Kontrola logu - padající internet

[Tommy.BX]

Zdravím, mám opět problém s padajícím a pomalým internetem, nevím jestli je to způsobený nějákou aktualizací nebo v tom je nějáká potvora, proto prosím o kontrolu Děkuji


Logfile of random's system information tool 1.09 (written by random/random)
Run by Tommy at 2012-05-07 12:38:51
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 97 GB (37%) free of 261 GB
Total RAM: 3582 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:38:59, on 7.5.2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Spyware Terminator\st_rsser.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\MediaMonkey\MediaMonkey.exe
C:\Windows\system32\conime.exe
C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\mobsync.exe
C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Tommy\Downloads\RSIT.exe
C:\Program Files\trend micro\Tommy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SpywareTerminatorShield] C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Tommy\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-21-3925026829-1360748515-940742455-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-3925026829-1360748515-940742455-1001\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'UpdatusUser')
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5E62CC6-706E-4A7A-990A-68D993FDCAB6}: NameServer = 8.8.8.8,8.8.4.4
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: sfklg.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Web'n'walk Manager mobile equipment installation service (ameisvc) - Gemfor s.r.o. - C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\Windows\system32\pr2ah4nc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files\Spyware Terminator\st_rsser.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 7300 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000UA.job
C:\Windows\tasks\RtlVistaStart.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\50g99inv.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"fe_6.0@nokia.com"=C:\Program Files\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_6.0


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-03-11 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-03-11 42272]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-09-06 3722416]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"SpywareTerminatorShield"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2012-02-20 2786480]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Tommy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-12 136176]
""= []
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2011-06-07 421160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]
C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2010-04-03 1234216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2010-11-29 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDSmartWare.lnk]
C:\PROGRA~1\WESTER~1\WDSMAR~1\FRONTP~1\WDSMAR~1.EXE [2009-10-14 9085760]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
WDDMStatus.lnk - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="sfklg.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"EnableLinkedConnections"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 2 months======

2012-05-07 12:38:51 ----D---- C:\rsit
2012-04-13 21:01:49 ----A---- C:\Windows\system32\mshtmled.dll
2012-04-13 21:01:48 ----A---- C:\Windows\system32\jscript9.dll
2012-04-13 21:01:48 ----A---- C:\Windows\system32\jscript.dll
2012-04-13 21:01:48 ----A---- C:\Windows\system32\iertutil.dll
2012-04-13 21:01:47 ----A---- C:\Windows\system32\wininet.dll
2012-04-13 21:01:47 ----A---- C:\Windows\system32\url.dll
2012-04-13 21:01:47 ----A---- C:\Windows\system32\jsproxy.dll
2012-04-13 21:01:47 ----A---- C:\Windows\system32\ieui.dll
2012-04-13 21:01:46 ----A---- C:\Windows\system32\urlmon.dll
2012-04-13 21:01:45 ----A---- C:\Windows\system32\ieframe.dll
2012-04-13 21:01:44 ----A---- C:\Windows\system32\mshtml.dll
2012-04-13 21:01:30 ----A---- C:\Windows\system32\wmi.dll
2012-04-13 21:01:30 ----A---- C:\Windows\system32\wintrust.dll
2012-04-13 21:01:30 ----A---- C:\Windows\system32\imagehlp.dll
2012-04-13 21:01:30 ----A---- C:\Windows\system32\drivers\fs_rec.sys
2012-04-13 21:01:09 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-04-13 21:01:09 ----A---- C:\Windows\system32\ntkrnlpa.exe
2012-03-22 17:33:37 ----ASH---- C:\hiberfil.sys
2012-03-15 18:50:04 ----A---- C:\Windows\system32\win32k.sys
2012-03-15 18:49:55 ----A---- C:\Windows\system32\iphlpsvc.dll
2012-03-15 18:49:55 ----A---- C:\Windows\system32\drivers\tunnel.sys
2012-03-15 18:49:50 ----A---- C:\Windows\system32\DWrite.dll
2012-03-15 18:49:50 ----A---- C:\Windows\system32\d3d10warp.dll
2012-03-15 18:49:50 ----A---- C:\Windows\system32\d3d10_1core.dll
2012-03-15 18:49:44 ----A---- C:\Windows\system32\d3d10_1.dll
2012-03-15 18:49:44 ----A---- C:\Windows\system32\d2d1.dll
2012-03-15 18:49:03 ----A---- C:\Windows\system32\rdpencom.dll
2012-03-15 18:49:03 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2012-03-11 14:24:21 ----D---- C:\Program Files\Common Files\Java
2012-03-11 14:23:59 ----A---- C:\Windows\system32\javaws.exe
2012-03-11 14:23:59 ----A---- C:\Windows\system32\javaw.exe
2012-03-11 14:23:59 ----A---- C:\Windows\system32\java.exe
2012-03-11 14:23:49 ----D---- C:\Program Files\Java
2012-03-09 14:03:12 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2012-03-09 14:03:12 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2012-03-09 14:03:12 ----A---- C:\Windows\system32\msrating.dll
2012-03-09 14:03:12 ----A---- C:\Windows\system32\msls31.dll
2012-03-09 14:03:12 ----A---- C:\Windows\system32\mshtmler.dll
2012-03-09 14:03:12 ----A---- C:\Windows\system32\iesysprep.dll
2012-03-09 14:03:12 ----A---- C:\Windows\system32\dxtrans.dll
2012-03-09 14:03:12 ----A---- C:\Windows\system32\dxtmsft.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\wextract.exe
2012-03-09 14:03:11 ----A---- C:\Windows\system32\webcheck.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\vbscript.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\pngfilt.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\occache.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\mshta.exe
2012-03-09 14:03:11 ----A---- C:\Windows\system32\msfeeds.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\licmgr10.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\inseng.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\iexpress.exe
2012-03-09 14:03:11 ----A---- C:\Windows\system32\ieUnatt.exe
2012-03-09 14:03:11 ----A---- C:\Windows\system32\iesetup.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\iernonce.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\iedkcs32.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\ieapfltr.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\ieapfltr.dat
2012-03-09 14:03:11 ----A---- C:\Windows\system32\ieakui.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\ieaksie.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\ie4uinit.exe
2012-03-09 14:03:11 ----A---- C:\Windows\system32\icardie.dll
2012-03-09 14:03:11 ----A---- C:\Windows\system32\admparse.dll
2012-03-09 14:03:10 ----A---- C:\Windows\system32\msfeedssync.exe
2012-03-09 14:03:10 ----A---- C:\Windows\system32\msfeedsbs.dll
2012-03-09 14:03:10 ----A---- C:\Windows\system32\imgutil.dll
2012-03-09 14:03:10 ----A---- C:\Windows\system32\iepeers.dll
2012-03-09 14:03:10 ----A---- C:\Windows\system32\ieakeng.dll
2012-03-09 14:03:10 ----A---- C:\Windows\system32\IEAdvpack.dll
2012-03-09 14:03:10 ----A---- C:\Windows\system32\advpack.dll

======List of files/folders modified in the last 2 months======

2012-05-07 12:39:00 ----D---- C:\Windows\temp
2012-05-07 12:38:59 ----D---- C:\Windows\Prefetch
2012-05-07 12:38:54 ----D---- C:\Program Files\Trend Micro
2012-05-07 12:30:25 ----D---- C:\Windows\System32
2012-05-07 12:30:25 ----D---- C:\Windows\inf
2012-05-07 12:30:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-05-07 12:30:21 ----D---- C:\Users\Tommy\AppData\Roaming\DAEMON Tools Lite
2012-05-07 12:30:18 ----D---- C:\Users\Tommy\AppData\Roaming\uTorrent
2012-05-07 12:30:10 ----D---- C:\Windows\Debug
2012-05-07 12:30:10 ----D---- C:\Windows
2012-05-07 12:30:05 ----D---- C:\Users\Tommy\AppData\Roaming\MediaMonkey
2012-05-06 22:18:40 ----D---- C:\Windows\system32\WDI
2012-05-06 21:42:23 ----D---- C:\Windows\tracing
2012-05-05 22:55:43 ----SHD---- C:\System Volume Information
2012-05-05 17:11:26 ----D---- C:\ProgramData\NVIDIA
2012-04-14 18:59:19 ----RSD---- C:\Windows\assembly
2012-04-14 18:59:19 ----D---- C:\Windows\Microsoft.NET
2012-04-14 14:36:25 ----D---- C:\Windows\system32\migration
2012-04-14 14:36:24 ----D---- C:\Program Files\Internet Explorer
2012-04-14 14:36:23 ----D---- C:\Windows\system32\drivers
2012-04-13 21:01:58 ----D---- C:\Windows\winsxs
2012-04-13 21:01:56 ----D---- C:\Windows\system32\catroot
2012-04-13 21:01:55 ----D---- C:\Windows\system32\catroot2
2012-04-13 21:01:44 ----SHD---- C:\Windows\Installer
2012-04-13 21:01:43 ----D---- C:\ProgramData\Microsoft Help
2012-04-13 20:52:50 ----A---- C:\Windows\system32\mrt.exe
2012-04-13 20:52:16 ----D---- C:\Program Files\Windows Mail
2012-03-25 17:07:57 ----SD---- C:\Users\Tommy\AppData\Roaming\Microsoft
2012-03-25 17:07:56 ----RD---- C:\Program Files
2012-03-25 15:58:56 ----D---- C:\Windows\Minidump
2012-03-25 15:58:56 ----D---- C:\Windows\Logs
2012-03-18 12:44:33 ----D---- C:\ProgramData\NokiaInstallerCache
2012-03-11 14:24:21 ----D---- C:\Program Files\Common Files
2012-03-11 14:23:51 ----A---- C:\Windows\system32\deployJava1.dll
2012-03-09 20:58:16 ----D---- C:\Windows\rescache
2012-03-09 20:40:51 ----D---- C:\Windows\system32\cs-CZ
2012-03-09 20:40:43 ----RD---- C:\Windows\Offline Web Pages
2012-03-09 20:40:43 ----D---- C:\Windows\PolicyDefinitions
2012-03-09 20:40:42 ----D---- C:\Windows\system32\wbem
2012-03-09 20:40:42 ----D---- C:\Windows\system32\en-US
2012-03-09 20:40:37 ----SD---- C:\Windows\Downloaded Program Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvstor32;nvstor32; C:\Windows\system32\DRIVERS\nvstor32.sys [2007-08-09 110624]
R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc); C:\Windows\system32\drivers\pe3ah4nc.sys [2007-05-18 64880]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc); C:\Windows\system32\drivers\ps6ah4nc.sys [2007-05-18 55160]
R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2009-04-17 44944]
R0 SI3132;SiI-3132 SATALink Controller; C:\Windows\system32\DRIVERS\SI3132.sys [2007-10-03 80424]
R0 SiFilter;SATALink driver accelerator; C:\Windows\system32\DRIVERS\SiWinAcc.sys [2007-10-03 19240]
R0 SiRemFil;SATALink External Device Filter; C:\Windows\system32\DRIVERS\SiRemFil.sys [2007-10-03 15400]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-09-06 52568]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-14 218688]
R1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2011-06-21 32768]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-09-06 20568]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-09-06 54616]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-10 236544]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-18 7680]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-11-18 1040544]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2011-05-25 10589800]
R3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter; C:\Windows\system32\DRIVERS\RTL8187.sys [2007-06-25 221696]
R3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver; C:\Windows\system32\DRIVERS\rtlprot.sys []
S3 catchme;catchme; \??\C:\Users\Tommy\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 massfilter;Mass Storage Filter Driver; C:\Windows\system32\drivers\massfilter.sys [2010-02-22 9216]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmb.sys [2011-11-01 18176]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbo.sys [2011-11-01 23168]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 SjyPkt;SjyPkt; \??\C:\Windows\System32\Drivers\SjyPkt.sys []
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2011-11-01 8192]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-18 35328]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-04-10 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2011-11-01 8192]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys [2010-03-02 105856]
S3 ZTEusbnmea;ZTE NMEA Port; C:\Windows\system32\DRIVERS\ZTEusbnmea.sys [2010-03-02 105856]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\Windows\system32\DRIVERS\ZTEusbser6k.sys [2010-03-02 105856]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 ameisvc;Web'n'walk Manager mobile equipment installation service; C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe [2011-03-08 122608]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-09-06 44768]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-04-06 349472]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-18 21504]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2011-05-25 615528]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service; C:\Program Files\Spyware Terminator\st_rsser.exe [2012-02-20 482992]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
R2 WDDMService;WD SmartWare Drive Manager; C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-10-14 98304]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-12 136176]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc); C:\Windows\system32\pr2ah4nc.exe [2007-05-18 407152]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2011-07-31 85096]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-12 136176]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2011-06-07 820520]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-01-04 718888]
S3 WPFFontCache_v0400;@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2011-05-25 37664]
S4 NAUpdate;@C:\Program Files\Nero\Update\NASvc.exe,-200; C:\Program Files\Nero\Update\NASvc.exe [2010-03-25 490280]

-----------------EOF-----------------

[Rudy]

Zdravím!
Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[Tommy.BX]

ComboFix 12-05-07.01 - Tommy 07.05.2012 18:53:39.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3582.2478 [GMT 2:00]
Spuštěný z: c:\users\Tommy\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-07 do 2012-05-07 )))))))))))))))))))))))))))))))
.
.
2012-05-07 17:00 . 2012-05-07 17:00 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-05-07 17:00 . 2012-05-07 17:00 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-05-07 17:00 . 2012-05-07 17:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-07 10:38 . 2012-05-07 10:39 -------- d-----w- C:\rsit
2012-05-05 15:17 . 2012-04-13 07:36 6734704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AF98F37A-1D42-464F-9B2F-BEF351F689A8}\mpengine.dll
2012-04-13 07:56 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-11 12:23 . 2011-07-14 18:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-09 12:03 . 2012-03-09 12:03 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-03-09 12:03 . 2012-03-09 12:03 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-09 12:03 . 2012-03-09 12:03 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-09 12:03 . 2012-03-09 12:03 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-03-09 12:03 . 2012-03-09 12:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-03-09 12:03 . 2012-03-09 12:03 367104 ----a-w- c:\windows\system32\html.iec
2012-03-09 12:03 . 2012-03-09 12:03 161792 ----a-w- c:\windows\system32\msls31.dll
2012-03-09 12:03 . 2012-03-09 12:03 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-03-09 12:03 . 2012-03-09 12:03 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-03-09 12:03 . 2012-03-09 12:03 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-09 12:03 . 2012-03-09 12:03 152064 ----a-w- c:\windows\system32\wextract.exe
2012-03-09 12:03 . 2012-03-09 12:03 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-03-09 12:03 . 2012-03-09 12:03 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-03-09 12:03 . 2012-03-09 12:03 11776 ----a-w- c:\windows\system32\mshta.exe
2012-03-09 12:03 . 2012-03-09 12:03 101888 ----a-w- c:\windows\system32\admparse.dll
2012-03-09 12:03 . 2012-03-09 12:03 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-03-09 12:03 . 2012-03-09 12:03 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-02-23 08:18 . 2011-06-15 08:43 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-14 15:45 . 2012-03-15 16:49 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-15 16:49 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-02-14 10:09 . 2012-02-14 10:09 1070352 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-02-13 14:12 . 2012-03-15 16:49 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-15 16:49 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-15 16:49 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-08-12 03:15 . 2011-08-29 14:00 126976 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SpywareTerminatorShield"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2012-02-20 2786480]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-10-14 2049344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDSmartWare.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-20 09:20 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-07 15:51 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]
2010-04-02 23:27 1234216 ----a-w- c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-12 12:22]
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-12 12:22]
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000Core.job
- c:\users\Tommy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-12 12:22]
.
2012-05-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000UA.job
- c:\users\Tommy\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-12 12:22]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{A5E62CC6-706E-4A7A-990A-68D993FDCAB6}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\50g99inv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-07 19:00
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2012-05-07 19:02:08
ComboFix-quarantined-files.txt 2012-05-07 17:02
ComboFix2.txt 2011-08-26 13:04
ComboFix3.txt 2011-08-16 18:32
ComboFix4.txt 2011-08-15 12:26
ComboFix5.txt 2012-05-07 16:51
.
Před spuštěním: Volných bajtů: 99 925 389 312
Po spuštění: Volných bajtů: 99 868 274 688
.
- - End Of File - - 085BFDA6BB0229CAAD71EF7407EE89B4

[Rudy]

Otevřte poznámkový blok a zkiopírujte do něj:

KillAll::

Collect::
C:\Windows\System32\Drivers\SjyPkt.sys
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000UA.job

Driver::
SjyPkt

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[Tommy.BX]

Tak vyběhl ještě tenhle log:


ComboFix 12-05-07.01 - Tommy 07.05.2012 19:57:36.7.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3582.2260 [GMT 2:00]
Spuštěný z: c:\users\Tommy\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Tommy\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
file zipped: c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
file zipped: c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
file zipped: c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000Core.job
file zipped: c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000UA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3925026829-1360748515-940742455-1000UA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SjyPkt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-07 do 2012-05-07 )))))))))))))))))))))))))))))))
.
.
2012-05-07 18:02 . 2012-05-07 18:04 -------- d-----w- c:\users\Tommy\AppData\Local\temp
2012-05-07 18:02 . 2012-05-07 18:02 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-05-07 18:02 . 2012-05-07 18:02 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-05-07 18:02 . 2012-05-07 18:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-07 10:38 . 2012-05-07 10:39 -------- d-----w- C:\rsit
2012-05-05 15:17 . 2012-04-13 07:36 6734704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AF98F37A-1D42-464F-9B2F-BEF351F689A8}\mpengine.dll
2012-04-13 07:56 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-11 12:23 . 2011-07-14 18:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-09 12:03 . 2012-03-09 12:03 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-03-09 12:03 . 2012-03-09 12:03 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-09 12:03 . 2012-03-09 12:03 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-09 12:03 . 2012-03-09 12:03 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-03-09 12:03 . 2012-03-09 12:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-03-09 12:03 . 2012-03-09 12:03 367104 ----a-w- c:\windows\system32\html.iec
2012-03-09 12:03 . 2012-03-09 12:03 161792 ----a-w- c:\windows\system32\msls31.dll
2012-03-09 12:03 . 2012-03-09 12:03 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-03-09 12:03 . 2012-03-09 12:03 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-03-09 12:03 . 2012-03-09 12:03 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-09 12:03 . 2012-03-09 12:03 152064 ----a-w- c:\windows\system32\wextract.exe
2012-03-09 12:03 . 2012-03-09 12:03 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-03-09 12:03 . 2012-03-09 12:03 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-03-09 12:03 . 2012-03-09 12:03 11776 ----a-w- c:\windows\system32\mshta.exe
2012-03-09 12:03 . 2012-03-09 12:03 101888 ----a-w- c:\windows\system32\admparse.dll
2012-03-09 12:03 . 2012-03-09 12:03 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-03-09 12:03 . 2012-03-09 12:03 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-02-23 08:18 . 2011-06-15 08:43 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-14 15:45 . 2012-03-15 16:49 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-15 16:49 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-02-14 10:09 . 2012-02-14 10:09 1070352 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-02-13 14:12 . 2012-03-15 16:49 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-15 16:49 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-15 16:49 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-08-12 03:15 . 2011-08-29 14:00 126976 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SpywareTerminatorShield"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2012-02-20 2786480]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-10-14 2049344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDSmartWare.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-20 09:20 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-07 15:51 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]
2010-04-02 23:27 1234216 ----a-w- c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{A5E62CC6-706E-4A7A-990A-68D993FDCAB6}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\50g99inv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-07 20:04
Windows 6.0.6002 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Spyware Terminator\st_rsser.exe
c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\T-Mobile\Web'n'walk Manager\ameisvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conime.exe
c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Windows Media Player\wmpnscfg.exe
.
**************************************************************************
.
Celkový čas: 2012-05-07 20:07:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-05-07 18:07
ComboFix2.txt 2012-05-07 17:02
ComboFix3.txt 2011-08-26 13:04
ComboFix4.txt 2011-08-16 18:32
ComboFix5.txt 2012-05-07 17:56
.
Před spuštěním: Volných bajtů: 99 922 259 968
Po spuštění: Volných bajtů: 99 414 085 632
.
- - End Of File - - FBC8B91AE34D40894CB503387E3B5322
Nahr nˇ probŘhlo ŁspŘçnŘ

[Rudy]

Smazáno. Nastala nějaká změna?

[Tommy.BX]

Přijde mi, že jo Ale padalo to nepravidelně, tak budu testovat a dám vědět. Zatím moc děkuji

[Rudy]

Zatím nemáte zač!

[Tommy.BX]

Tak to padá stále. Nejdříve se zpomalí připojení k internetu a pak se odpojí od sítě, chvíli se nedá na síť připojit (používám wifi) a po několika minutách se pc připojí automaticky. Nevím jestli to je hw nebo nějakou havětí, ale nevím si s tím rady.

[Rudy]

Udělejte sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 a dejte log.