VIRY.CZ

Dobrý den,

od dneška od rána jsem zaznamenal rapidní zpomalení internetu, v práci mám 20Mbit/s, kolegům to frčí, mě to jede 5Mbit/s a to ještě neustále vypadává, 2x se stránka nenačte, pak teprve jo, pak zase nenačte a takhle pořád. Zkoušel jsem jiný prohlížeč a pořád stejné. Zkoušel jsem combofix a potom MSE, nenašlo to nic. S virama obecně problém nemám, navíc dnes jsem nic rizikového neprováděl.

Dávám výpis s RSIT, jen upozornuji, že při loading event list se to asi na 90% zaseklo a musel jsem to přes správce úloh vypnout, ale log je snad ok. Za jakoukoliv pomoc budu rád.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Lighter at 2013-03-19 14:45:39
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 53 GB (65%) free of 82 GB
Total RAM: 1944 MB (42% free)

HijackThis download failed

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Lighter\AppData\Roaming\Mozilla\Firefox\Profiles\nwxqsxcx.default

prefs.js - "browser.startup.homepage" - "www.google.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.6.602.180 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.17.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=C:\Windows\system32\Wat\npWatWeb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@spoon.net/Spoon Plugin 3.33]
"Description"=Spoon Plugin 3.33
"Path"=C:\Program Files\Spoon\3.33.4.43\npMozillaSpoonPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 66280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-03-08 461216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-03-08 170912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor []
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2009-09-09 176128]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-11 137752]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-08-25 171032]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-08-25 170520]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-01-27 947152]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2013-01-08 18705664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-02-11 228864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2012-03-07 203776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Users\Lighter\AppData\Local\Temp\0.15675615993944436.exe"="C:\Users\Lighter\AppData\Local\Temp\0.15675615993944436.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.9208076682711265.exe"="C:\Users\Lighter\AppData\Local\Temp\0.9208076682711265.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Roaming\download2\svcnost.exe"="C:\Users\Lighter\AppData\Roaming\download2\svcnost.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.9523083606483687.exe"="C:\Users\Lighter\AppData\Local\Temp\0.9523083606483687.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.09572847558253228.exe"="C:\Users\Lighter\AppData\Local\Temp\0.09572847558253228.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.9853548150749413.exe"="C:\Users\Lighter\AppData\Local\Temp\0.9853548150749413.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.11576092351949807.exe"="C:\Users\Lighter\AppData\Local\Temp\0.11576092351949807.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.7462047542477686.exe"="C:\Users\Lighter\AppData\Local\Temp\0.7462047542477686.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.16802070481786036.exe"="C:\Users\Lighter\AppData\Local\Temp\0.16802070481786036.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.3258829608313345.exe"="C:\Users\Lighter\AppData\Local\Temp\0.3258829608313345.exe:*:Enabled:ldrsoft"
"C:\Users\Lighter\AppData\Local\Temp\0.7015040681395383.exe"="C:\Users\Lighter\AppData\Local\Temp\0.7015040681395383.exe:*:Enabled:ldrsoft"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.vorbis"=vorbis.acm
"VIDC.FPS1"=frapsvid.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "C:\Program Files\PSPad editor\PSPad.exe" "%1"

======List of files/folders created in the last 1 month======

2013-03-19 13:37:18 ----D---- C:\Program Files\trend micro
2013-03-19 13:37:17 ----D---- C:\rsit
2013-03-19 12:52:45 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-03-19 12:52:25 ----D---- C:\Program Files\Mozilla Firefox
2013-03-19 12:44:36 ----D---- C:\Windows\temp
2013-03-19 12:43:32 ----SHD---- C:\$RECYCLE.BIN
2013-03-13 20:04:51 ----A---- C:\Windows\system32\vbscript.dll
2013-03-13 20:04:51 ----A---- C:\Windows\system32\mshtmled.dll
2013-03-13 20:04:50 ----A---- C:\Windows\system32\jsproxy.dll
2013-03-13 20:04:50 ----A---- C:\Windows\system32\ieui.dll
2013-03-13 20:04:49 ----A---- C:\Windows\system32\msfeeds.dll
2013-03-13 20:04:49 ----A---- C:\Windows\system32\ieUnatt.exe
2013-03-13 20:04:48 ----A---- C:\Windows\system32\wininet.dll
2013-03-13 20:04:48 ----A---- C:\Windows\system32\url.dll
2013-03-13 20:04:48 ----A---- C:\Windows\system32\jscript9.dll
2013-03-13 20:04:48 ----A---- C:\Windows\system32\jscript.dll
2013-03-13 20:04:47 ----A---- C:\Windows\system32\iertutil.dll
2013-03-13 20:04:46 ----A---- C:\Windows\system32\urlmon.dll
2013-03-13 20:04:45 ----A---- C:\Windows\system32\mshtml.dll
2013-03-13 20:04:43 ----A---- C:\Windows\system32\ieframe.dll
2013-03-12 10:29:04 ----D---- C:\Program Files\Mozilla Thunderbird
2013-03-08 14:59:41 ----A---- C:\Windows\system32\javaws.exe
2013-03-08 14:59:20 ----A---- C:\Windows\system32\WindowsAccessBridge.dll
2013-03-08 14:59:20 ----A---- C:\Windows\system32\javaw.exe
2013-03-08 14:59:20 ----A---- C:\Windows\system32\java.exe
2013-03-01 13:50:14 ----D---- C:\Users\Lighter\AppData\Roaming\PSpad
2013-03-01 13:49:32 ----D---- C:\Program Files\PSPad editor
2013-02-28 17:21:15 ----D---- C:\ProgramData\phpDesigner
2013-02-27 08:54:42 ----A---- C:\Windows\system32\UIAnimation.dll
2013-02-27 08:54:26 ----A---- C:\Windows\system32\WMPhoto.dll
2013-02-27 08:54:17 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-02-27 08:54:17 ----AH---- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-02-27 08:54:17 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-02-27 08:54:15 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2013-02-27 08:54:13 ----AH---- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-02-27 08:54:13 ----AH---- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-02-27 08:54:13 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-02-27 08:54:13 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-02-27 08:54:13 ----AH---- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-02-27 08:54:13 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-02-27 08:54:12 ----A---- C:\Windows\system32\d3d10warp.dll
2013-02-27 08:54:11 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2013-02-27 08:54:11 ----A---- C:\Windows\system32\dxgi.dll
2013-02-27 08:54:11 ----A---- C:\Windows\system32\d3d10level9.dll
2013-02-27 08:54:10 ----A---- C:\Windows\system32\d3d11.dll
2013-02-27 08:54:10 ----A---- C:\Windows\system32\d3d10core.dll
2013-02-27 08:54:10 ----A---- C:\Windows\system32\d3d10_1core.dll
2013-02-27 08:54:10 ----A---- C:\Windows\system32\d3d10_1.dll
2013-02-27 08:54:09 ----A---- C:\Windows\system32\XpsPrint.dll
2013-02-27 08:54:09 ----A---- C:\Windows\system32\FntCache.dll
2013-02-27 08:54:09 ----A---- C:\Windows\system32\d3d10.dll
2013-02-27 08:54:08 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2013-02-27 08:54:08 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-02-27 08:54:08 ----A---- C:\Windows\system32\DWrite.dll
2013-02-27 08:54:07 ----A---- C:\Windows\system32\d2d1.dll

======List of files/folders modified in the last 1 month======

2013-03-19 13:54:33 ----D---- C:\Users\Lighter\AppData\Roaming\FileZilla
2013-03-19 13:37:18 ----RD---- C:\Program Files
2013-03-19 13:25:10 ----D---- C:\Windows\system32\config
2013-03-19 13:17:18 ----D---- C:\Windows\System32
2013-03-19 13:17:18 ----D---- C:\Windows\inf
2013-03-19 13:17:18 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-03-19 13:12:55 ----D---- C:\Windows\SoftwareDistribution
2013-03-19 13:12:40 ----D---- C:\Windows\pss
2013-03-19 13:12:06 ----D---- C:\Windows
2013-03-19 12:55:46 ----D---- C:\Windows\system32\Tasks
2013-03-19 12:55:45 ----D---- C:\Windows\Tasks
2013-03-19 12:48:17 ----D---- C:\Qoobox
2013-03-19 12:42:35 ----A---- C:\Windows\system.ini
2013-03-19 12:39:37 ----D---- C:\Windows\system32\drivers
2013-03-19 12:39:37 ----D---- C:\Windows\AppPatch
2013-03-19 12:39:35 ----D---- C:\Program Files\Common Files
2013-03-19 12:36:48 ----D---- C:\Windows\Prefetch
2013-03-19 12:34:41 ----SHD---- C:\System Volume Information
2013-03-19 12:23:53 ----D---- C:\Windows\system32\catroot2
2013-03-19 12:23:53 ----D---- C:\Windows\system32\catroot
2013-03-19 12:23:49 ----D---- C:\Windows\winsxs
2013-03-19 09:14:20 ----D---- C:\Windows\debug
2013-03-19 08:58:40 ----D---- C:\Users\Lighter\AppData\Roaming\PrimoPDF
2013-03-15 16:23:03 ----D---- C:\Users\Lighter\AppData\Roaming\Skype
2013-03-14 13:32:57 ----D---- C:\Program Files\Spoon
2013-03-14 12:09:29 ----D---- C:\Windows\rescache
2013-03-14 08:43:45 ----D---- C:\Windows\system32\migration
2013-03-14 08:43:44 ----D---- C:\Program Files\Internet Explorer
2013-03-13 20:06:37 ----A---- C:\Windows\system32\MRT.exe
2013-03-13 20:06:33 ----SHD---- C:\Windows\Installer
2013-03-13 20:06:31 ----D---- C:\ProgramData\Microsoft Help
2013-03-12 22:03:33 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2013-03-08 14:59:10 ----A---- C:\Windows\system32\npDeployJava1.dll
2013-03-08 14:59:10 ----A---- C:\Windows\system32\deployJava1.dll
2013-02-28 17:21:15 ----D---- C:\ProgramData
2013-02-28 17:12:13 ----D---- C:\Program Files\Java
2013-02-28 17:08:58 ----D---- C:\Users\Lighter\AppData\Roaming\NetBeans
2013-02-27 09:23:30 ----D---- C:\Windows\system32\zh-TW
2013-02-27 09:23:30 ----D---- C:\Windows\system32\zh-HK
2013-02-27 09:23:30 ----D---- C:\Windows\system32\zh-CN
2013-02-27 09:23:30 ----D---- C:\Windows\system32\tr-TR
2013-02-27 09:23:30 ----D---- C:\Windows\system32\sv-SE
2013-02-27 09:23:30 ----D---- C:\Windows\system32\pt-PT
2013-02-27 09:23:30 ----D---- C:\Windows\system32\pt-BR
2013-02-27 09:23:30 ----D---- C:\Windows\system32\pl-PL
2013-02-27 09:23:30 ----D---- C:\Windows\system32\nl-NL
2013-02-27 09:23:30 ----D---- C:\Windows\system32\ko-KR
2013-02-27 09:23:30 ----D---- C:\Windows\system32\it-IT
2013-02-27 09:23:30 ----D---- C:\Windows\system32\hu-HU
2013-02-27 09:23:30 ----D---- C:\Windows\system32\fr-FR
2013-02-27 09:23:30 ----D---- C:\Windows\system32\fi-FI
2013-02-27 09:23:30 ----D---- C:\Windows\system32\es-ES
2013-02-27 09:23:30 ----D---- C:\Windows\system32\el-GR
2013-02-27 09:23:30 ----D---- C:\Windows\system32\de-DE
2013-02-27 09:23:30 ----D---- C:\Windows\system32\cs-CZ
2013-02-27 09:23:29 ----D---- C:\Windows\system32\ru-RU
2013-02-27 09:23:29 ----D---- C:\Windows\system32\ja-JP
2013-02-27 09:23:28 ----D---- C:\Windows\system32\nb-NO
2013-02-27 09:23:28 ----D---- C:\Windows\system32\en-US
2013-02-27 09:23:28 ----D---- C:\Windows\system32\da-DK

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-01-20 195296]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-08-19 697328]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiif32.sys [2009-10-19 13480]
R1 MpKsl47933253;MpKsl47933253; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FC47B55F-7389-47F6-B547-EAA5F343BC8B}\MpKsl47933253.sys [2013-03-19 29904]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr32v.sys [2009-07-28 11552]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 100328]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-14 37376]
R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2010-11-20 117760]
R2 SVKP;SVKP; \??\C:\Windows\system32\SVKP.sys [2010-10-17 2368]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2009-09-09 154672]
R3 ATSwpWDF;AuthenTec TruePrint WBF Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2012-08-30 969192]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2009-07-22 459264]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2012-12-11 36040]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-02-11 9036800]
R3 NETw5s32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 32 Bit; C:\Windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]
R3 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840]
R3 sdbus;sdbus; C:\Windows\system32\drivers\sdbus.sys [2010-11-20 84992]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 30720]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys []
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 catchme;catchme; \??\C:\Users\Lighter\AppData\Local\Temp\catchme.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
S3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-24 116736]
S3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2011-04-27 17408]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2012-08-23 49664]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 wod0205;WeOnlyDo Network Adapter 2.5; C:\Windows\system32\DRIVERS\wod0205.sys [2011-04-23 28936]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2009-12-03 99896]
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2012-12-11 51056]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-01-27 20456]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 295232]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-07-09 104912]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-01-08 161536]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-12 253656]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-03-07 115608]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\system32\GameMon.des [2011-01-17 4077936]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Power Manager DBC Service;Power Manager DBC Service; C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2009-07-28 75040]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-31 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2012-07-09 46528]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]

-----------------EOF-----------------

Zdravim

A tenhle PC je Vas nebo pracovni\firemni

Osobní, mám na něj přístup jen já.

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Kliknete na Prohledat
• Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222

• Provedte aktualizaci
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Dostal jsem se k tomu až teď,

LOG z ADWcleaner:
# AdwCleaner v2.115 - Log vytvooen 19/03/2013 v 21:07:37
# Aktualizováno 17/03/2013 Xplode
# Operaení systém : Windows 7 Professional Service Pack 1 (32 bits)
# Uživatel : Lighter - LIGHTER-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Lighter\Desktop\adwcleaner.exe
# Volba [Prohledat]


***** [Služby] *****


***** [Soubory / Složky] *****

Složka Nalezeno : C:\Users\Lighter\AppData\Local\Conduit
Složka Nalezeno : C:\Users\Lighter\AppData\LocalLow\Conduit

***** [Registry] *****

Klíe Nalezeno : HKCU\Software\AppDataLow\Software\Conduit
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Nalezeno : HKCU\Software\Conduit
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Toolbar.CT2481032
Klíe Nalezeno : HKLM\Software\Conduit
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Nalezeno : HKU\S-1-5-21-1177361563-3352678178-607106812-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v9.0.8112.16470

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - SearchAssistant] = hxxp://www.crawler.com/search/ie.aspx?tb_id=60347
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - CustomizeSearch] = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60347

-\\ Mozilla Firefox v19.0.2 (cs)

Soubor : C:\Users\Lighter\AppData\Roaming\Mozilla\Firefox\Profiles\nwxqsxcx.default\prefs.js

[OK] Soubor je eistý.

*************************

AdwCleaner[R1].txt - [1953 octets] - [19/03/2013 21:07:37]

########## EOF - C:\AdwCleaner[R1].txt - [2013 octets] ##########


LOG z Malware
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Verze: v2013.03.19.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Lighter :: LIGHTER-PC [administrátor]

19.3.2013 21:11:15
MBAM-log-2013-03-19 (23-35-23).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 324353
Uplynulý čas: 1 hodin, 15 minut, 29 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 1
HKLM\SYSTEM\CurrentControlSet\Services\SVKP (Trojan.Agent) -> Nebyla provedena žádná instrukce.

Nalezené hodnoty v registru: 3
HKCU\Software\Microsoft|idln2 (Malware.Trace) -> Data: 1qhge3qeoapxlhofxnalh3kny2nxded -> Nebyla provedena žádná instrukce.
HKCU\Software\Microsoft|bk (Malware.Trace) -> Data: ca-pdk.com/;
-> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS|services.exe (Malware.Trace) -> Data: 1 -> Nebyla provedena žádná instrukce.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
C:\Windows\System32\SVKP.sys (Trojan.Agent) -> Nebyla provedena žádná instrukce.

(konec)


Díky za pomoc

Nasledujici soubory otestujte na VirusTotalu https://www.virustotal.com/cs/

• C:\Windows\System32\SVKP.sys
• Kliknete na Choose file
• Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
• Kliknete na Scan It
• Pokud na Vas vyskoci obrazovka jako je nize, tak kliknete na ReAnalyse
  
• Vysledek analyzy sem vlozte (jako odkaz)

Výsledek:
https://www.virustotal.com/cs/file/c43a ... 363769215/

Nalezy MBAMu smazte krom tohoto C:\Windows\System32\SVKP.sys (Trojan.Agent) -> Nebyla provedena žádná instrukce.

Spustte znovu AdwCleaner

• Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
• Kliknete na Smazat
• PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

MBAM smazáno kromě souboru SVKP.sys

Log z ADWcleaner:
# AdwCleaner v2.115 - Log vytvooen 20/03/2013 v 12:43:23
# Aktualizováno 17/03/2013 Xplode
# Operaení systém : Windows 7 Professional Service Pack 1 (32 bits)
# Uživatel : Lighter - LIGHTER-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Lighter\Desktop\adwcleaner.exe
# Volba [Vymazat]


***** [Služby] *****


***** [Soubory / Složky] *****

Složka Vymazáno : C:\Users\Lighter\AppData\Local\Conduit
Složka Vymazáno : C:\Users\Lighter\AppData\LocalLow\Conduit

***** [Registry] *****

Klíe Vymazáno : HKCU\Software\AppDataLow\Software\Conduit
Klíe Vymazáno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Vymazáno : HKCU\Software\Conduit
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Toolbar.CT2481032
Klíe Vymazáno : HKLM\Software\Conduit
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v9.0.8112.16470

Zaminino : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - SearchAssistant] = hxxp://www.crawler.com/search/ie.aspx?tb_id=60347 --> hxxp://www.google.com
Zaminino : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - CustomizeSearch] = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60347 --> hxxp://www.google.com

-\\ Mozilla Firefox v19.0.2 (cs)

Soubor : C:\Users\Lighter\AppData\Roaming\Mozilla\Firefox\Profiles\nwxqsxcx.default\prefs.js

[OK] Soubor je eistý.

*************************

AdwCleaner[S1].txt - [1802 octets] - [20/03/2013 12:43:23]

########## EOF - C:\AdwCleaner[S1].txt - [1862 octets] ##########

Fajn, nastala nejaka zmena?

Ano, už to opravdu běží stabilně

Díky za pomoc. Nevíte náhodou, jaký byl v PC vir a kde jsem ho mohl chytit? Asi nejste věštec, že? Nebo dá se to zjistit?

Tak jeste uklidime

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Bylo tam hodne reklaminiho nezadouciho SW, chce to cist co se instaluje jako doprovod - vice zde http://www.viry.cz/pozor-na-to-co-vsech ... -pocitace/

A pokud nejsou problemy ci dotazy, je to z me strany vse