VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Zpomalil se počítač.

https://forum.viry.cz:443/viewtopic.php?t=111002

Stránka 1 z 2

Zpomalil se počítač.

Napsal: 12 dub 2011 13:31
od kakuk
Jsem zde úplný nováček. Kaspersky odhalil a odstranil.

Trojsky kun Trojan-GameThief. Win32. Staem.hi C:\System Volume Information\_restore{7BE5B964-F343-43E9-B088-5A03FE0A9BD3}Vy>257\A0046996.EXE

Od tohoto okamžiku se mě zdá, že počítač je pomalý. Potřeboval bych od někoho zjistit, zda je počítač stále ohrožen vnitřní hrozbou. Děkuji. Zde je log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by moje1 at 2011-04-12 13:44:49
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 7 GB (23%) free of 30 GB
Total RAM: 768 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:46:49, on 12.4.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Opera\opera.exe
D:\Záloha\Programy\VYTVOŘENÍ LOGU PRO KONTROLU PC\RSIT.exe
C:\Program Files\trend micro\moje1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: MHURLSearchHook Class - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files\Family Toolbar\tbhelper.dll
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O3 - Toolbar: Family Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Family Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Family Tree Builder Update] C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ABBYY Screenshot Reader Retail] "C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Adobe Reader Synchronizer.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Přidat do Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: &Virtuální klávesnice - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: K&ontrola adres URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.cz/Genoogle/Compo ... eQuery.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2037324722
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/f ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7CEC668-BECE-4FDD-A588-7B0E24F5A32B}: NameServer = 93.153.117.1 62.141.0.2
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - (no file)
O20 - AppInit_DLLs: C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll,C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ABBYY.Licensing.FineReader.ScreenshotReader.9.0 - ABBYY (BIT Software) - C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Služba Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: Služba Google Update (gupdate1c9be876827bd70) (gupdate1c9be876827bd70) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 9413 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\20071118_144400_záloha_výpln_ZC5.job
C:\WINDOWS\tasks\20081115_205000_Posta.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0C37B053-FD68-456a-82E1-D788EE342E6F}]
MHTBPos00 Class - C:\Program Files\Family Toolbar\tbcore3.dll [2009-05-07 2642432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll [2010-07-01 68280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22 1242504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-04-16 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll [2010-07-01 191160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - Family Toolbar - C:\Program Files\Family Toolbar\tbcore3.dll [2009-05-07 2642432]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"=C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe [2003-03-26 172032]
"NBKeyScan"=C:\Program Files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe [2008-04-08 1647912]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"Family Tree Builder Update"=C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2010-10-31 226832]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2011-03-22 352976]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"=stmctrl.dll,TaskBar []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2008-01-22 152872]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"ABBYY Screenshot Reader Retail"=C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe [2008-12-09 959776]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-01-26 15026056]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
Adobe Gamma Loader.exe.lnk -
Adobe Reader Synchronizer.lnk -

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll,C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-10-26 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2010-07-01 228024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoInstrumentation"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1
"HonorAutoRunSetting"=1
"NoDriveTypeAutoRun"=28

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-04-12 13:44:49 ----DC---- C:\rsit
2011-03-31 23:11:19 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2011-03-31 22:53:57 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2011-03-31 22:53:21 ----D---- C:\Program Files\TuneUp Utilities 2010
2011-03-31 17:39:29 ----SHDC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2011-03-24 11:25:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2524375$
2011-03-19 12:21:09 ----DC---- C:\Documents and Settings\moje1\Data aplikací\skypePM
2011-03-19 12:11:38 ----D---- C:\Program Files\Common Files\Skype
2011-03-19 12:11:07 ----RD---- C:\Program Files\Skype
2011-03-19 12:11:05 ----DC---- C:\Documents and Settings\moje1\Data aplikací\Skype
2011-03-19 12:10:50 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Skype

======List of files/folders modified in the last 1 months======

2011-04-12 13:46:49 ----D---- C:\Program Files\Trend Micro
2011-04-12 13:44:41 ----D---- C:\WINDOWS\Prefetch
2011-04-12 13:34:47 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab
2011-04-12 12:26:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-04-12 11:37:52 ----D---- C:\WINDOWS\Temp
2011-04-12 11:34:22 ----D---- C:\WINDOWS\system32
2011-04-11 06:25:52 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Google Updater
2011-04-08 16:49:56 ----D---- C:\Program Files\Opera
2011-04-05 21:55:42 ----AC---- C:\WINDOWS\NeroDigital.ini
2011-04-04 18:28:43 ----D---- C:\WINDOWS\system32\drivers
2011-04-04 07:38:22 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Adobe
2011-03-31 23:38:21 ----DC---- C:\Config.Msi
2011-03-31 23:11:28 ----SHD---- C:\WINDOWS\Installer
2011-03-31 22:53:21 ----RD---- C:\Program Files
2011-03-31 22:52:51 ----D---- C:\WINDOWS
2011-03-31 18:23:43 ----D---- C:\WINDOWS\system32\config
2011-03-31 17:46:27 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TuneUp Software
2011-03-31 16:53:28 ----D---- C:\Program Files\Common Files\Adobe
2011-03-31 16:51:18 ----D---- C:\Program Files\Adobe
2011-03-31 16:50:18 ----D---- C:\WINDOWS\WinSxS
2011-03-30 22:30:49 ----AC---- C:\WINDOWS\MyHeritage.INI
2011-03-27 08:13:52 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-03-26 17:11:22 ----D---- C:\Program Files\Hry
2011-03-26 17:00:45 ----D---- C:\WINDOWS\system32\CatRoot2
2011-03-26 16:04:19 ----D---- C:\WINDOWS\repair
2011-03-26 16:02:50 ----D---- C:\WINDOWS\Registration
2011-03-24 11:25:22 ----HD---- C:\WINDOWS\inf
2011-03-24 11:24:11 ----HD---- C:\WINDOWS\$hf_mig$
2011-03-24 09:28:04 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-03-23 00:28:10 ----D---- C:\WINDOWS\security
2011-03-23 00:21:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-03-22 23:46:47 ----D---- C:\Program Files\TuxPaint
2011-03-22 22:53:16 ----A---- C:\WINDOWS\imsins.BAK
2011-03-22 22:53:08 ----D---- C:\WINDOWS\Help
2011-03-22 22:53:07 ----D---- C:\WINDOWS\Cursors
2011-03-22 22:53:06 ----D---- C:\Program Files\Windows NT
2011-03-22 22:52:39 ----D---- C:\WINDOWS\system32\wbem
2011-03-22 16:12:32 ----SHD---- C:\System Volume Information
2011-03-22 15:07:42 ----D---- C:\WINDOWS\system32\CatRoot
2011-03-22 15:04:51 ----DC---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab Setup Files
2011-03-22 15:03:23 ----D---- C:\Program Files\Kaspersky Lab
2011-03-19 12:11:38 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 imagedrv;imagedrv; C:\WINDOWS\System32\Drivers\imagedrv.sys [2008-01-22 11304]
R0 imagesrv;imagesrv; C:\WINDOWS\system32\DRIVERS\imagesrv.sys [2008-01-22 132904]
R0 kl1;kl1; C:\WINDOWS\system32\DRIVERS\kl1.sys [2010-06-09 132184]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\System32\DRIVERS\viaagp.sys [2008-04-14 42240]
R1 kl2;kl2; C:\WINDOWS\system32\DRIVERS\kl2.sys [2010-06-09 11352]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2011-03-22 475736]
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [2001-08-17 289887]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [2001-08-17 115807]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [2001-08-17 391199]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [2001-08-17 199711]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [2001-08-17 50751]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [2001-08-17 488383]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-07-12 655596]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2004-10-26 820224]
R3 bbcap;bbcap; C:\WINDOWS\system32\DRIVERS\bbcap.sys [2008-12-20 4096]
R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2010-05-07 32856]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 NtApm;Ovladač rozhraní služby NT Apm/Legacy; C:\WINDOWS\System32\DRIVERS\NtApm.sys [2001-10-24 9472]
R3 Stmatm;ATM/ADSL miniport; C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service; C:\WINDOWS\system32\DRIVERS\torususb.sys [2003-12-23 549421]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 AF15BDA;AF9015 BDA Filter; C:\WINDOWS\System32\Drivers\AF15BDA.sys [2006-09-28 283776]
S3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879]
S3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-11-02 19472]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471]
S3 s716bus;Sony Ericsson Device 716 driver (WDM); C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-06-29 83208]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-06-29 15112]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-06-29 108552]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 100360]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS); C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 23176]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-04-04 98568]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM); C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 98952]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.ScreenshotReader.9.0;ABBYY.Licensing.FineReader.ScreenshotReader.9.0; C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe [2008-10-27 759072]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2004-10-26 413696]
R2 AVP;Služba Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2011-03-22 352976]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2011-03-08 1051968]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2004-10-26 516096]
S2 gupdate1c9be876827bd70;Služba Google Update (gupdate1c9be876827bd70); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-16 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-16 183280]
S2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2008-04-08 800040]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2011-03-31 435008]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 13:35
od vyosek
Zdravim a pekny den preji :)

:arrow: Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

:arrow: Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)
  • Provedte aktualizaci - treti zalozka
  • Provedte uplny sken - nic nemazte :!:
  • MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 13:51
od kakuk
Pěkný den.
Musím se hned zeptat, než na to zapomenu. Až provedu odstranění bodu obnovy, dle návodu, mohu jej zase zapnout?

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 13:52
od vyosek
Ano, vzdyt je to tam i napsano :)

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 17:32
od kakuk
Pěkný den.
V prvé řadě se omlouvám za spam. Všiml jsem si toho, až když jsem napsal dotaz.

Zde zasílám log z MBAM.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 6341

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12.4.2011 18:25:28
mbam-log-2011-04-12 (18-24-47).txt

Typ kontroly: Úplný test (C:\|D:\|)
Testované objekty: 299183
Uplynulý čas: 1 hodin, 8 minut, 31 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
d:\system volume information\_restore{6768fba0-ef19-4480-9047-a90fb23da263}\RP172\A0044341.exe (Adware.MyWebSearch) -> No action taken.

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 17:37
od vyosek
:arrow: Nalez MBAMu smazte

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner (viz muj podpis)
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za 14 dni

:arrow: Doporucuji provest defragmentaci disku
  • Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
    • Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
    • prepnete se do zalozky Nastroje
    • Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
    • Toto provedte se vsemi disky
  • Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
    • Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
    • Kliknete na Analyzovat
    • Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
    • Postup provedte se vsemi disky
  • Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
    • Vyhodou programku je, ze se neinstaluje
    • Staci tedy jen stahnout dle verze vaseho OS a rozbalit
    • Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
    • Probehne analyza disku a nasledne i defragmentace
:arrow: Napiste jak se chova PC

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 17:51
od kakuk
K čistění a defragmentaci používám program TuneUp Utilities. Čistění a defragmentace probíhá každé tři dny. To nestačí?

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 18:04
od vyosek
TuneUp neumi cistit to co CClenaer a TFC

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 19:18
od kakuk
Děkuji za pomoc. Zatím jsem použil TFC. Pokračovat budu až zítra. Dnes mám jiné povinnosti. Pak dám vědět jak se podařilo.

Re: Zpomalil se počítač.

Napsal: 12 dub 2011 19:19
od vyosek
Oki :)

Re: Zpomalil se počítač.

Napsal: 13 dub 2011 13:52
od kakuk
Pěkný den!
Tak jsem provedl všechny doporučené akce. Výsledek byl výborný. Balast zabíral přes 3 Giga. Rychlost je v normálu. Ale.....
Před určitou dobou, jsem si na doporučení časopisu Chip, nainstaloval prográmek UPM. Po všech akcích jsem dal scan tímto programem. A co nevidím: Hlásí, že jsou tam asi 2 rootkity. Tak co dál s detoxikací PC? Děkuji za váš čas, který mě ještě bude věnovat.
Scan přikládám.

Windows XP SP 3 (build 2600)
Boot Mode: Normal
Ověření souborů Microsoftu: Ano
Whitelist: Ano
Internet Explorer v8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
Log vygenerován: 13.4.2011 14:23:40
================================================================

SmallARK
================================================================
[R]NtAdjustPrivilegesToken -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtClearEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtClose -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtConnectPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateJobObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateMutant -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateNamedPipeFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreatePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateSemaphore -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtCreateWaitablePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDebugActiveProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeleteKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeleteValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDeviceIoControlFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtDuplicateObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtEnumerateKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtEnumerateValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtFsControlFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadDriver -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtLoadKey2 -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtMapViewOfSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtNotifyChangeKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenEvent -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenFile -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenMutant -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenSemaphore -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtOpenThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryMultipleValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQuerySection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueryValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtQueueApcThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRenameKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplaceKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplyPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtReplyWaitReceivePort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRequestWaitReplyPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtRestoreKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtResumeThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSaveKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSecureConnectPort -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetContextThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetInformationToken -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetSecurityObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetSystemInformation -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSetValueKey -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSuspendProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSuspendThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtSystemDebugControl -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateJobObject -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateProcess -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtTerminateThread -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtUnmapViewOfSection -> C:\WINDOWS\system32\drivers\klif.sys
[R]NtWriteVirtualMemory -> C:\WINDOWS\system32\drivers\klif.sys


Běžící procesy
================================================================

(rootkit?)
(rootkit?) System
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\UPM\UPM.EXE

Scanner
================================================================

Proces se nepodařilo otevřít
ROOTKIT? Skrytá cesta
Spouští se po startu HKCU Run [AdslTaskBar]
Nelze otevřít
Nemá okno

System
ROOTKIT? Skrytá cesta
Spouští se po startu HKCU Run [AdslTaskBar]
Jiná ImageBase 00000000h
BaseAddress
Skrytá cesta EXE:
Nemá okno

[S, novf!] services.exe
Non Microsoft v System32:
Ověřený Microsoft: Ne
Nemá okno

[?] ati2evxx.exe
Non Microsoft v System32:

[S, novf!] spoolsv.exe
Non Microsoft v System32:
Ověřený Microsoft: Ne
Nemá okno

[R] avp.exe
Spouští se po startu HKLM Run [AVP]

[R] MDM.EXE
Ověřený Microsoft: Ne

[?] ati2evxx.exe
Non Microsoft v System32:

[S] explorer.exe
Spouští se po startu HKLM Winlogon [Shell]

[R] avp.exe
Spouští se po startu HKLM Run [AVP]

[R] NMBgMonitor.exe
Spouští se po startu HKCU Run [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

[S] ctfmon.exe
Spouští se po startu HKCU Run [ctfmon.exe]

[R] ScreenshotReader.exe
Spouští se po startu HKCU Run [ABBYY Screenshot Reader Retail]

[R] Skype.exe
Spouští se po startu HKCU Run [Skype]
Podvržená cesta modulu: (00400000) C:\Program Files\Skype\Phone\Skype.exe

[R] skypePM.exe
EntryPoint v sekci: CODE
|_ Celkový počet sekcí: 8

[?] UPM.exe
Soubor 7%


Po spuštění
================================================================

HKCU Run
|_ [?][AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
|_ [R][ABBYY Screenshot Reader Retail] C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe -autorun
|_ [R][Skype] C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

HKLM Run
|_ [?][HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
|_ [?][AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar

HKLM ShellServiceObjectDelayLoad
|_ [?][PostBootReminder] C:\WINDOWS\system32\SHELL32.dll
|_ [?][CDBurn] C:\WINDOWS\system32\SHELL32.dll
|_ [?][WebCheck] C:\WINDOWS\system32\webcheck.dll
|_ [?][WPDShServiceObj] C:\WINDOWS\system32\WPDShServiceObj.dll

HKLM IC
|_ [?][<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] C:\WINDOWS\system32\ieudinit.exe
|_ [?][>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\WINDOWS\inf\unregmp2.exe /ShowWMP
|_ [?][>{26923b43-4d38-484f-9b9e-de460746276c}] C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
|_ [?][{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] C:\WINDOWS\INF\msnetmtg.inf ,NetMtg.Install.PerUser.NT
|_ [?][{5945c046-1e7d-11d1-bc44-00c04fd912be}] C:\WINDOWS\INF\msmsgs.inf ,BLC.QuietInstall.PerUser
|_ [?][{6BF52A52-394A-11d3-B153-00C04F79FAA6}] C:\WINDOWS\INF\wmp11.inf ,PerUserStub
|_ [?][{89820200-ECBD-11cf-8B85-00AA005B4340}] regsvr32.exe /s /n /i:U shell32.dll
|_ [?][{89820200-ECBD-11cf-8B85-00AA005B4383}] C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

HKLM Winlogon Notify
|_ [?][AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll

HKLM AppInit_DLLs
|_ [R][AppInit_DLLs] C:\DOCUME~1\ALLUSE~1.WIN\AVP11\mzvkbd3.dll , C:\DOCUME~1\ALLUSE~1.WIN\AVP11\kloehk.dll

Job
|_ [?][User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job] C:\WINDOWS\system32\msfeedssync.exe
|_ [?][User_Feed_Synchronization-{0A0CCE5C-13F9-484D-BFD4-6C9F2BC67947}.job] C:\WINDOWS\system32\msfeedssync.exe


HKLM BHO
|_ [?][{0C37B053-FD68-456a-82E1-D788EE342E6F}] C:\Program Files\Family Toolbar\tbcore3.dll

HKCU IE WebBrowser Toolbar
|_ [?][{0E5CBF21-D15F-11D0-8301-00AA005B4383}] C:\WINDOWS\system32\SHELL32.dll
|_ [?][{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] C:\Program Files\Family Toolbar\tbcore3.dll

HKLM IE Toolbar
|_ [?][{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}] C:\Program Files\Family Toolbar\tbcore3.dll

Služby (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[X] ABBYY.Licensing.FineReader.ScreenshotReader.9.0
|_ Cesta: C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe -service
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: ABBYY.Licensing.FineReader.ScreenshotReader.9.0
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS

[?] Ati HotKey Poller
|_ Cesta: C:\WINDOWS\System32\Ati2evxx.exe
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI External Event Utility EXE Module
| |_ MD5: E9E4CAAF26D436D1DF177AE484090750
|
|_ Jméno: Ati HotKey Poller
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency:

[?] ATI Smart
|_ Cesta: C:\WINDOWS\system32\ati2sgag.exe
| |_ Výrobce:
| |_ Popis: ATI Smart
| |_ MD5: 7A20E3A78A97C9E3D5BFE1FA36AA7A50
|
|_ Jméno: ATI Smart
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ:
|_ Dependency:

[?] Spouštěč procesů serveru DCOM
|_ Cesta: C:\WINDOWS\system32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\system32\rpcss.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Distributed COM Services
| |_ MD5: BE27674D1CBC3214AEC84B4336A38BBF
|
|_ Jméno: DcomLaunch
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:

[?] Protokol událostí
|_ Cesta: C:\WINDOWS\system32\services.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Services and Controller app
| |_ MD5: 9EF697AF07BB8DD82C3B02CA953A95B7
|
|_ Jméno: Eventlog
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:

[X] Služba Google Update (gupdate1c9be876827bd70)
|_ Cesta: C:\Program Files\Google\Update\GoogleUpdate.exe /svc
| |_ Výrobce:
| |_ Popis:
| |_ MD5:
|
|_ Jméno: gupdate1c9be876827bd70
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Own Process
|_ Dependency: RPCSS

[?] Server
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\srvsvc.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Server Service DLL
| |_ MD5: 3428E8F86F8ADD36B42FB23542C7B3E4
|
|_ Jméno: lanmanserver
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:

[?] Pracovní stanice
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\wkssvc.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Workstation Service DLL
| |_ MD5: 936C1D110232D23B621CB0196E4F80F0
|
|_ Jméno: lanmanworkstation
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:

[?] Plug and Play
|_ Cesta: C:\WINDOWS\system32\services.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Services and Controller app
| |_ MD5: 9EF697AF07BB8DD82C3B02CA953A95B7
|
|_ Jméno: PlugPlay
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency:

[?] Vzdálené volání procedur (RPC)
|_ Cesta: C:\WINDOWS\system32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\system32\rpcss.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Distributed COM Services
| |_ MD5: BE27674D1CBC3214AEC84B4336A38BBF
|
|_ Jméno: RpcSs
|_ StartName: NT Authority\NetworkService
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Own Process
|_ Dependency:

[?] Rozpoznávání hardwaru
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\shsvcs.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows Shell Services Dll
| |_ MD5: EE9A2B9EA968A792A053C9D1A86BF870
|
|_ Jméno: ShellHWDetection
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Win32 Share Process
|_ Dependency: RpcSs

[?] Zařazování tisku
|_ Cesta: C:\WINDOWS\system32\spoolsv.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Spooler SubSystem App
| |_ MD5: 60784F891563FB1B767F70117FC2428F
|
|_ Jméno: Spooler
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ:
|_ Dependency: RPCSS

[?] Motivy
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\shsvcs.dll
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows Shell Services Dll
| |_ MD5: EE9A2B9EA968A792A053C9D1A86BF870
|
|_ Jméno: Themes
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Share Process
|_ Dependency:

[R] TuneUp Theme Extension
|_ Cesta: C:\WINDOWS\System32\svchost.exe
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Generic Host Process for Win32 Services
| |_ MD5: BE4A520E29B6391F49E79CCC52044D93
|
|_ ServiceDLL: C:\WINDOWS\System32\uxtuneup.dll
| |_ Výrobce: TuneUp Software
| |_ Popis: TuneUp Theme Extension
| |_ MD5: D4BD1E2B3EA4E02A526B41514F31D3BC
|
|_ Jméno: UxTuneUp
|_ StartName: LocalSystem
|_ Typ spouštění: Auto Start
|_ Status: Zastaveno
|_ Typ: Win32 Share Process
|_ Dependency: Themes


Ovladače (Zobraz běžící: True, Zobraz zastavené: False, Zobraz i bezpečné služby: False)
================================================================
[?] PPdus ASPI Shell
|_ Cesta: C:\WINDOWS\system32\drivers\Afc.sys
| |_ Výrobce: Arcsoft, Inc.
| |_ Popis: Arcsoft(R) ASPI Shell
| |_ MD5: A7B8A3A79D35215D798A300DF49ED23F
|
|_ Jméno: Afc
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Service for Avance AC97 Audio (WDM)
|_ Cesta: C:\WINDOWS\system32\drivers\ALCXWDM.SYS
| |_ Výrobce: Avance Logic, Inc.
| |_ Popis: Avance AC'97 Audio Driver (WDM)
| |_ MD5: 7BFE59F5EFF8896D043CFDE731B262E9
|
|_ Jméno: ALCXWDM
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] ati2mtag
|_ Cesta: C:\WINDOWS\System32\DRIVERS\ati2mtag.sys
| |_ Výrobce: ATI Technologies Inc.
| |_ Popis: ATI Radeon WindowsNT Miniport Driver
| |_ MD5: 85C673F5862441F231099809235B5657
|
|_ Jméno: ati2mtag
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Fallback
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys
| |_ Výrobce: Conexant
| |_ Popis: Fallback driver
| |_ MD5: C823DEBE2548656549F84A875D65237B
|
|_ Jméno: Fallback
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Fsks
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys
| |_ Výrobce: Conexant
| |_ Popis: FSKsNT driver
| |_ MD5: 6483414841D4CAB6C3B4DB2AC6EDD70B
|
|_ Jméno: Fsks
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] HSFHWBS2
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_HWB2 WDM driver
| |_ MD5: 970178E8E003EB1481293830069624B9
|
|_ Jméno: HSFHWBS2
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] HSF_DP
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_DP driver
| |_ MD5: EBB354438A4C5A3327FB97306260714A
|
|_ Jméno: HSF_DP
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Služba HTTP
|_ Cesta: C:\WINDOWS\System32\Drivers\HTTP.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: HTTP Protocol Stack
| |_ MD5: F80A415EF82CD06FFAF0D971528EAD38
|
|_ Jméno: HTTP
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] K56
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys
| |_ Výrobce: Conexant
| |_ Popis: K56NT driver
| |_ MD5: 9C5E3FDBFCC30CF71A49CA178B9AD442
|
|_ Jméno: K56
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] KSecDD
|_ Cesta: C:\WINDOWS\system32\drivers\KSecDD.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Kernel Security Support Provider Interface
| |_ MD5: B467646C54CC746128904E1654C750C1
|
|_ Jméno: KSecDD
|_ StartName:
|_ Typ spouštění: Boot Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] mdmxsdk
|_ Cesta: C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys
| |_ Výrobce: Conexant
| |_ Popis: Diagnostic Interface DRIVER
| |_ MD5: 195741AEE20369980796B557358CD774
|
|_ Jméno: mdmxsdk
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] MRXSMB
|_ Cesta: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Windows NT SMB Minirdr
| |_ MD5: F3AEFB11ABC521122B67095044169E98
|
|_ Jméno: MRxSmb
|_ StartName:
|_ Typ spouštění: System Start
|_ Status: Spuštěno
|_ Typ: File System Driver
|_ Dependency:

[?] Služba NDIS Proxy
|_ Cesta: C:\WINDOWS\system32\drivers\NDProxy.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: NDIS Proxy
| |_ MD5: 9282BD12DFB069D3889EB3FCC1000A9B
|
|_ Jméno: NDProxy
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] SoftFax
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys
| |_ Výrobce: Conexant
| |_ Popis: FaxNT driver
| |_ MD5: D9E8E0CE154A2F6430D9EFABDF730867
|
|_ Jméno: SoftFax
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Srv
|_ Cesta: C:\WINDOWS\System32\DRIVERS\srv.sys
| |_ Výrobce: Microsoft Corporation
| |_ Popis: Server driver
| |_ MD5: 0F6AEFAD3641A657E18081F52D0C15AF
|
|_ Jméno: Srv
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: File System Driver
|_ Dependency:

[?] ATM/ADSL miniport
|_ Cesta: C:\WINDOWS\system32\DRIVERS\stmatm.sys
| |_ Výrobce: STMicroelectronics
| |_ Popis: ATM/ADSL miniport
| |_ MD5: 2FC0C3D5615395585ABDB16660EFBC3A
|
|_ Jméno: Stmatm
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] ADSL Modem USB Service
|_ Cesta: C:\WINDOWS\system32\DRIVERS\torususb.sys
| |_ Výrobce: ?
| |_ Popis: ?
| |_ MD5: 22826EEDAAAEFBB0B95E33CD24314375
|
|_ Jméno: TaurusUsb
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] Tones
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys
| |_ Výrobce: Conexant
| |_ Popis: TonesNT driver
| |_ MD5: 8021A499DB46B2961C285168671CB9AF
|
|_ Jméno: Tones
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] V124
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSF_V124.sys
| |_ Výrobce: Conexant
| |_ Popis: V124NT driver
| |_ MD5: 269C0ADE94B90029B12497747BE408CB
|
|_ Jméno: V124
|_ StartName:
|_ Typ spouštění: Auto Start
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:

[?] winachsf
|_ Cesta: C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys
| |_ Výrobce: Conexant Systems, Inc.
| |_ Popis: HSF_CNXT driver
| |_ MD5: 1225EBEA76AAC3C84DF6C54FE5E5D8BE
|
|_ Jméno: winachsf
|_ StartName:
|_ Typ spouštění: Ruční spuštění
|_ Status: Spuštěno
|_ Typ: Kernel Driver
|_ Dependency:


lNetStat
================================================================
Typ: PID Proces Local <-> Remote Status
-----------------------------------------------------------------------------------------
TCP (1812) Skype.exe 0.0.0.0:80 LISTENING
TCP (1068) svchost.exe 0.0.0.0:135 LISTENING
TCP (1812) Skype.exe 0.0.0.0:443 LISTENING
TCP (4) Systém 0.0.0.0:445 LISTENING
TCP (1600) avp.exe 0.0.0.0:1110 LISTENING
TCP (1812) Skype.exe 0.0.0.0:59642 LISTENING
TCP (1812) Skype.exe 78.80.6.20:443 <-> 78.100.38.30:36425 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:443 <-> 195.113.201.101:23413 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:443 <-> 217.77.161.17:19116 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4008 <-> 85.239.154.117:10487 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4014 <-> 212.161.8.4:12350 ESTABLISHED
TCP (1600) avp.exe 78.80.6.20:4113 CLOSE_WAIT
TCP (1600) avp.exe 78.80.6.20:4118 <-> 93.99.17.238:80 ESTABLISHED
TCP (1812) Skype.exe 78.80.6.20:59642 <-> 81.200.55.82:4459 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4007 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4013 ESTABLISHED
TCP (1600) avp.exe 127.0.0.1:1110 FIN_WAIT2
TCP (0) 127.0.0.1:1110 TIME_WAIT
TCP (1600) avp.exe 127.0.0.1:1110 <-> 127.0.0.1:4117 ESTABLISHED
TCP (1812) Skype.exe 127.0.0.1:4007 <-> 127.0.0.1:1110 ESTABLISHED
TCP (1812) Skype.exe 127.0.0.1:4013 <-> 127.0.0.1:1110 ESTABLISHED
TCP (1664) UPM.exe 127.0.0.1:4112 CLOSE_WAIT
UDP (1812) Skype.exe 0.0.0.0:443 <-> 127.0.0.1:1110 ESTABLISHED
UDP (4) Systém 0.0.0.0:445
UDP (744) lsass.exe 0.0.0.0:500
UDP (1600) avp.exe 0.0.0.0:2581
UDP (744) lsass.exe 0.0.0.0:4500
UDP (1812) Skype.exe 0.0.0.0:59642
UDP (1296) svchost.exe 78.80.6.20:1900
UDP (1732) opera.exe 78.80.6.20:1900
UDP (1732) opera.exe 78.80.6.20:4114
UDP (1296) svchost.exe 127.0.0.1:1900
UDP (2076) ScreenshotReader.exe127.0.0.1:3934
UDP (1812) Skype.exe 127.0.0.1:4006
UDP (1812) Skype.exe 127.0.0.1:4017

Moduly (Zobraz i bezpečné DLL: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[!] kjim.kdl.0b52ef7124235e8f8711175b8fad0aad
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\kjim.kdl.0b52ef7124235e8f8711175b8fad0aad
|_ MD5: 0B52EF7124235E8F8711175B8FAD0AAD
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[!] pbs.kdl.a3dbdf39fdcbbca23e0dfb303b8030d6
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\pbs.kdl.a3dbdf39fdcbbca23e0dfb303b8030d6
|_ MD5: A3DBDF39FDCBBCA23E0DFB303B8030D6
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[?] bsshlp.kdl.c333e2601f1b0d52312ab3ec900c2e4d
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\bsshlp.kdl.c333e2601f1b0d52312ab3ec900c2e4d
|_ MD5: C333E2601F1B0D52312AB3EC900C2E4D
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[?] vlns.kdl.002d59a92d55ccbddcca8fba8ea8340d
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\vlns.kdl.002d59a92d55ccbddcca8fba8ea8340d
|_ MD5: 002D59A92D55CCBDDCCA8FBA8EA8340D
|_ Výrobce: Kaspersky Lab
|_ Procesy
|_ avp.exe (1600)

[!] mark.kdl.4c174a6abe5d8edee2169b038e0925d7
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\mark.kdl.4c174a6abe5d8edee2169b038e0925d7
|_ MD5: 4C174A6ABE5D8EDEE2169B038E0925D7
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[!] klavemu.kdl.b2beb3b968abcbef0057cdfe20932efd
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\klavemu.kdl.b2beb3b968abcbef0057cdfe20932efd
|_ MD5: B2BEB3B968ABCBEF0057CDFE20932EFD
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[!] qscan.kdl.f5e6e61c7ced81e9880827d5026b35ff
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\qscan.kdl.f5e6e61c7ced81e9880827d5026b35ff
|_ MD5: F5E6E61C7CED81E9880827D5026B35FF
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[!] kavsys.kdl.0d885c7ff37beb5f30936020f811d20f
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\kavsys.kdl.0d885c7ff37beb5f30936020f811d20f
|_ MD5: 0D885C7FF37BEB5F30936020F811D20F
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[!] klavasyswatch.dll.c6fa7a3c61474aa194bc8c102e524f52
|_ Cesta: C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Kaspersky Lab\AVP11\Bases\Cache\klavasyswatch.dll.c6fa7a3c61474aa194bc8c102e524f52
|_ MD5: C6FA7A3C61474AA194BC8C102E524F52
|_ Výrobce: Kaspersky Lab ZAO
|_ Procesy
|_ avp.exe (1600)

[?] boost_log-vc71-mt-1_33.dll
|_ Cesta: C:\Program Files\Common Files\Teleca Shared\boost_log-vc71-mt-1_33.dll
|_ MD5: 8EB4888D9504D2BC4CEC3209645F55BE
|_ Výrobce:
|_ Procesy
|_ explorer.exe (1312)

[?] fm.dll
|_ Cesta: C:\Program Files\Sony Ericsson\Mobile2\File Manager\FM.dll
|_ MD5: 92339ED33F67A0252308835C5C0088E5
|_ Výrobce: Popwire AB
|_ Procesy
|_ explorer.exe (1312)

[?] rarext.dll
|_ Cesta: C:\Program Files\WinRAR\RarExt.dll
|_ MD5: 30A23A61E651C7487407CF74176C6AB1
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (1312)

[X] rarlng.dll
|_ Cesta: C:\Program Files\WinRAR\rarlng.dll
|_ MD5: FF96E637FC3D59D0BF1DF9704E3B0D45
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (1312)

[?] pdm.dll
|_ Cesta: C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\PDM.DLL
|_ MD5: 0316E1DF05A25AD02FFAE44A01E160AC
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ Skype.exe (1812)



================================================================
Ultimate Process Manager v4.1.3 - [ Lodus Software ] - Not Registered =(

Re: Zpomalil se počítač.

Napsal: 13 dub 2011 15:40
od vyosek
Dle meho jde o falesne detekce, ale muzeme udelat test na rootkity pro Vas klid...

:arrow: Stahnete SPTD http://www.duplexsecure.com/en/downloads
  • Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
  • Ulozte na plochu a spustte
  • Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
:arrow: Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe
  • Ulozte na plochu a spustte
  • Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
:arrow: Stahnete MBR na plochu http://www2.gmer.net/mbr/mbr.exe ale nespoustejte

:arrow: Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R
  • Vyskoci na Vas okenko, do ktereho zkopirujte text nize

  • Kód: Vybrat vše

    "%userprofile%\plocha\mbr" -t -s
  • Kliknete na OK
  • Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte
:arrow: Dejte logy z Gmeru - viz muj podpis

Re: Zpomalil se počítač.

Napsal: 14 dub 2011 06:49
od kakuk
Provedl jsem operace dle návodu.
- SPTD - šedé tlačítko - přeskočeno
Log z Defogger

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:20 on 13/04/2011 (moje1)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

- Log z MBR

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST360021A rev.3.19 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll viaide.sys
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x83B95AB8]
3 CLASSPNP[0xF784BFD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\Ide\IdeDeviceP0T0L0-4[0x83B98D98]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
user & kernel MBR OK

S tímto programem mám potíže. První scan proběhne bez problémů. Ale ten hlavní ne a ne udělat. Proces se zahájí, ale asi tak po 3/4 hodiny dojde k samočinnému restartu. Tím se vše ztratí. Dělal jsem to 2x. Po každé stejná událost.
- Vkládám první scan z GMERu

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit quick scan 2011-04-13 18:07:32
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST360021A rev.3.19
Running: gmer.exe; Driver: C:\DOCUME~1\moje1\LOCALS~1\Temp\pxtdapow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xB9BA2ED2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB9BA2F6A]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

---- EOF - GMER 1.0.15 ----

Re: Zpomalil se počítač.

Napsal: 14 dub 2011 07:25
od vyosek
:arrow: Prihlaste se do nouzoveho rezimu (restart PC, mackat F8, zvolit Stav nouze s praci v siti)

:arrow: Aplikujte gmer

Re: Zpomalil se počítač.

Napsal: 17 dub 2011 12:20
od kakuk
Nemohl jsem reagovat na odpověď. Rozsypalo se mě připojení na net. Konečně jsem to dal do kupy. Určitě udělám, až najdu zase volnou díru v programu.
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz