Avast hlásí problém

[PredyP]

Dobrý den,
kamarádka mě požádala o pomoc, při každém otevření internetu jí avast hlísí http://www.avast.com/cs-cz/lp-security- ... p_vbd=1367
Děkuji za radu a pomoc.

[vyosek]

Zdravim a pekny den preji

Dejte sem prosim screen hlaseni Avastu

Dejte prosim log z RSIT

[PredyP]

Avast přestal hlásit, ale přidalo se že pc nejde vypnout
Logfile of random's system information tool 1.09 (written by random/random)
Run by Petra at 2012-02-06 19:48:24
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 177 GB (78%) free of 227 GB
Total RAM: 2013 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:48:57, on 6.2.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\Macromed\Flash\FlashUtil11e_ActiveX.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Ufonuv fofr internet\EASYWIRELESSNET.EXE
C:\RSIT.exe
C:\Program Files\trend micro\Petra.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Petra\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} (IASRunner Class) - http://support.lenovo.com/Resources/Len ... etect2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E072B46-86EE-48A4-A857-8D19370131DE}: NameServer = 78.136.128.4 78.136.128.12
O17 - HKLM\System\CCS\Services\Tcpip\..\{733563F1-00E8-4A8A-B10C-9DD9317FE984}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E072B46-86EE-48A4-A857-8D19370131DE}: NameServer = 78.136.128.4 78.136.128.12
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

--
End of file - 5619 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2434014512-3133335245-3839603683-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2434014512-3133335245-3839603683-1001UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-12-22 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-12-22 42272]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-02-23 3451496]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-12-21 6676808]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-11 137752]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-02-11 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-02-11 172568]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-04-23 1725736]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2011-12-09 4616064]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"Google Update"=C:\Users\Petra\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-22 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Petra\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-22 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [2006-10-23 40048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE [2006-10-23 734872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2011-05-04 551296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-02-11 228864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2011-07-19 113024]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-02-06 19:48:24 ----D---- C:\rsit
2012-02-06 19:48:24 ----D---- C:\Program Files\trend micro
2012-02-06 16:09:08 ----SHD---- C:\Config.Msi
2012-02-04 13:39:33 ----A---- C:\RSIT.exe
2012-02-01 18:20:44 ----A---- C:\Windows\system32\schannel.dll
2012-02-01 18:20:44 ----A---- C:\Windows\system32\lsasrv.dll
2012-02-01 18:20:44 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2012-02-01 18:20:44 ----A---- C:\Windows\system32\drivers\cng.sys
2012-02-01 18:20:43 ----A---- C:\Windows\system32\webio.dll
2012-02-01 18:20:43 ----A---- C:\Windows\system32\sspicli.dll
2012-02-01 18:20:43 ----A---- C:\Windows\system32\secur32.dll
2012-02-01 18:20:43 ----A---- C:\Windows\system32\lsass.exe
2012-02-01 18:20:43 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2012-02-01 18:20:42 ----A---- C:\Windows\system32\sspisrv.dll
2012-02-01 18:20:41 ----A---- C:\Windows\system32\ntdll.dll
2012-02-01 18:19:19 ----A---- C:\Windows\system32\packager.dll
2012-02-01 18:19:16 ----A---- C:\Windows\system32\quartz.dll
2012-02-01 18:19:15 ----A---- C:\Windows\system32\qdvd.dll
2012-02-01 17:17:10 ----D---- C:\Program Files\MSXML 4.0
2012-01-25 19:49:59 ----D---- C:\Windows\Minidump
2012-01-19 12:56:34 ----D---- C:\Users\Petra\AppData\Roaming\Stellarium
2012-01-18 20:29:43 ----D---- C:\Program Files\Stellarium

======List of files/folders modified in the last 1 month======

2012-02-06 19:48:42 ----D---- C:\Windows\Prefetch
2012-02-06 19:48:34 ----D---- C:\Windows\Temp
2012-02-06 19:48:24 ----RD---- C:\Program Files
2012-02-06 19:47:55 ----D---- C:\Windows\ModemLogs
2012-02-06 19:47:50 ----D---- C:\Program Files\Ufonuv fofr internet
2012-02-06 16:58:41 ----D---- C:\Windows\system32\config
2012-02-06 16:50:56 ----D---- C:\Windows\System32
2012-02-06 16:50:56 ----D---- C:\Windows\inf
2012-02-06 16:50:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-02-06 16:12:17 ----SHD---- C:\Windows\Installer
2012-02-06 16:12:14 ----D---- C:\ProgramData\Microsoft Help
2012-02-06 16:11:02 ----RSD---- C:\Windows\assembly
2012-02-06 15:56:19 ----SHD---- C:\System Volume Information
2012-02-05 20:39:00 ----D---- C:\Windows\winsxs
2012-02-05 20:24:30 ----D---- C:\Windows\system32\catroot2
2012-02-04 20:11:16 ----RSD---- C:\Windows\Fonts
2012-02-04 20:11:07 ----D---- C:\Program Files\Common Files\microsoft shared
2012-02-04 20:10:35 ----D---- C:\Program Files\Microsoft Works
2012-02-04 20:08:29 ----D---- C:\Program Files\Common Files\System
2012-02-04 20:08:29 ----A---- C:\Windows\win.ini
2012-02-04 19:37:26 ----D---- C:\Users\Petra\AppData\Roaming\Skype
2012-02-04 14:10:24 ----D---- C:\Users\Petra\AppData\Roaming\TeamViewer
2012-02-03 20:13:27 ----D---- C:\Windows\Microsoft.NET
2012-02-02 15:26:44 ----D---- C:\Windows\ehome
2012-02-02 15:26:43 ----D---- C:\Windows\system32\drivers
2012-02-01 18:17:03 ----D---- C:\Windows\system32\catroot
2012-02-01 17:27:51 ----D---- C:\Windows\debug
2012-02-01 17:27:47 ----A---- C:\Windows\system32\MRT.exe
2012-02-01 17:17:24 ----D---- C:\Windows
2012-01-27 00:21:24 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-02-23 25432]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-02-23 371544]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-02-23 301528]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-02-23 49240]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2011-12-19 491816]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2011-12-19 39640]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2011-12-19 82400]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-02-23 19544]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-14 37376]
R3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\Windows\system32\DRIVERS\adusbser.sys [2009-11-06 106880]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-02-11 9036800]
R3 NETw5s32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 32 Bit; C:\Windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
R3 sdbus;sdbus; C:\Windows\system32\drivers\sdbus.sys [2010-11-20 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-04-23 244784]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2008-09-26 101760]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2011-08-12 116608]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-02-23 42184]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-12-19 1960584]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-05-15 935208]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-22 1343400]

-----------------EOF-----------------

[vyosek]

Stahnete MBRScan http://eric71.geekstogo.com/tools/MbrScan.exe

• Ulozte nejlepe na plochu
• Pokud pouzivate Win Vista ci W7, kliknete na MBRScan pravym a dejte Run As Administrator ci Spustit jako spravce
• Kliknete na Report
• Po chvilce se objevi log do souboru MBRScan.txt, ten sem vlozte

[PredyP]

Program se zpustí a po chvíli se objeví Neodpovídá

[vyosek]

Ani po chvili se nerozjede me to treba na netbooku dela stejne...

[PredyP]

Když čekám tak to potom vyplivne

[vyosek]

Stahnete aswMBR http://public.avast.com/%7Egmerek/aswMBR.exe a ulozte jej na plochu.

• Utilitu spustte a prikazte ji, at skenuje - klik na Scan
• Kliknutim na Save log ulozte log aswMBR na plochu
• Obsah logu aswMBR mi sem vlozte

[PredyP]

aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-02-07 12:48:36
-----------------------------
12:48:36.081 OS Version: Windows 6.1.7601 Service Pack 1
12:48:36.081 Number of processors: 2 586 0xF0D
12:48:36.081 ComputerName: PETRA-PC UserName: Petra
12:48:38.592 Initialize success
12:48:39.357 AVAST engine defs: 12020700
12:48:47.375 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:48:47.375 Disk 0 Vendor: WDC_WD2500BEVS-08VAT2 14.01A14 Size: 238475MB BusType: 11
12:48:47.391 Disk 0 MBR read successfully
12:48:47.406 Disk 0 MBR scan
12:48:47.406 Disk 0 Windows 7 default MBR code
12:48:47.438 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 226974 MB offset 3074048
12:48:47.469 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10000 MB offset 467916800
12:48:47.484 Disk 0 scanning sectors +488396800
12:48:47.562 Disk 0 scanning C:\Windows\system32\drivers
12:48:54.738 Service scanning
12:48:56.954 Modules scanning
12:49:09.543 Disk 0 trace - called modules:
12:49:09.574 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys
12:49:09.590 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85a6d030]
12:49:09.605 3 CLASSPNP.SYS[88dc859e] -> nt!IofCallDriver -> [0x855b2c10]
12:49:09.621 5 ACPI.sys[8889b3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x855c2908]
12:49:10.931 AVAST engine scan C:\Windows
12:49:13.942 AVAST engine scan C:\Windows\system32
12:51:33.812 AVAST engine scan C:\Windows\system32\drivers
12:51:46.776 AVAST engine scan C:\Users\Petra
12:55:47.219 Disk 0 MBR has been saved successfully to "C:\Users\Petra\Desktop\MBR.dat"
12:55:47.422 The log file has been saved successfully to "C:\Users\Petra\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-02-07 12:48:36
-----------------------------
12:48:36.081 OS Version: Windows 6.1.7601 Service Pack 1
12:48:36.081 Number of processors: 2 586 0xF0D
12:48:36.081 ComputerName: PETRA-PC UserName: Petra
12:48:38.592 Initialize success
12:48:39.357 AVAST engine defs: 12020700
12:48:47.375 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:48:47.375 Disk 0 Vendor: WDC_WD2500BEVS-08VAT2 14.01A14 Size: 238475MB BusType: 11
12:48:47.391 Disk 0 MBR read successfully
12:48:47.406 Disk 0 MBR scan
12:48:47.406 Disk 0 Windows 7 default MBR code
12:48:47.438 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 226974 MB offset 3074048
12:48:47.469 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10000 MB offset 467916800
12:48:47.484 Disk 0 scanning sectors +488396800
12:48:47.562 Disk 0 scanning C:\Windows\system32\drivers
12:48:54.738 Service scanning
12:48:56.954 Modules scanning
12:49:09.543 Disk 0 trace - called modules:
12:49:09.574 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys
12:49:09.590 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85a6d030]
12:49:09.605 3 CLASSPNP.SYS[88dc859e] -> nt!IofCallDriver -> [0x855b2c10]
12:49:09.621 5 ACPI.sys[8889b3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x855c2908]
12:49:10.931 AVAST engine scan C:\Windows
12:49:13.942 AVAST engine scan C:\Windows\system32
12:51:33.812 AVAST engine scan C:\Windows\system32\drivers
12:51:46.776 AVAST engine scan C:\Users\Petra
12:55:47.219 Disk 0 MBR has been saved successfully to "C:\Users\Petra\Desktop\MBR.dat"
12:55:47.422 The log file has been saved successfully to "C:\Users\Petra\Desktop\aswMBR.txt"
12:56:22.957 Disk 0 MBR has been saved successfully to "C:\Users\Petra\Desktop\MBR.dat"
12:56:22.989 The log file has been saved successfully to "C:\Users\Petra\Desktop\aswMBR.txt"

[vyosek]

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[PredyP]

############################## | UsbFix 7.059 | [Deletion]

User: Petra (Administrator) # PETRA-PC [LENOVO 2746ERG]
Updated 16/09/2011 by El Desaparecido
Started at 13:12:34 | 07/02/2012
Website: http://eldesaparecido.com
Submit your sample: http://eldesaparecido.com/support.php
Contact: contact@eldesaparecido.com

CPU: Intel(R) Core(TM)2 Duo CPU T5870 @ 2.00GHz
CPU 2: Intel(R) Core(TM)2 Duo CPU T5870 @ 2.00GHz
Microsoft Windows 7 Professional (6.1.7601 32-Bit) # Service Pack 1
Internet Explorer 9.0.8112.16421

Windows Firewall: Disabled /!\
RAM -> 2013 Mb
C:\ (%systemdrive%) -> Fixed drive # 222 Gb (172 Mb free - 78%) [] # NTFS
D:\ -> Fixed drive # 10 Gb (2 Mb free - 16%) [Lenovo] # NTFS
E:\ -> CD-ROM
F:\ -> Removable drive # 8 Gb (7 Mb free - 100%) [] # FAT32
G:\ -> Removable drive # 7 Gb (4 Mb free - 54%) [PATRIOT] # FAT32
H:\ -> Removable drive # 2 Gb (2 Mb free - 92%) [] # FAT

################## | Files # Infected Folders |

Deleted ! C:\RSIT.exe
Deleted ! C:\$RECYCLE.BIN\S-1-5-21-2434014512-3133335245-3839603683-1001
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-2434014512-3133335245-3839603683-1001
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-4030417722-1536257747-3023725566-1003
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-4030417722-1536257747-3023725566-500
Deleted ! D:\AUTORUN.INF

(!) Temporary files deleted.


################## | Registry |


################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\G
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{116efa21-2cd4-11e1-883f-90e6ba5db433}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{96521912-2cc4-11e1-ad01-90e6ba5db433}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{eb2dc1db-2cb0-11e1-bb45-90e6ba5db433}

################## | Listing |

[07/02/2012 - 13:14:50 | SHD ] C:\$Recycle.Bin
[10/06/2009 - 22:42:20 | N | 24] C:\autoexec.bat
[22/12/2011 - 18:07:16 | D ] C:\Boot
[20/11/2010 - 13:40:07 | RASH | 383786] C:\bootmgr
[21/12/2011 - 20:51:28 | N | 8192] C:\BOOTSECT.BAK
[10/06/2009 - 22:42:20 | N | 10] C:\config.sys
[22/12/2011 - 19:14:33 | D ] C:\Dandík
[14/07/2009 - 05:53:55 | SHD ] C:\Documents and Settings
[22/12/2011 - 19:15:58 | D ] C:\Dominik
[21/12/2011 - 21:01:44 | N | 203464] C:\grldr
[07/02/2012 - 12:08:55 | ASH | 1583321088] C:\hiberfil.sys
[22/12/2011 - 18:32:44 | D ] C:\Intel
[03/01/2012 - 15:36:27 | D ] C:\Mamka
[21/12/2011 - 22:34:35 | RHD ] C:\MSOCache
[07/02/2012 - 12:08:57 | ASH | 2111098880] C:\pagefile.sys
[14/07/2009 - 03:37:05 | D ] C:\PerfLogs
[06/02/2012 - 20:14:42 | D ] C:\Program Files
[22/12/2011 - 18:54:25 | HD ] C:\ProgramData
[21/12/2011 - 21:01:42 | SHD ] C:\Recovery
[06/02/2012 - 19:49:02 | D ] C:\rsit
[06/02/2012 - 20:44:15 | SHD ] C:\System Volume Information
[07/02/2012 - 13:14:51 | D ] C:\UsbFix
[07/02/2012 - 13:12:35 | A | 2827] C:\UsbFix.txt
[21/12/2011 - 21:03:02 | D ] C:\Users
[21/12/2011 - 21:01:44 | N | 14] C:\win7.ld
[06/02/2012 - 19:56:01 | D ] C:\Windows
[07/02/2012 - 13:14:50 | SHD ] D:\$RECYCLE.BIN
[06/02/2012 - 19:54:44 | D ] D:\Dandík
[06/02/2012 - 19:55:35 | D ] D:\Dominik
[26/08/2009 - 01:59:45 | D ] D:\FactoryRecovery
[06/02/2012 - 19:53:16 | D ] D:\Intel
[21/07/2008 - 17:09:40 | N | 262144] D:\LenovoQDrive.exe
[06/02/2012 - 19:54:42 | D ] D:\Mamka
[03/06/2008 - 02:17:50 | N | 422982] D:\qdrive.ico
[26/08/2009 - 00:18:43 | D ] D:\showroom
[26/08/2009 - 00:01:12 | D ] D:\swtools
[25/08/2009 - 10:31:26 | SHD ] D:\System Volume Information
[20/01/2012 - 19:19:44 | N | 19749679] F:\ConvertXtoDVD 4.rar
[31/12/2011 - 13:43:32 | D ] G:\Krucipüsk - Druide (2004)
[31/12/2011 - 13:44:16 | D ] G:\Rammstein - Herzeleid
[31/12/2011 - 13:44:36 | D ] G:\Rammstein - Liebe Ist Fur Alle Da 2009
[31/12/2011 - 13:45:02 | D ] G:\Rammstein - Mutter
[31/12/2011 - 13:45:40 | D ] G:\Rammstein - Reise,reise
[31/12/2011 - 13:46:00 | D ] G:\Rammstein - Sehnsucht
[31/12/2011 - 13:47:10 | D ] G:\Scorpions - Humanity Hour I (2007)
[31/12/2011 - 13:48:14 | D ] G:\Visací zámek - klasika 2010
[23/11/2011 - 21:59:18 | D ] G:\1991-Orlík-Demise - by Stuffy
[31/12/2011 - 13:48:54 | N | 3233920] G:\Herrgott---Lady-Karneval.mp3
[24/11/2011 - 21:23:58 | D ] G:\Morcata na uteku - 2007 - Při požáru otevřít!!! - by Stuffy
[18/01/2012 - 15:52:56 | D ] G:\ovladače
[30/01/2012 - 20:33:46 | D ] G:\inf-du
[06/01/2012 - 14:17:52 | D ] G:\Stronghold Crusader
[06/01/2012 - 15:03:02 | D ] G:\vše k strongholdu
[11/01/2012 - 11:37:38 | D ] G:\Warlock - Triumph And Agony (1987)

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
F:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
G:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_PETRA-PC.zip
http://eldesaparecido.com/support.php
Thank you for your contribution.

################## | E.O.F |

[vyosek]

Tohle znate C:\win7.ld Pripadne otestujte na virustotal a dejte sem nalezy

[PredyP]

připojuje se k internetu přez usb flashdisc ufon a nevidím ho v tom logu

[vyosek]

Flash disky jsou F,G,H - jeden z nich by to mel byt, ale to ted neni podstatne

CO ten soubor co jsem psal

[PredyP]

F G H to ano ale není vidět ten čtvrtý, dal jsem do usb 3 flashdisk a přez toho ufona jsem připojen


93036d47ab0733dd88382612dc7e3e8b05b71e3e7eab9e17fe95128e1c3d372e



SHA1:

b9fd352c2d67df19a43c10c014cd183c99f21a7e



MD5:

49182436635a547be71e5d82b48a77db



File size:

14 bajtů ( 14 bytes )



File name:

win7.ld



File type:

unknown



Detection ratio:

0 / 43



Analysis date:

2012-02-07 12:58:55 UTC ( 29 minut ago )







0



0







Antivirus

Result

Update




AhnLab-V3

-

20120206



AntiVir

-

20120207



Antiy-AVL

-

20120207



Avast

-

20120207



AVG

-

20120207



BitDefender

-

20120207



ByteHero

-

20120128



CAT-QuickHeal

-

20120207



ClamAV

-

20120207



Commtouch

-

20120207



Comodo

-

20120207



DrWeb

-

20120207



Emsisoft

-

20120207



eSafe

-

20120206



eTrust-Vet

-

20120207



F-Prot

-

20120201



F-Secure

-

20120207



Fortinet

-

20120207



GData

-

20120207



Ikarus

-

20120207



Jiangmin

-

20120206



K7AntiVirus

-

20120206



Kaspersky

-

20120207



McAfee

-

20120207



McAfee-GW-Edition

-

20120207



Microsoft

-

20120207



NOD32

-

20120207



Norman

-

20120207



nProtect

-

20120207



Panda

-

20120207



PCTools

-

20120207



Prevx

-

20120207



Rising

-

20120207



Sophos

-

20120207



SUPERAntiSpyware

-

20120206



Symantec

-

20120207



TheHacker

-

20120206



TrendMicro

-

20120207



TrendMicro-HouseCall

-

20120207



VBA32

-

20120207



VIPRE

-

20120206



ViRobot

-

20120207



VirusBuster

-