Brana Firewall

[Kastab]

Dobrý den, dnes jsem zapnul PC a zjistil jsem, že mi nejde zapnout brána firewall (služba WMI). Četl jsem zde několik topiců se stejným problémem a u všech to skončilo tím, že tam byl virus a po odmazání bylo vše OK. Přikládám log z Rsitu, předem děkuji.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Administrator at 2012-09-05 16:02:57
WIN_XP Service Pack 3
System drive C: has 248 GB (81%) free of 305 GB
Total RAM: 1023 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:06:05, on 5.9.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Plocha\gpcl32bit.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\windows\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\trend micro\Administrator.exe
C:\WINDOWS\system32\taskmgr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ROC_roc_ssl_v12] "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-21-796845957-436374069-1202660629-500\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe" /c (User '?')
O4 - HKUS\S-1-5-21-796845957-436374069-1202660629-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-796845957-436374069-1202660629-500\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED (User '?')
O4 - HKUS\S-1-5-21-796845957-436374069-1202660629-500\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray (User '?')
O4 - HKUS\S-1-5-21-796845957-436374069-1202660629-500\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun (User '?')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 5853 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-796845957-436374069-1202660629-500UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-09-05 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-09-05 157672]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-08-11 77824]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2012-05-15 15504192]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"nwiz"=C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2012-05-15 1634112]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-08-21 4282728]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"ROC_roc_ssl_v12"=C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe / /PROMPT /CMPID=roc_ssl_v12 []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Documents and Settings\Administrator\Data aplikací\Google\Update\GoogleUpdate.exe [2012-09-01 116648]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2012-09-01 895376]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2012-06-26 1516632]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2012-07-13 17418928]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabled:Daemonu.exe"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"midi"=wdmaud.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\windows\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\windows\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer"=wdmaud.drv
"msacm.divxa32"=msaud32_divx.acm
"wave1"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer4"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-09-05 16:03:27 ----D---- C:\Program Files\trend micro
2012-09-05 16:02:57 ----D---- C:\rsit
2012-09-05 15:49:20 ----D---- C:\Program Files\Common Files\Java
2012-09-05 15:48:21 ----A---- C:\WINDOWS\system32\javaws.exe
2012-09-05 15:47:42 ----A---- C:\WINDOWS\system32\WindowsAccessBridge.dll
2012-09-05 15:47:42 ----A---- C:\WINDOWS\system32\javaw.exe
2012-09-05 15:47:42 ----A---- C:\WINDOWS\system32\java.exe
2012-09-05 15:47:01 ----D---- C:\Program Files\Java
2012-09-04 22:07:06 ----D---- C:\Program Files\Valve
2012-09-04 20:43:51 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2012-09-04 20:43:39 ----D---- C:\Program Files\Common Files\Skype
2012-09-04 20:43:38 ----RD---- C:\Program Files\Skype
2012-09-04 20:43:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2012-09-04 12:28:08 ----A---- C:\WINDOWS\system32\drivers\PnkBstrK.sys
2012-09-04 12:23:19 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2012-09-04 12:23:10 ----D---- C:\WINDOWS\system32\LogFiles
2012-09-04 12:23:09 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2012-09-04 12:23:08 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PunkBuster
2012-09-04 12:13:03 ----D---- C:\Program Files\GamePark2
2012-09-04 11:34:56 ----SHD---- C:\WINDOWS\ftpcache
2012-09-04 11:34:12 ----A---- C:\WINDOWS\game.ini
2012-09-04 11:31:01 ----D---- C:\Program Files\Activision
2012-09-04 11:30:05 ----D---- C:\Documents and Settings\Administrator\Data aplikací\NVIDIA
2012-09-03 21:53:17 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PhotoScape
2012-09-03 21:52:22 ----D---- C:\Program Files\PhotoScape
2012-09-03 21:27:38 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Adobe
2012-09-03 21:27:29 ----D---- C:\Program Files\MSXML 4.0
2012-09-03 21:25:42 ----A---- C:\WINDOWS\system32\NMSDVDXU.dll
2012-09-03 21:25:27 ----HD---- C:\Documents and Settings\Administrator\Data aplikací\{D94BA408-F110-488B-A65E-3AE7945F79E6}
2012-09-03 21:25:27 ----D---- C:\Documents and Settings\Administrator\Data aplikací\LG Electronics
2012-09-03 20:52:42 ----D---- C:\Documents and Settings\Administrator\Data aplikací\InstallShield
2012-09-03 20:46:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\SYSTEMAX Software Development
2012-09-03 20:46:37 ----D---- C:\Documents and Settings\Administrator\Data aplikací\SYSTEMAX Software Development
2012-09-03 20:45:08 ----HD---- C:\Documents and Settings\All Users\Data aplikací\Common Files
2012-09-03 20:33:19 ----D---- C:\Program Files\LG Electronics
2012-09-03 20:33:18 ----SHD---- C:\Config.Msi
2012-09-01 16:59:05 ----A---- C:\WINDOWS\ALCFDRTM.EXE
2012-09-01 16:59:03 ----D---- C:\WINDOWS\system32\Lang
2012-09-01 12:45:53 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Nokia
2012-09-01 12:45:52 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PC Suite
2012-09-01 12:45:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Suite
2012-09-01 12:37:04 ----D---- C:\Program Files\Common Files\PCSuite
2012-09-01 12:36:54 ----D---- C:\Program Files\Common Files\Nokia
2012-09-01 12:36:42 ----D---- C:\Program Files\DIFX
2012-09-01 12:36:41 ----A---- C:\WINDOWS\system32\drivers\pccsmcfd.sys
2012-09-01 12:36:33 ----D---- C:\Program Files\PC Connectivity Solution
2012-09-01 12:36:21 ----DC---- C:\WINDOWS\system32\DRVSTORE
2012-09-01 12:36:20 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2012-09-01 12:36:18 ----D---- C:\Program Files\Nokia
2012-09-01 12:35:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Installations
2012-09-01 12:08:58 ----A---- C:\WINDOWS\system32\ptpusb.dll
2012-09-01 12:08:57 ----A---- C:\WINDOWS\system32\ptpusd.dll
2012-09-01 12:08:56 ----A---- C:\WINDOWS\system32\drivers\usbscan.sys
2012-09-01 11:50:33 ----D---- C:\Documents and Settings\Administrator\Data aplikací\GRETECH
2012-09-01 11:45:24 ----A---- C:\Documents and Settings\Administrator\Data aplikací\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-01 11:44:43 ----A---- C:\Documents and Settings\Administrator\Data aplikací\GDIPFONTCACHEV1.DAT
2012-09-01 11:38:57 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2012-09-01 11:38:56 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2012-09-01 11:38:55 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2012-09-01 11:38:55 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2012-09-01 11:38:54 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2012-09-01 11:38:54 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2012-09-01 11:38:54 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2012-09-01 11:38:53 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2012-09-01 11:38:24 ----A---- C:\WINDOWS\avastSS.scr
2012-09-01 11:38:23 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-09-01 11:38:05 ----D---- C:\Program Files\AVAST Software
2012-09-01 11:38:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2012-09-01 11:36:34 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2012-09-01 11:36:33 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2012-09-01 11:36:32 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2012-09-01 11:36:31 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2012-09-01 11:36:31 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2012-09-01 11:36:30 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2012-09-01 11:36:30 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2012-09-01 11:35:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA
2012-09-01 11:34:10 ----A---- C:\WINDOWS\system32\nvhdap32.dll
2012-09-01 11:34:10 ----A---- C:\WINDOWS\system32\nvhdagenco3220103.dll
2012-09-01 11:34:10 ----A---- C:\WINDOWS\system32\drivers\nvhda32.sys
2012-09-01 11:34:07 ----A---- C:\WINDOWS\system32\nvgenco32.dll
2012-09-01 11:34:07 ----A---- C:\WINDOWS\system32\nvdispco32.dll
2012-09-01 11:32:52 ----D---- C:\NVIDIA
2012-09-01 11:32:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2012-09-01 11:32:29 ----A---- C:\WINDOWS\system32\npDeployJava1.dll
2012-09-01 11:32:29 ----A---- C:\WINDOWS\system32\deployJava1.dll
2012-09-01 11:30:15 ----D---- C:\Program Files\GRETECH
2012-09-01 11:29:12 ----D---- C:\Program Files\uTorrent
2012-09-01 11:28:49 ----D---- C:\Documents and Settings\Administrator\Data aplikací\uTorrent
2012-09-01 11:28:43 ----D---- C:\Documents and Settings\Administrator\Data aplikací\WinRAR
2012-09-01 11:28:41 ----D---- C:\Program Files\WinRAR
2012-09-01 11:27:24 ----D---- C:\Program Files\CCleaner
2012-09-01 11:24:58 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Sun
2012-09-01 11:23:27 ----A---- C:\WINDOWS\system32\d3d9caps.dat
2012-09-01 11:19:52 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Google
2012-09-01 11:13:48 ----A---- C:\WINDOWS\system32\hidserv.dll
2012-09-01 11:13:47 ----A---- C:\WINDOWS\system32\drivers\kbdhid.sys
2012-09-01 11:11:44 ----A---- C:\WINDOWS\system32\drivers\mouhid.sys
2012-09-01 11:07:29 ----A---- C:\WINDOWS\system32\drivers\usbccgp.sys
2012-09-01 11:07:27 ----A---- C:\WINDOWS\system32\drivers\hidusb.sys

======List of files/folders modified in the last 1 month======

2012-09-05 16:03:27 ----RD---- C:\Program Files
2012-09-05 16:03:05 ----D---- C:\WINDOWS\Prefetch
2012-09-05 15:49:21 ----SHD---- C:\WINDOWS\Installer
2012-09-05 15:49:20 ----D---- C:\Program Files\Common Files
2012-09-05 15:48:22 ----D---- C:\WINDOWS\Temp
2012-09-05 15:48:22 ----D---- C:\WINDOWS\system32
2012-09-05 15:38:33 ----D---- C:\WINDOWS
2012-09-05 15:26:36 ----D---- C:\WINDOWS\system32\CatRoot2
2012-09-05 15:24:12 ----N---- C:\WINDOWS\SchedLgU.Txt
2012-09-04 22:07:05 ----HD---- C:\Program Files\InstallShield Installation Information
2012-09-04 12:28:08 ----D---- C:\WINDOWS\system32\drivers
2012-09-04 12:14:43 ----D---- C:\WINDOWS\Minidump
2012-09-04 11:29:07 ----D---- C:\Program Files\Common Files\InstallShield
2012-09-03 21:28:18 ----D---- C:\WINDOWS\system32\CatRoot
2012-09-03 21:27:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-09-03 21:27:30 ----D---- C:\WINDOWS\WinSxS
2012-09-03 21:27:06 ----HD---- C:\WINDOWS\inf
2012-09-01 17:35:19 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2012-09-01 12:09:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-09-01 11:49:00 ----D---- C:\WINDOWS\SoftwareDistribution
2012-09-01 11:49:00 ----D---- C:\WINDOWS\Debug
2012-09-01 11:38:54 ----SD---- C:\WINDOWS\Tasks
2012-09-01 11:38:49 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-09-01 11:36:28 ----D---- C:\WINDOWS\system32\DirectX
2012-09-01 11:35:13 ----D---- C:\WINDOWS\Help
2012-09-01 11:35:13 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA Corporation
2012-09-01 11:35:07 ----D---- C:\Program Files\NVIDIA Corporation
2012-09-01 11:35:00 ----D---- C:\Documents and Settings
2012-09-01 11:19:43 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-08-21 25256]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-08-21 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-08-21 729752]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-08-21 355632]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-08-21 54232]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-08-21 21256]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-08-21 97608]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-08-11 2324480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 lgbusenum;LG Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2012-05-15 14014656]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-01-13 33408]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda32.sys [2012-04-18 123840]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-01-13 12928]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2012-06-11 19072]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2010-10-21 13056]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2010-10-21 20864]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2010-10-21 25216]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\WINDOWS\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-08-21 44808]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2012-09-05 161768]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2012-05-15 164160]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2012-09-04 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2012-09-05 214520]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]

-----------------EOF-----------------

[Rudy]

Zdravím!
Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[Kastab]

Jdu na to.

[Kastab]

Každopádně to nepomohlo a nemohu najít log z combofixu :/.

Firewall:


Hodim sem screeny přímo s problémama.

Začlo to tím že jsem si chtěl zahrát jednu hru na jednom herním portálu a napsalo to tohle (přitom mi to ještě před hodinkou šlo) - než jsem to restartoval.

Gamepark client:


A když jsem najel do služeb pomocí postupu a snažil se to spustit ručně tak to napsalo tohle.

[Rudy]

Měl by být v C:\combofix. txt.

[Kastab]

Není tam a, když jsem se ho pokusil vyhledat tak mi do neurčitého času vyhledávalo furt ty samé položky z toho combofix vypadá jako Tento Počítač.

Při aplikování combofixu jsem postupoval přesně dle postupu.

[Kastab]

Projíždím PC Mbamem (úplná kontrola), kontroluje to 10min a zatím to nalezlo 1 objekt.

// hotovo -- log

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.62.0.1300
www.malwarebytes.org

Verze databáze: v2012.09.05.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Administrator :: XXX-22E4A69236C [administrátor]

Ochrana: Povolena

5.9.2012 19:18:40
mbam-log-2012-09-05 (19-33-03).txt

Typ: Úplná kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 226174
Uplynulý čas: 14 minut, 5 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\System Volume Information\_restore{534B35A9-3FDA-4F88-9D4A-779CEF7AC439}\RP15\A0008196.exe (PUP.AdBundle) -> Žádná instrukce nebyla provedena.

(konec)

[Rudy]

Nalezenou položku smažte a zkuste obnovu systému k datu, kdy korketně fungoval.

[Kastab]

Všechno funguje a PC je i svižnější! Mnohokrát děkuji .

[Rudy]

Rádo se stalo!