz celej den a porad na to nemuzu prijit.

pocitac (w7) zacal vyhazovat po nalogovani uzivatele chybu "An error has occurred in the program. Try to Open it again. If this problem continues, you'll need to reinstall Microsoft Security Client" a nasledne skocila BSOD. v nouzovem rezimu jsem vypnul vse podezrele po startu a v normalnim rezimu odinstaloval nektere podivne programy. V registrech taky nejaka potvurka casto zanechava v run klici prikaz "shutdown -f -r -t 0". Projel jsem program MBAMem (ten nekolik potvurek objevil) a ESETem (take neco nasel), ale porad tam podle me neco je. Pocitac stale hazi BSOD (vetsinou po nalogovani PC), proto jsem se rozhodnul analizovat minidump. Pri instalaci .NET framework 4 ovsem pravidelne nastava BSOD, takze bez nej asi winsdk nespustim... Nefunguje stranka windows update a aktualizace skrz windows nedokaze nainstalovat update na .NET. Projel jsem i pamet pres memtest, ale je v poradku. Prosim poradte...

posilam log z RSITu

Logfile of random's system information tool 1.08 (written by random/random)
Run by Martin at 2011-01-30 18:01:45
Microsoft Windows 7 Ultimate
System drive C: has 63 GB (21%) free of 305 GB
Total RAM: 2046 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:01:47, on 30.1.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Kerio\VPN Client\kvpncgui.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Martin\Downloads\hijackthis(3).exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\Martin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Kerio VPN Client] "C:\Program Files (x86)\Kerio\VPN Client\kvpncgui.exe" /tray
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Kerio VPN Client Service (KVPNCSvc) - Kerio Technologies Inc. - C:\Program Files (x86)\Kerio\VPN Client\kvpncsvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7318 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files (x86)\Kerio\VPN Client\kvpncsvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe"
"C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe" /watchfiles startup
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"C:\Program Files (x86)\Kerio\VPN Client\kvpncgui.exe" /tray
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe" -Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Users\Martin\Downloads\hijackthis(3).exe"
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Martin\Desktop\hijackthis.log
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=1128.9451040.279975 "C:\Windows\system32\Macromed\Flash\NPSWF32.dll" 1128 plugin \\.\pipe\gecko-crash-server-pipe.1128
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\Martin\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3560697966-1128753602-1030856183-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3560697966-1128753602-1030856183-1000UA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3560697966-1128753602-1030856183-1002Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3560697966-1128753602-1030856183-1002UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-12-01 382720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-04-03 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll [2011-01-20 1581376]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll [2011-01-20 988480]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-01-12 2918656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
c:\Program Files\Microsoft Security Essentials\msseces.exe -hide -runkey []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"=C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2010-02-15 417792]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
"Kerio VPN Client"=C:\Program Files (x86)\Kerio\VPN Client\kvpncgui.exe [2010-07-18 5293928]
""= []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-01-30 18:01:45 ----D---- C:\rsit
2011-01-30 18:01:45 ----D---- C:\Program Files\trend micro
2011-01-30 17:39:53 ----D---- C:\2acc28f80a30c92967773e
2011-01-30 17:38:29 ----D---- C:\fbb8889be2f0044ba2bef0c6
2011-01-30 15:27:32 ----D---- C:\Users\Martin\AppData\Roaming\ESET
2011-01-30 15:26:32 ----D---- C:\ProgramData\ESET
2011-01-30 15:26:32 ----D---- C:\Program Files\ESET
2011-01-30 14:06:06 ----SHD---- C:\Config.Msi
2011-01-30 13:05:27 ----A---- C:\Windows\ntbtlog.txt
2011-01-30 12:49:33 ----D---- C:\Program Files (x86)\VS Revo Group
2011-01-30 11:54:01 ----A---- C:\Windows\SYSWOW64\drivers\mbamswissarmy.sys
2011-01-30 11:53:57 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-01-29 21:14:37 ----D---- C:\Program Files (x86)\Revo Uninstaller
2011-01-29 21:13:11 ----D---- C:\Program Files\CCleaner
2011-01-29 21:02:56 ----D---- C:\ProgramData\Kaspersky Lab ZAO
2011-01-29 20:57:29 ----D---- C:\ProgramData\Kaspersky Lab Setup Files
2011-01-29 18:44:57 ----D---- C:\Users\Martin\AppData\Roaming\Malwarebytes
2011-01-29 18:44:52 ----D---- C:\ProgramData\Malwarebytes
2011-01-29 18:44:49 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-01-28 18:00:55 ----D---- C:\Users\Martin\AppData\Roaming\Real
2011-01-26 14:49:17 ----D---- C:\ProgramData\Alwil Software
2011-01-26 14:41:36 ----D---- C:\Program Files (x86)\Microsoft Security Client
2011-01-26 14:41:20 ----D---- C:\Windows\Temp7442F134-26C4-7F3F-7D9E-1443FA36E18C-Signatures
2011-01-24 10:12:34 ----A---- C:\autoexec.bat
2011-01-24 10:12:12 ----D---- C:\Program Files (x86)\Enigma Software Group
2011-01-24 10:11:20 ----D---- C:\Windows\41EBC322660F4D16A0DF53147210CBDB.TMP
2011-01-23 21:31:39 ----D---- C:\Program Files (x86)\Call of Duty Modern Warfare 2
2011-01-23 18:43:37 ----D---- C:\Windows\Minidump
2011-01-23 16:36:24 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2011-01-23 16:35:51 ----D---- C:\Program Files (x86)\DAEMON Tools Toolbar
2011-01-23 16:35:45 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2011-01-23 13:25:56 ----A---- C:\Windows\window-title-changer.INI
2011-01-12 14:03:43 ----A---- C:\Windows\system32\d3d10warp.dll
2011-01-12 14:03:42 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2011-01-12 14:03:42 ----A---- C:\Windows\SYSWOW64\d2d1.dll
2011-01-12 14:03:42 ----A---- C:\Windows\system32\d2d1.dll
2011-01-12 14:03:41 ----A---- C:\Windows\system32\WMVDECOD.DLL
2011-01-12 14:03:41 ----A---- C:\Windows\system32\DWrite.dll
2011-01-12 14:03:40 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2011-01-12 14:03:40 ----A---- C:\Windows\system32\XpsPrint.dll
2011-01-12 14:03:40 ----A---- C:\Windows\system32\mf.dll
2011-01-12 14:03:39 ----A---- C:\Windows\SYSWOW64\mf.dll
2011-01-12 14:03:39 ----A---- C:\Windows\system32\FntCache.dll
2011-01-12 14:03:38 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2011-01-12 14:03:37 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-01-12 14:03:36 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2011-01-12 14:03:36 ----A---- C:\Windows\system32\ExplorerFrame.dll
2011-01-12 14:03:36 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-01-12 14:03:36 ----A---- C:\Windows\system32\d3d10_1core.dll
2011-01-12 14:03:35 ----A---- C:\Windows\SYSWOW64\WMVDECOD.DLL
2011-01-12 14:03:35 ----A---- C:\Windows\SYSWOW64\mfreadwrite.dll
2011-01-12 14:03:35 ----A---- C:\Windows\SYSWOW64\d3d10_1core.dll
2011-01-12 14:03:35 ----A---- C:\Windows\system32\mfreadwrite.dll
2011-01-12 14:03:34 ----A---- C:\Windows\SYSWOW64\XpsRasterService.dll
2011-01-12 14:03:34 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2011-01-12 14:03:34 ----A---- C:\Windows\system32\XpsRasterService.dll
2011-01-12 14:03:34 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2011-01-12 14:03:33 ----A---- C:\Windows\SYSWOW64\d3d10_1.dll
2011-01-12 14:03:33 ----A---- C:\Windows\system32\mfps.dll
2011-01-12 14:03:33 ----A---- C:\Windows\system32\d3d10_1.dll
2011-01-12 14:03:33 ----A---- C:\Windows\system32\cdd.dll
2011-01-12 14:03:24 ----A---- C:\Windows\SYSWOW64\odbc32.dll
2011-01-12 14:03:24 ----A---- C:\Windows\system32\odbc32.dll

======List of files/folders modified in the last 1 months======

2011-01-30 18:01:48 ----D---- C:\Windows\Temp
2011-01-30 18:01:45 ----RD---- C:\Program Files
2011-01-30 17:53:27 ----D---- C:\Windows\system32\Tasks
2011-01-30 17:45:02 ----SHD---- C:\Windows\Installer
2011-01-30 17:40:40 ----D---- C:\Windows
2011-01-30 17:35:50 ----D---- C:\Windows\system32\config
2011-01-30 17:21:12 ----SHD---- C:\System Volume Information
2011-01-30 17:16:33 ----D---- C:\instalace
2011-01-30 15:27:17 ----D---- C:\Windows\system32\drivers
2011-01-30 15:27:17 ----D---- C:\Windows\system32\catroot
2011-01-30 15:27:16 ----D---- C:\Windows\system32\DriverStore
2011-01-30 15:27:16 ----D---- C:\Windows\inf
2011-01-30 15:26:32 ----HD---- C:\ProgramData
2011-01-30 15:15:38 ----D---- C:\Windows\Prefetch
2011-01-30 15:12:07 ----D---- C:\Windows\System32
2011-01-30 15:12:07 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-01-30 15:11:46 ----D---- C:\Windows\Microsoft.NET
2011-01-30 15:11:45 ----D---- C:\Windows\SysWOW64
2011-01-30 15:11:40 ----D---- C:\Windows\SYSWOW64\en-US
2011-01-30 15:11:40 ----D---- C:\Windows\system32\en-US
2011-01-30 15:11:36 ----D---- C:\Program Files (x86)\Microsoft.NET
2011-01-30 14:13:08 ----D---- C:\Windows\system32\catroot2
2011-01-30 14:13:06 ----D---- C:\Windows\winsxs
2011-01-30 14:06:12 ----RD---- C:\Program Files (x86)
2011-01-30 13:48:39 ----D---- C:\Windows\Tasks
2011-01-30 11:54:01 ----D---- C:\Windows\SYSWOW64\drivers
2011-01-30 11:42:01 ----D---- C:\Windows\system32\wfp
2011-01-30 11:41:59 ----D---- C:\Windows\system32\wbem
2011-01-30 11:39:17 ----D---- C:\Windows\system32\drivers\etc
2011-01-30 11:39:16 ----D---- C:\Windows\system32\drivers\UMDF
2011-01-30 11:39:16 ----D---- C:\Windows\system32\CodeIntegrity
2011-01-30 11:39:16 ----D---- C:\Windows\AppCompat
2011-01-30 11:39:13 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-01-30 11:38:46 ----D---- C:\Windows\registration
2011-01-30 11:37:55 ----SD---- C:\ProgramData\Microsoft
2011-01-30 11:37:48 ----D---- C:\Program Files (x86)\Call of Duty 4 - Modern Warfare
2011-01-29 21:15:24 ----D---- C:\Windows\debug
2011-01-24 10:11:18 ----D---- C:\Program Files (x86)\Common Files
2011-01-23 21:03:55 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2011-01-23 16:40:37 ----RSD---- C:\Windows\assembly
2011-01-23 16:36:03 ----D---- C:\Windows\system32\cs-CZ
2011-01-23 16:36:00 ----D---- C:\Windows\SYSWOW64\cs-CZ
2011-01-23 15:12:53 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-01-23 15:02:58 ----D---- C:\Windows\SoftwareDistribution
2011-01-22 21:18:08 ----D---- C:\Windows\system32\NDF
2011-01-19 07:19:19 ----D---- C:\Program Files (x86)\Electronic Arts
2011-01-12 21:52:47 ----A---- C:\Windows\system32\MRT.exe
2011-01-12 21:52:40 ----D---- C:\ProgramData\Microsoft Help
2011-01-07 13:40:27 ----D---- C:\Program Files (x86)\Microsoft Silverlight

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-02-21 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-01-23 254528]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2010-12-21 170640]
R2 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2010-12-21 50624]
R2 npf;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-01-27 47632]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 6037504]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 79360]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2008-02-14 91176]
R3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2007-07-16 95784]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2010-12-21 34144]
R3 kvnet;Kerio Virtual Network Adapter; C:\Windows\system32\DRIVERS\kvnet.sys [2010-07-15 30720]
R3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 551936]
S3 esgiguard;esgiguard; \??\C:\Program Files (x86)\Enigma Software Group\SpyHunter\esgiguard.sys [2010-06-21 13408]
S3 lvpepf64;Volume Adapter; C:\Windows\system32\DRIVERS\lv302a64.sys [2008-07-26 15768]
S3 LVRS64;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs64.sys [2008-07-26 790424]
S3 LVUSBS64;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBS64.sys [2008-07-26 50072]
S3 nmwcdcx64;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbox64.sys [2009-12-30 25088]
S3 nmwcdx64;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmbx64.sys [2010-01-21 18944]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
S3 PID_PEPI;Logitech QuickCam IM(PID_PEPI); C:\Windows\system32\DRIVERS\LV302V64.SYS [2008-07-26 2624408]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2009-12-30 8704]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltx64j.sys [2009-12-30 8704]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]
S3 X6va003;X6va003; \??\C:\Users\MIKA~1\AppData\Local\Temp\0033D81.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 203264]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]
R2 KVPNCSvc;Kerio VPN Client Service; C:\Program Files (x86)\Kerio\VPN Client\kvpncsvc.exe [2010-07-18 1103720]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2010-11-28 75136]
R3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2011-01-12 42360]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-22 1255736]
S4 NetMsmqActivator;@%SystemRoot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 116560]
S4 NetPipeActivator;@%SystemRoot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 116560]
S4 NetTcpActivator;@%SystemRoot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 116560]
S4 NMSAccess;NMSAccess; C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
S4 SpyHunter 4 Service;SpyHunter 4 Service; C:\PROGRA~2\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [2010-11-05 327000]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[achiles]

tak bohuzel po spusteni programu vyskoci vzdy BSOD (a to i v safe mode) > IRQL_NOT_LESS_OR_EQUAL 0x0000000A (cisla v zavorce se meni...)

[Rudy]

OK. Zkuste sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 . Dejte log. BSOD klidně může způsobovat i jiná vada, nejen virus.

[achiles]

Takze AVPTool nasel toto: MEM:Rootkit.Win64.TDSS.fa. K jeho ostraneni vyzadoval restart, takze se restartovalo, ale nasledne jiz OS nenaskocil. Udelal jsem tedy Bod Obnovy, po kterem system naskocil a dalsi otestovani pres AVPTool jiz proslo bez nakaz. Zadne BSOD a jiz se mi i podarilo nainstalovat MS .NET Framework 4. Stranky Microsoft Update se jiz take nacitaji, takze budu doufat, ze je jiz vyreseno.

[Rudy]

OK. Jsem rád, že se problém vyřešil.

[achiles]

jeste jsem nechal projet PC tim combofixem a vypada to OK. Posilam vam tedy jeste dodatecne velke diky...

[Rudy]

Rádo se stalo!