VIRY.CZ

Dobrý den po dlouhém čase,
obracím se uctivě s prosbou o radu a pomoc. Zhruba třetí týden se peru s neustále se odpojujícím wifi a lan připojením z domácího routeru. Jen u jednoho stroje ze čtyř v domácnosti. Ten jsem si přestěhoval z kanceláře domů, v kanceláři byl připojen na podivnou monstrózní síť, do které mohl sahat prakticky kdokoliv.
Technici providera už dvakrát měnili router, ale já si myslím, že problém je někde v počítači a možná důmyslně maskován.
Prosím proto o kontrolu logu, jestli v tom není nějaký bacilonosič:-


Logfile of random's system information tool 1.09 (written by random/random)
Run by Luboš at 2014-02-18 14:48:58
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 783 MB (2%) free of 50 GB
Total RAM: 2046 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:49:00, on 18.2.2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\atwtusb.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
C:\WINDOWS\system32\WTMKM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\ZyXEL\G-302v3\G-302v3.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Documents and Settings\Luboš\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Luboš\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Ask.com\AbineSDK\IE\DNTPSE~1.EXE
C:\Program Files\Ask.com\CallingIDSDK\CIDGlobalLight.exe
C:\Documents and Settings\Luboš\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Luboš.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.idnes.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Ask Toolbar BHO - {424C542D-5637-006A-76A7-7A786E7484D7} - "C:\Program Files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll" (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Ask Toolbar - {424C542D-5637-006A-76A7-7A786E7484D7} - "C:\Program Files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll" (file missing)
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvBackend] "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"
O4 - HKLM\..\Run: [MacrokeyManager] WTMKM.exe
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Luboš\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: ZyXEL G-302 v3 Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/ ... taller.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Ask Update Service (APNMCP) - APN LLC. - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: WTService - Unknown owner - C:\WINDOWS\system32\atwtusb.exe

--
End of file - 8844 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Antivirus Scheduled Scan.job
C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-LUBOM-0652195B6-Luboš.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-57989841-1035525444-725345543-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-57989841-1035525444-725345543-1003UA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{4D1DB19F-50B6-475F-A537-015A6E441331}.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Luboš\Data aplikací\Mozilla\Firefox\Profiles\6ti99htx.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.startup.homepage" - "http://www.svetnicka.webnode.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11, {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15, {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19, {20a82645-c095-46ed-80e3-08825760534b}:1.2.1, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, jqs@sun.com:1.0, {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.26"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 12.0.0.44 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS\system32\Adobe\Director\np32dsw_1168638.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.51.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@ngm.nexoneu.com/NxGame]
"Description"=Nexon Game Controller
"Path"=C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\npNxGameEU.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2321]
"Description"=RealMedia Plugin
"Path"=C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1483]
"Description"=RealPlayer Version Plugin
"Path"=C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@virtools.com/3DviaPlayer]
"Description"=3Dvia Player For Mozilla Based Broswer
"Path"=C:\Program Files\Virtools\3D Life Player\npvirtools.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
nppdf32.dll

C:\Documents and Settings\Luboš\Data aplikací\Mozilla\Firefox\Profiles\6ti99htx.default\extensions\
battlefieldplay4free@ea.com
{20a82645-c095-46ed-80e3-08825760534b}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{424C542D-5637-006A-76A7-7A786E7484D7}]
Ask Toolbar - C:\Program Files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll [2013-12-31 12240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-18 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2014-01-31 1521080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-18 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2014-01-31 1521080]
{424C542D-5637-006A-76A7-7A786E7484D7} - Ask Toolbar - C:\Program Files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll [2013-12-31 12240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2013-12-17 684600]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2013-12-19 15708448]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"nwiz"=C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2013-12-19 2602784]
"NvBackend"=C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2013-12-10 2279712]
"MacrokeyManager"=C:\WINDOWS\system32\WTMKM.exe [2010-12-24 7134952]
"AdobeCS5.5ServiceManager"=C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [2011-01-12 1523360]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-08-01 499608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"AdobeBridge"= []
"Google Update"=C:\Documents and Settings\Luboš\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2012-02-14 136176]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe
ZyXEL G-302 v3 Utility.lnk - C:\Program Files\ZyXEL\G-302v3\G-302v3.exe

C:\Documents and Settings\Luboš\Nabídka Start\Programy\Po spuštění
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe"="C:\Documents and Settings\All Users\Data aplikací\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe"="C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe:*:Enabled:NVIDIA Network Service TCP Exception (HTTPS)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=iyvu9_32.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"VIDC.DIVX"=divx.dll
"VIDC.X264"=x264vfw.dll
"VIDC.3iv2"=3ivxVfWCodec.dll
"msacm.vorbis"=vorbis.acm
"msacm.ac3acm"=ac3acm.acm
"VIDC.wmv3"=wmv9vcm.dll
"msacm.lhacm"=lhacm.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2014-02-18 14:42:36 ----D---- C:\rsit
2014-02-18 14:18:18 ----D---- C:\Documents and Settings\Luboš\Data aplikací\DRPSu
2014-02-18 13:06:37 ----HDC---- C:\WINDOWS\$NtUninstallKB2916036$
2014-02-18 13:02:28 ----SHD---- C:\Config.Msi
2014-02-18 12:55:59 ----A---- C:\WINDOWS\imsins.BAK
2014-02-18 11:44:25 ----D---- C:\WINDOWS\SoftwareDistribution
2014-02-18 11:23:52 ----A---- C:\WINDOWS\PSEXESVC.EXE
2014-02-18 11:20:28 ----D---- C:\RegBackup
2014-02-18 10:10:42 ----D---- C:\Program Files\Tweaking.com
2014-02-18 10:00:55 ----A---- C:\WINDOWS\system32\drivers\battc.sys
2014-02-18 10:00:53 ----D---- C:\WINDOWS\OemDir
2014-02-18 09:54:23 ----D---- C:\Program Files\DLLSuite
2014-02-18 08:53:48 ----D---- C:\Program Files\MetaGeek
2014-02-15 20:10:16 ----D---- C:\Program Files\Mozilla Firefox
2014-02-15 18:19:23 ----D---- C:\WINDOWS\ERUNT
2014-02-15 14:17:02 ----A---- C:\WINDOWS\system32\drivers\dwprot.sys
2014-02-15 14:16:54 ----D---- C:\Program Files\DrWeb
2014-02-15 14:16:54 ----D---- C:\Program Files\Common Files\Doctor Web
2014-02-15 14:16:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Doctor Web
2014-02-12 20:48:12 ----A---- C:\WINDOWS\RTacDbg.txt
2014-02-12 20:45:59 ----RA---- C:\WINDOWS\system32\drivers\EAPPkt.sys
2014-02-12 20:45:59 ----A---- C:\WINDOWS\system32\drivers\SjyPkt.sys
2014-02-12 20:45:59 ----A---- C:\WINDOWS\system32\drivers\rtl8185.sys
2014-02-12 20:45:58 ----D---- C:\Program Files\ZyXEL
2014-02-04 13:34:32 ----D---- C:\WINDOWS\pss
2014-02-02 20:10:21 ----HD---- C:\Documents and Settings\All Users\Data aplikací\Common Files
2014-02-01 18:32:23 ----HDC---- C:\WINDOWS\$NtUninstallKB2914368$
2014-02-01 15:27:56 ----A---- C:\WINDOWS\system32\javaws.exe
2014-02-01 15:27:49 ----A---- C:\WINDOWS\system32\WindowsAccessBridge.dll
2014-02-01 15:27:49 ----A---- C:\WINDOWS\system32\javaw.exe
2014-02-01 15:27:49 ----A---- C:\WINDOWS\system32\java.exe
2014-01-30 16:08:11 ----D---- C:\Games

======List of files/folders modified in the last 1 month======

2014-02-18 14:49:00 ----D---- C:\Program Files\trend micro
2014-02-18 14:48:59 ----D---- C:\WINDOWS\temp
2014-02-18 14:35:29 ----D---- C:\Documents and Settings\Luboš\Data aplikací\CallingID
2014-02-18 14:22:21 ----RD---- C:\Program Files
2014-02-18 14:20:37 ----D---- C:\WINDOWS\Prefetch
2014-02-18 14:17:13 ----SHD---- C:\WINDOWS\Installer
2014-02-18 14:06:39 ----D---- C:\WINDOWS\system32\CatRoot2
2014-02-18 13:39:25 ----RSD---- C:\WINDOWS\assembly
2014-02-18 13:39:25 ----D---- C:\WINDOWS\Microsoft.NET
2014-02-18 13:30:10 ----A---- C:\WINDOWS\win.ini
2014-02-18 13:28:10 ----D---- C:\WINDOWS
2014-02-18 13:27:10 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-02-18 13:26:44 ----D---- C:\WINDOWS\system32\drivers
2014-02-18 13:24:26 ----D---- C:\Program Files\SpeedFan
2014-02-18 13:14:02 ----D---- C:\WINDOWS\system32
2014-02-18 13:06:43 ----HD---- C:\WINDOWS\inf
2014-02-18 13:06:41 ----RSHDC---- C:\WINDOWS\system32\dllcache
2014-02-18 13:02:59 ----D---- C:\WINDOWS\WinSxS
2014-02-18 13:02:50 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2014-02-18 12:56:49 ----D---- C:\Program Files\Internet Explorer
2014-02-18 12:56:36 ----D---- C:\WINDOWS\ie8updates
2014-02-18 12:54:50 ----D---- C:\WINDOWS\system32\XPSViewer
2014-02-18 11:53:58 ----D---- C:\WINDOWS\system32\CatRoot
2014-02-18 11:41:05 ----D---- C:\WINDOWS\Registration
2014-02-18 11:20:38 ----D---- C:\WINDOWS\repair
2014-02-18 11:20:25 ----SHD---- C:\System Volume Information
2014-02-18 11:20:25 ----D---- C:\WINDOWS\system32\Restore
2014-02-18 09:58:44 ----D---- C:\WINDOWS\mui
2014-02-18 07:10:09 ----D---- C:\WINDOWS\Debug
2014-02-17 20:30:36 ----D---- C:\Documents and Settings\Luboš\Data aplikací\Adobe
2014-02-17 19:00:45 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-02-17 18:55:19 ----A---- C:\WINDOWS\system32\RTNUninst32.dll
2014-02-17 18:55:19 ----A---- C:\WINDOWS\system32\RtNicProp32.dll
2014-02-17 18:48:44 ----D---- C:\WINDOWS\system32\ReinstallBackups
2014-02-15 18:19:35 ----SD---- C:\WINDOWS\Tasks
2014-02-15 18:05:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2570947$
2014-02-15 14:16:54 ----D---- C:\Program Files\Common Files
2014-02-15 14:09:12 ----D---- C:\WINDOWS\system32\drivers\etc
2014-02-15 11:31:16 ----D---- C:\WINDOWS\system32\config
2014-02-14 17:55:00 ----HD---- C:\Program Files\InstallShield Installation Information
2014-02-14 17:55:00 ----D---- C:\Program Files\Realtek
2014-02-14 09:50:50 ----D---- C:\WINDOWS\system32\NtmsData
2014-02-13 14:13:39 ----RSD---- C:\WINDOWS\Fonts
2014-02-13 10:35:04 ----D---- C:\Documents and Settings\Luboš\Data aplikací\TS3Client
2014-02-09 11:42:19 ----D---- C:\WINDOWS\Minidump
2014-02-06 04:38:36 ----A---- C:\WINDOWS\system32\wininet.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\urlmon.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\url.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\occache.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\mstime.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\mshtmled.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\mshtml.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\msfeeds.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\licmgr10.dll
2014-02-06 00:08:34 ----A---- C:\WINDOWS\system32\jsproxy.dll
2014-02-06 00:08:33 ----A---- C:\WINDOWS\system32\iertutil.dll
2014-02-06 00:08:33 ----A---- C:\WINDOWS\system32\iepeers.dll
2014-02-06 00:08:33 ----A---- C:\WINDOWS\system32\ieframe.dll
2014-02-06 00:08:33 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2014-02-06 00:08:33 ----A---- C:\WINDOWS\system32\corpol.dll
2014-02-05 23:24:06 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2014-02-05 20:44:24 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2014-02-04 20:44:56 ----RASH---- C:\boot.ini
2014-02-04 20:44:56 ----A---- C:\WINDOWS\system.ini
2014-02-04 19:09:42 ----A---- C:\WINDOWS\system32\MRT.exe
2014-02-04 05:05:27 ----D---- C:\Program Files\Ask.com
2014-02-01 18:34:54 ----D---- C:\WINDOWS\system32\MRT
2014-02-01 18:13:35 ----D---- C:\WINDOWS\Logs
2014-02-01 15:27:49 ----D---- C:\Program Files\Java
2014-01-30 16:08:23 ----D---- C:\WINDOWS\system32\DirectX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 DwProt;DrWeb Protection; C:\WINDOWS\system32\drivers\dwprot.sys [2010-11-22 131192]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-17 44944]
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2013-12-17 135648]
R1 avkmgr;avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [2013-11-27 37352]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 meiudf;meiudf; C:\WINDOWS\System32\Drivers\meiudf.sys [2005-02-24 102320]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2013-03-04 28520]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2013-08-01 21035]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2013-12-17 90400]
R2 EAPPkt;Realtek EAPPkt Protocol; C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2006-11-15 38144]
R2 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2012-06-03 5504]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2013-11-05 5589720]
R3 moufiltr;Tablet Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\moufiltr.sys [2009-03-08 6144]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2013-12-19 12708160]
R3 rtl8185;Realtek RTL8185 54M Wireless LAN Network Adapter Driver; C:\WINDOWS\system32\DRIVERS\rtl8185.sys [2009-10-27 823936]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2014-02-17 415832]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vhidmini;Generic Virtual HID Driver; C:\WINDOWS\system32\DRIVERS\walvhid.sys [2009-08-20 6144]
S1 SBRE;SBRE; \??\C:\WINDOWS\system32\drivers\SBREdrv.sys []
S3 ActivHidSerMini;Promethean Serial Board Driver; C:\WINDOWS\system32\DRIVERS\activhidsermini.sys [2008-06-16 57088]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 EagleXNt;EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.SYS []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-04-05 47360]
S3 prmvmouse;Promethean HID Mouse Service; C:\WINDOWS\system32\DRIVERS\activmouse.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2007-10-29 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira Real-Time Protection; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2013-11-27 440376]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2013-12-17 440376]
R2 AntiVirWebService;Avira Web Protection; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2013-12-17 1011768]
R2 APNMCP;Ask Update Service; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [2013-12-31 166352]
R2 DVD-RAM_Service;DVD-RAM_Service; C:\WINDOWS\system32\DVDRAMSV.exe [2004-08-27 110592]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2013-12-18 182696]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-10 1494304]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2013-12-19 156960]
R2 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
R2 WTService;WTService; C:\WINDOWS\system32\atwtusb.exe [2011-01-26 870120]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-08-06 72704]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-05 257928]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-02-15 118896]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-07-20 754856]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Zdravím!
Nejprve zkuste přeinstalovat ovladač WiFi adaptéru.

Omlouvám se, měl jsem to napsat. Ovladač jsem aktualizoval jako první.

OK. Dejte log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

tady je log z combofix


ComboFix 14-02-18.01 - Luboš 18.02.2014 20:33:59.9.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1396 [GMT 1:00]
Spuštěný z: c:\documents and settings\LuboÜ\Plocha\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\COM+.log
c:\windows\msmqinst.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-01-18 do 2014-02-18 )))))))))))))))))))))))))))))))
.
.
2014-02-18 15:33 . 2014-02-18 18:41 49600 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-02-18 15:33 . 2014-02-18 15:33 -------- d-----w- C:\VTRoot
2014-02-18 15:31 . 2014-02-18 15:31 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\COMODO
2014-02-18 15:24 . 2014-02-18 15:25 -------- d-s---w- c:\documents and settings\All Users\Data aplikací\Shared Space
2014-02-18 15:24 . 2014-02-18 15:24 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\COMODO
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\program files\AdTrustMedia
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\COMODO
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Adtrustmedia
2014-02-18 15:22 . 2014-02-18 15:27 -------- d-----w- c:\documents and settings\All Users\Data aplikací\COMODO
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\program files\Common Files\COMODO
2014-02-18 15:21 . 2014-02-18 15:21 -------- d-----w- C:\first_launch
2014-02-18 15:21 . 2014-02-18 15:21 -------- d-----w- c:\documents and settings\Luboš\Local Settings\Data aplikací\COMODO
2014-02-18 15:21 . 2014-02-18 15:21 48392 ----a-w- c:\windows\system32\certsentry.dll
2014-02-18 15:21 . 2014-02-18 15:23 -------- d-----w- c:\program files\Comodo
2014-02-18 15:21 . 2014-02-18 15:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Comodo Downloader
2014-02-18 14:27 . 2014-02-18 14:31 -------- d-----w- C:\AdwCleaner
2014-02-18 13:42 . 2014-02-18 13:42 -------- d-----w- C:\rsit
2014-02-18 13:18 . 2014-02-18 13:18 -------- d-----w- c:\documents and settings\Luboš\Data aplikací\DRPSu
2014-02-18 10:39 . 2014-02-18 10:39 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2014-02-18 10:23 . 2014-02-18 10:42 181064 ----a-w- c:\windows\PSEXESVC.EXE
2014-02-18 10:20 . 2014-02-18 10:20 -------- d-----w- C:\RegBackup
2014-02-18 09:10 . 2014-02-18 09:10 -------- d-----w- c:\program files\Tweaking.com
2014-02-18 09:00 . 2014-02-18 09:00 14208 -c--a-w- c:\windows\system32\dllcache\battc.sys
2014-02-18 09:00 . 2014-02-18 09:00 14208 ----a-w- c:\windows\system32\drivers\battc.sys
2014-02-18 09:00 . 2014-02-18 09:00 -------- d-----w- c:\windows\OemDir
2014-02-18 09:00 . 2014-02-18 09:00 236032 -c--a-w- c:\windows\system32\dllcache\migwiz_a.exe
2014-02-18 08:54 . 2014-02-18 08:54 -------- d-----w- c:\program files\DLLSuite
2014-02-18 07:55 . 2014-02-18 07:55 -------- d-sh--w- c:\documents and settings\Luboš\Local Settings\Data aplikací\ms-drivers
2014-02-18 07:55 . 2014-02-18 07:55 -------- d-----w- c:\documents and settings\Luboš\Local Settings\Data aplikací\MetaGeek,_LLC
2014-02-18 07:53 . 2014-02-18 07:53 -------- d-----w- c:\program files\MetaGeek
2014-02-15 17:19 . 2014-02-15 17:19 -------- d-----w- c:\windows\ERUNT
2014-02-15 13:17 . 2014-02-15 13:20 -------- d-----w- c:\documents and settings\Luboš\DoctorWeb
2014-02-15 13:17 . 2010-11-22 12:30 131192 ----a-w- c:\windows\system32\drivers\dwprot.sys
2014-02-15 13:16 . 2014-02-15 16:15 -------- d-----w- c:\program files\DrWeb
2014-02-15 13:16 . 2014-02-15 13:16 -------- d-----w- c:\program files\Common Files\Doctor Web
2014-02-15 13:16 . 2014-02-15 13:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Doctor Web
2014-02-15 10:31 . 2014-02-15 11:02 -------- d-----w- c:\documents and settings\Luboš\Doctor Web
2014-02-12 19:45 . 2009-10-27 13:23 823936 ----a-w- c:\windows\system32\drivers\rtl8185.sys
2014-02-12 19:45 . 2006-11-15 15:23 38144 ----a-r- c:\windows\system32\drivers\EAPPkt.sys
2014-02-12 19:45 . 2002-10-02 08:57 13532 ----a-w- c:\windows\system32\drivers\SjyPkt.sys
2014-02-12 19:45 . 2014-02-12 19:45 -------- d-----w- c:\program files\ZyXEL
2014-02-02 19:10 . 2014-02-02 19:10 -------- d--h--w- c:\documents and settings\All Users\Data aplikací\Common Files
2014-02-01 14:27 . 2013-12-18 20:10 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-01-30 15:08 . 2014-01-30 15:08 -------- d-----w- C:\Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-17 17:55 . 2013-10-28 10:00 77528 ----a-w- c:\windows\system32\RtNicProp32.dll
2014-02-17 17:55 . 2013-10-28 10:00 102104 ----a-w- c:\windows\system32\RTNUninst32.dll
2014-02-17 17:55 . 2008-08-01 22:42 415832 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys
2014-02-06 03:38 . 2007-10-29 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2014-02-05 23:08 . 2007-10-29 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2014-02-05 23:08 . 2007-10-29 12:00 18944 ----a-w- c:\windows\system32\corpol.dll
2014-02-05 23:08 . 2007-10-29 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2014-02-05 22:24 . 2007-10-29 12:00 385024 ----a-w- c:\windows\system32\html.iec
2014-02-05 19:44 . 2012-05-25 04:48 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-02-05 19:44 . 2011-05-18 07:04 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-04 03:12 . 2007-10-29 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2013-12-19 20:17 . 2014-01-08 09:15 9637888 ----a-w- c:\windows\system32\nvopencl.dll
2013-12-19 20:17 . 2014-01-08 09:15 893728 ----a-w- c:\windows\system32\nvdispgenco3233221.dll
2013-12-19 20:17 . 2014-01-08 09:15 1049888 ----a-w- c:\windows\system32\nvdispco3233221.dll
2013-12-19 20:17 . 2012-06-22 20:11 2952992 ----a-w- c:\windows\system32\nvcuvid.dll
2013-12-19 20:17 . 2012-06-22 20:11 2747680 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-12-19 20:17 . 2012-06-22 20:11 17551360 ----a-w- c:\windows\system32\nvcompiler.dll
2013-12-19 20:17 . 2008-09-17 22:55 9682944 ----a-w- c:\windows\system32\nvcuda.dll
2013-12-19 20:17 . 2007-05-10 22:03 4085504 ----a-w- c:\windows\system32\nv4_disp.dll
2013-12-19 20:17 . 2007-05-10 22:03 2635264 ----a-w- c:\windows\system32\nvapi.dll
2013-12-19 20:17 . 2007-05-10 22:03 22188032 ----a-w- c:\windows\system32\nvoglnt.dll
2013-12-19 20:17 . 2007-05-10 22:03 12708160 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2013-12-19 18:19 . 2008-09-17 22:55 270336 ----a-w- c:\windows\system32\nvrsru.dll
2013-12-19 18:19 . 2008-09-17 22:55 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrstr.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrssl.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrssk.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrsth.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrssv.dll
2013-12-19 18:19 . 2008-09-17 22:55 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2013-12-19 18:19 . 2008-09-17 22:55 126976 ----a-w- c:\windows\system32\nvrszht.dll
2013-12-19 18:19 . 2008-09-17 22:55 335872 ----a-w- c:\windows\system32\nvrshe.dll
2013-12-19 18:19 . 2008-09-17 22:55 282624 ----a-w- c:\windows\system32\nvrsit.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrspt.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrsja.dll
2013-12-19 18:19 . 2008-09-17 22:55 266240 ----a-w- c:\windows\system32\nvrsko.dll
2013-12-19 18:19 . 2008-09-17 22:55 262144 ----a-w- c:\windows\system32\nvrshu.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrspl.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrsno.dll
2013-12-19 18:19 . 2008-09-17 22:55 335872 ----a-w- c:\windows\system32\nvrsar.dll
2013-12-19 18:19 . 2008-09-17 22:55 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2013-12-19 18:19 . 2008-09-17 22:55 282624 ----a-w- c:\windows\system32\nvrses.dll
2013-12-19 18:19 . 2008-09-17 22:55 282624 ----a-w- c:\windows\system32\nvrsel.dll
2013-12-19 18:19 . 2008-09-17 22:55 278528 ----a-w- c:\windows\system32\nvrsde.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrsda.dll
2013-12-19 18:19 . 2008-09-17 22:55 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2013-12-19 18:19 . 2008-09-17 22:55 249856 ----a-w- c:\windows\system32\nvrseng.dll
2013-12-19 18:19 . 2008-09-17 22:55 249856 ----a-w- c:\windows\system32\nvrscs.dll
2013-12-19 18:17 . 2007-05-10 22:03 54272 ----a-w- c:\windows\system32\nvwddi.dll
2013-12-19 18:17 . 2007-05-10 22:03 15708448 ----a-w- c:\windows\system32\nvcpl.dll
2013-12-19 18:17 . 2007-05-10 22:03 156960 ----a-w- c:\windows\system32\nvsvc32.exe
2013-12-19 18:17 . 2007-05-10 22:03 376096 ----a-w- c:\windows\system32\nvmctray.dll
2013-12-19 18:17 . 2007-05-10 22:03 144160 ----a-w- c:\windows\system32\nvcolor.exe
2013-12-17 13:36 . 2013-03-04 09:48 90400 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-17 13:36 . 2013-03-04 09:48 135648 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-05 11:26 . 2007-10-29 12:00 1172992 ----a-w- c:\windows\system32\msxml3.dll
2013-11-27 20:21 . 2007-10-29 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2013-11-27 19:34 . 2013-03-04 09:48 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2009-09-17 18:13 . 2009-09-17 18:13 1822848 ----a-w- c:\program files\instmsiw.exe
2009-09-17 18:13 . 2009-09-17 18:13 1709160 ----a-w- c:\program files\instmsia.exe
2009-09-17 18:12 . 2009-09-17 18:12 9795072 ----a-w- c:\program files\openofficeorg31.msi
2004-07-09 03:08 . 2004-07-09 03:08 472576 ----a-w- c:\program files\dxsetup.exe
2004-07-09 03:08 . 2004-07-09 03:08 2242560 ----a-w- c:\program files\dsetup32.dll
2004-07-09 02:03 . 2004-07-09 02:03 62976 ----a-w- c:\program files\DSETUP.dll
1998-05-24 13:26 . 2008-08-01 22:52 351232 ----a-w- c:\program files\SALAMAND.EXE
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{424C542D-5637-006A-76A7-7A786E7484D7}]
2013-12-31 13:16 12240 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{424C542D-5637-006A-76A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll" [2013-12-31 12240]
.
[HKEY_CLASSES_ROOT\clsid\{424c542d-5637-006a-76a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{424C542D-5637-006A-76A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll" [2013-12-31 12240]
.
[HKEY_CLASSES_ROOT\clsid\{424c542d-5637-006a-76a7-7a786e7484d7}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-12-17 684600]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2013-12-19 15708448]
"NvMediaCenter"="NvMCTray.dll" [2013-12-19 376096]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2013-12-19 2602784]
"NvBackend"="c:\program files\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"MacrokeyManager"="WTMKM.exe" [2010-12-24 7134952]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-08-01 499608]
"tvncontrol"="c:\program files\Common Files\COMODO\GeekBuddyRSP.exe" [2013-10-11 2327248]
"PrivDogService"="c:\program files\AdTrustMedia\PrivDog\1.8.0.15\trustedadssvc.exe" [2013-11-15 525480]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2013-11-11 1576152]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2008-8-2 155648]
Start GeekBuddy.lnk - c:\program files\Comodo\GeekBuddy\launcher.exe "unit_manager.exe" [2013-10-11 49360]
ZyXEL G-302 v3 Utility.lnk - c:\program files\ZyXEL\G-302v3\G-302v3.exe /H [2014-2-12 1593856]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetService\\NvNetworkService.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5340:TCP"= 5340:TCP:warrock
"5330:TCP"= 5330:TCP:warrock
"5350:UDP"= 5350:UDP:warrock
"5351:UDP"= 5351:UDP:warrock
.
R0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys [15.2.2014 14:17 131192]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [4.3.2013 10:48 37352]
R1 CFRMD;CFRMD;c:\windows\system32\drivers\CFRMD.sys [7.5.2013 8:00 36112]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [24.9.2013 10:54 15704]
R1 cmdGuard;COMODO Internet Security Driver;c:\windows\system32\drivers\cmdGuard.sys [14.11.2013 11:38 587864]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [24.9.2013 10:54 30552]
R1 HMD;COMODO livePCsupport Hardware Monitor Driver;c:\windows\system32\drivers\hmd.sys [7.10.2013 6:17 14272]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4.3.2013 10:48 440376]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [4.3.2013 10:48 1011768]
R2 APNMCP;Ask Update Service;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [31.12.2013 14:16 166352]
R2 CLPSLauncher;COMODO LPS Launcher;c:\program files\Common Files\COMODO\launcher_service.exe [11.10.2013 12:23 70352]
R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\Comodo\Dragon\dragon_updater.exe [11.11.2013 16:23 2098880]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [12.2.2014 20:45 38144]
R2 GeekBuddyRSP;GeekBuddyRSP Server;c:\program files\Common Files\COMODO\GeekBuddyRSP.exe [11.10.2013 10:35 2327248]
R2 NvNetworkService;NVIDIA Network Service;c:\program files\NVIDIA Corporation\NetService\NvNetworkService.exe [8.1.2014 10:21 1494304]
R2 WTService;WTService;c:\windows\system32\atwtusb.exe -s --> c:\windows\system32\atwtusb.exe -s [?]
S1 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [13.7.2012 12:28 160944]
S3 ActivHidSerMini;Promethean Serial Board Driver;c:\windows\system32\drivers\activhidsermini.sys [16.6.2008 14:38 57088]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6.12.2013 14:05 1691480]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\Comodo\COMODO Internet Security\cmdvirth.exe [24.9.2013 10:53 131288]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [5.4.2010 15:58 47360]
S3 prmvmouse;Promethean HID Mouse Service;c:\windows\system32\DRIVERS\activmouse.sys --> c:\windows\system32\DRIVERS\activmouse.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 12:37 517096]
.
Obsah adresáře 'Naplánované úlohy'
.
2014-02-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-25 19:44]
.
2014-02-12 c:\windows\Tasks\AdobeAAMUpdater-1.0-LUBOM-0652195B6-Luboš.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-08-01 14:08]
.
2014-02-18 c:\windows\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11 13:58]
.
2014-02-18 c:\windows\Tasks\User_Feed_Synchronization-{4D1DB19F-50B6-475F-A537-015A6E441331}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: {{2F5C139F-79BD-4C84-A95A-E7140525BC55} - {5B06364D-FF00-4BD5-9D01-4379952513F2} - c:\program files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\sign
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojeplatba.cz\www
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{25E69404-793D-4115-813C-7BF45440F623}: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{512BF48C-FC8F-4DAE-8417-9D883414CF73}: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Luboš\Data aplikací\Mozilla\Firefox\Profiles\6ti99htx.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.svetnicka.webnode.cz/
FF - ExtSQL: 2014-02-18 16:22; PrivDog@AdTrustMedia.com; c:\documents and settings\Luboš\Data aplikací\Mozilla\Firefox\Profiles\6ti99htx.default\extensions\PrivDog@AdTrustMedia.com.xpi
FF - ExtSQL: !HIDDEN! 2009-10-20 09:07; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files\Ask.com\GenericAskToolbar.dll
HKCU-Run-AdobeBridge - (no file)
AddRemove-PhotoStage - c:\program files\NCH Software\PhotoStage\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-02-18 20:45
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-57989841-1035525444-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@SACL=
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(708)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
.
- - - - - - - > 'csrss.exe'(612)
c:\windows\system32\cmdcsr.dll
.
Celkový čas: 2014-02-18 20:49:23
ComboFix-quarantined-files.txt 2014-02-18 19:49
.
Před spuštěním: 360 873 984
Po spuštění: 972 455 936
.
- - End Of File - - 6A548D8D5E9E8EB66197AB7FB56078C3
413FC2A0C716421B3158746D63736515

Přesuňte ComboFix na kořenový adresář c:\. otevřte poznámkový blok a zkopírujte do něj:

KillAll::

File::
c:\windows\system32\drivers\SjyPkt.sys
c:\windows\system32\drivers\EAPPkt.sys

Folder::
c:\program files\AskPartnerNetwork

Driver::
SjyPkt
EAPPkt

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{424C542D-5637-006A-76A7-7A786E7484D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
[-HKEY_CLASSES_ROOT\clsid\{424c542d-5637-006a-76a7-7a786e7484d7}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

Regnull::
[HKEY_USERS\S-1-5-21-57989841-1035525444-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]

Reboot::

uložte rovněž na kořenový adresář c:\ jako CFScript.txt. Pak jej myší přetáhněte (v průzkumníku windows, nebo jiném souborovém manageru)nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

tak hotovo a tady je log

ComboFix 14-02-18.01 - Luboš 18.02.2014 22:03:07.10.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1259 [GMT 1:00]
Spuštěný z: C:\ComboFix.exe
Použité ovládací přepínače :: C:\CFScript.txt.txt
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
FILE ::
"c:\windows\system32\drivers\EAPPkt.sys"
"c:\windows\system32\drivers\SjyPkt.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AskPartnerNetwork
c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe
c:\program files\AskPartnerNetwork\Toolbar\APNSetup.exe
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Passport.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1031.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1033.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1034.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1036.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1040.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1041.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1043.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1045.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\1049.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\2070.mst
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\appdata\Mozilla\Firefox\Profiles\{DefaultProfilesFolder}\extensions\toolbar_BLT-V7@apn.ask.com.xpi
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\AskToolbarInstaller-12.10.0_BLT-V7.msi
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\AskToolbarInstaller-12.2.2_BLT-V7.msi
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\AskToolbarInstaller-12.3.0_BLT-V7.msi
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\AskToolbarInstaller-12.5.1_BLT-V7.msi
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\AskToolbarInstaller-12.6.0_BLT-V7.msi
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\AskToolbarInstaller-12.7.0_BLT-V7.msi
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\{Crx_Version}\Toolbar.crx
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\ToolbarCR.crx
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\Update.xml
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport_x64.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\apnmcp.exe
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\searchhook.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\ServiceLocator.exe
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\SO.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\Toolbar.exe
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar_x64.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\ToolbarPS.dll
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\UpdateManager.exe
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\{PartnerID}\config.xml
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\ask-search.xml
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\VNT\content.zip
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\VNT\vntldr.exe
c:\program files\AskPartnerNetwork\Toolbar\BLT-V7\Source\program files\VNT\vntsrv.dll
c:\program files\AskPartnerNetwork\Toolbar\searchhook.dll
c:\program files\AskPartnerNetwork\Toolbar\ServiceLocator.exe
c:\program files\AskPartnerNetwork\Toolbar\SO.dll
c:\program files\AskPartnerNetwork\Toolbar\toolbar.dll
c:\program files\AskPartnerNetwork\Toolbar\Toolbar.exe
c:\program files\AskPartnerNetwork\Toolbar\ToolbarPS.dll
c:\program files\AskPartnerNetwork\Toolbar\UpdateManager.exe
c:\program files\AskPartnerNetwork\Toolbar\Updater\ask-search.xml
c:\program files\AskPartnerNetwork\Toolbar\Updater\BLT-V7\config.xml
c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EAPPKT
-------\Service_EAPPkt
-------\Legacy_APNMCP
-------\Legacy_APNMCP
-------\Service_APNMCP
-------\Service_APNMCP
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-01-18 do 2014-02-18 )))))))))))))))))))))))))))))))
.
.
2014-02-18 15:33 . 2014-02-18 18:41 49600 ----a-w- c:\windows\system32\drivers\fvstore.dat
2014-02-18 15:33 . 2014-02-18 15:33 -------- d-----w- C:\VTRoot
2014-02-18 15:31 . 2014-02-18 15:31 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\COMODO
2014-02-18 15:24 . 2014-02-18 15:25 -------- d-s---w- c:\documents and settings\All Users\Data aplikací\Shared Space
2014-02-18 15:24 . 2014-02-18 15:24 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\COMODO
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\program files\AdTrustMedia
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\COMODO
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Adtrustmedia
2014-02-18 15:22 . 2014-02-18 15:27 -------- d-----w- c:\documents and settings\All Users\Data aplikací\COMODO
2014-02-18 15:22 . 2014-02-18 15:22 -------- d-----w- c:\program files\Common Files\COMODO
2014-02-18 15:21 . 2014-02-18 15:21 -------- d-----w- C:\first_launch
2014-02-18 15:21 . 2014-02-18 15:21 -------- d-----w- c:\documents and settings\Luboš\Local Settings\Data aplikací\COMODO
2014-02-18 15:21 . 2014-02-18 15:21 48392 ----a-w- c:\windows\system32\certsentry.dll
2014-02-18 15:21 . 2014-02-18 15:23 -------- d-----w- c:\program files\Comodo
2014-02-18 15:21 . 2014-02-18 15:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Comodo Downloader
2014-02-18 14:27 . 2014-02-18 14:31 -------- d-----w- C:\AdwCleaner
2014-02-18 13:42 . 2014-02-18 13:42 -------- d-----w- C:\rsit
2014-02-18 13:18 . 2014-02-18 13:18 -------- d-----w- c:\documents and settings\Luboš\Data aplikací\DRPSu
2014-02-18 10:39 . 2014-02-18 10:39 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2014-02-18 10:23 . 2014-02-18 10:42 181064 ----a-w- c:\windows\PSEXESVC.EXE
2014-02-18 10:20 . 2014-02-18 10:20 -------- d-----w- C:\RegBackup
2014-02-18 09:10 . 2014-02-18 09:10 -------- d-----w- c:\program files\Tweaking.com
2014-02-18 09:00 . 2014-02-18 09:00 14208 -c--a-w- c:\windows\system32\dllcache\battc.sys
2014-02-18 09:00 . 2014-02-18 09:00 14208 ----a-w- c:\windows\system32\drivers\battc.sys
2014-02-18 09:00 . 2014-02-18 09:00 -------- d-----w- c:\windows\OemDir
2014-02-18 09:00 . 2014-02-18 09:00 236032 -c--a-w- c:\windows\system32\dllcache\migwiz_a.exe
2014-02-18 08:54 . 2014-02-18 08:54 -------- d-----w- c:\program files\DLLSuite
2014-02-18 07:55 . 2014-02-18 07:55 -------- d-sh--w- c:\documents and settings\Luboš\Local Settings\Data aplikací\ms-drivers
2014-02-18 07:55 . 2014-02-18 07:55 -------- d-----w- c:\documents and settings\Luboš\Local Settings\Data aplikací\MetaGeek,_LLC
2014-02-18 07:53 . 2014-02-18 07:53 -------- d-----w- c:\program files\MetaGeek
2014-02-15 17:19 . 2014-02-15 17:19 -------- d-----w- c:\windows\ERUNT
2014-02-15 13:17 . 2014-02-15 13:20 -------- d-----w- c:\documents and settings\Luboš\DoctorWeb
2014-02-15 13:17 . 2010-11-22 12:30 131192 ----a-w- c:\windows\system32\drivers\dwprot.sys
2014-02-15 13:16 . 2014-02-15 16:15 -------- d-----w- c:\program files\DrWeb
2014-02-15 13:16 . 2014-02-15 13:16 -------- d-----w- c:\program files\Common Files\Doctor Web
2014-02-15 13:16 . 2014-02-15 13:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Doctor Web
2014-02-15 10:31 . 2014-02-15 11:02 -------- d-----w- c:\documents and settings\Luboš\Doctor Web
2014-02-12 19:45 . 2009-10-27 13:23 823936 ----a-w- c:\windows\system32\drivers\rtl8185.sys
2014-02-12 19:45 . 2006-11-15 15:23 38144 ----a-r- c:\windows\system32\drivers\EAPPkt.sys
2014-02-12 19:45 . 2002-10-02 08:57 13532 ----a-w- c:\windows\system32\drivers\SjyPkt.sys
2014-02-12 19:45 . 2014-02-12 19:45 -------- d-----w- c:\program files\ZyXEL
2014-02-02 19:10 . 2014-02-02 19:10 -------- d--h--w- c:\documents and settings\All Users\Data aplikací\Common Files
2014-02-01 14:27 . 2013-12-18 20:10 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-01-30 15:08 . 2014-01-30 15:08 -------- d-----w- C:\Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-17 17:55 . 2013-10-28 10:00 77528 ----a-w- c:\windows\system32\RtNicProp32.dll
2014-02-17 17:55 . 2013-10-28 10:00 102104 ----a-w- c:\windows\system32\RTNUninst32.dll
2014-02-17 17:55 . 2008-08-01 22:42 415832 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys
2014-02-06 03:38 . 2007-10-29 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2014-02-05 23:08 . 2007-10-29 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2014-02-05 23:08 . 2007-10-29 12:00 18944 ----a-w- c:\windows\system32\corpol.dll
2014-02-05 23:08 . 2007-10-29 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2014-02-05 22:24 . 2007-10-29 12:00 385024 ----a-w- c:\windows\system32\html.iec
2014-02-05 19:44 . 2012-05-25 04:48 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-02-05 19:44 . 2011-05-18 07:04 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-04 03:12 . 2007-10-29 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2013-12-19 20:17 . 2014-01-08 09:15 9637888 ----a-w- c:\windows\system32\nvopencl.dll
2013-12-19 20:17 . 2014-01-08 09:15 893728 ----a-w- c:\windows\system32\nvdispgenco3233221.dll
2013-12-19 20:17 . 2014-01-08 09:15 1049888 ----a-w- c:\windows\system32\nvdispco3233221.dll
2013-12-19 20:17 . 2012-06-22 20:11 2952992 ----a-w- c:\windows\system32\nvcuvid.dll
2013-12-19 20:17 . 2012-06-22 20:11 2747680 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-12-19 20:17 . 2012-06-22 20:11 17551360 ----a-w- c:\windows\system32\nvcompiler.dll
2013-12-19 20:17 . 2008-09-17 22:55 9682944 ----a-w- c:\windows\system32\nvcuda.dll
2013-12-19 20:17 . 2007-05-10 22:03 4085504 ----a-w- c:\windows\system32\nv4_disp.dll
2013-12-19 20:17 . 2007-05-10 22:03 2635264 ----a-w- c:\windows\system32\nvapi.dll
2013-12-19 20:17 . 2007-05-10 22:03 22188032 ----a-w- c:\windows\system32\nvoglnt.dll
2013-12-19 20:17 . 2007-05-10 22:03 12708160 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2013-12-19 18:19 . 2008-09-17 22:55 270336 ----a-w- c:\windows\system32\nvrsru.dll
2013-12-19 18:19 . 2008-09-17 22:55 270336 ----a-w- c:\windows\system32\nvrsptb.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrstr.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrssl.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrssk.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrsth.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrssv.dll
2013-12-19 18:19 . 2008-09-17 22:55 229376 ----a-w- c:\windows\system32\nvrszhc.dll
2013-12-19 18:19 . 2008-09-17 22:55 126976 ----a-w- c:\windows\system32\nvrszht.dll
2013-12-19 18:19 . 2008-09-17 22:55 335872 ----a-w- c:\windows\system32\nvrshe.dll
2013-12-19 18:19 . 2008-09-17 22:55 282624 ----a-w- c:\windows\system32\nvrsit.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrspt.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrsnl.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrsja.dll
2013-12-19 18:19 . 2008-09-17 22:55 266240 ----a-w- c:\windows\system32\nvrsko.dll
2013-12-19 18:19 . 2008-09-17 22:55 262144 ----a-w- c:\windows\system32\nvrshu.dll
2013-12-19 18:19 . 2008-09-17 22:55 258048 ----a-w- c:\windows\system32\nvrspl.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrsno.dll
2013-12-19 18:19 . 2008-09-17 22:55 335872 ----a-w- c:\windows\system32\nvrsar.dll
2013-12-19 18:19 . 2008-09-17 22:55 286720 ----a-w- c:\windows\system32\nvrsfr.dll
2013-12-19 18:19 . 2008-09-17 22:55 282624 ----a-w- c:\windows\system32\nvrses.dll
2013-12-19 18:19 . 2008-09-17 22:55 282624 ----a-w- c:\windows\system32\nvrsel.dll
2013-12-19 18:19 . 2008-09-17 22:55 278528 ----a-w- c:\windows\system32\nvrsde.dll
2013-12-19 18:19 . 2008-09-17 22:55 274432 ----a-w- c:\windows\system32\nvrsesm.dll
2013-12-19 18:19 . 2008-09-17 22:55 253952 ----a-w- c:\windows\system32\nvrsda.dll
2013-12-19 18:19 . 2008-09-17 22:55 249856 ----a-w- c:\windows\system32\nvrsfi.dll
2013-12-19 18:19 . 2008-09-17 22:55 249856 ----a-w- c:\windows\system32\nvrseng.dll
2013-12-19 18:19 . 2008-09-17 22:55 249856 ----a-w- c:\windows\system32\nvrscs.dll
2013-12-19 18:17 . 2007-05-10 22:03 54272 ----a-w- c:\windows\system32\nvwddi.dll
2013-12-19 18:17 . 2007-05-10 22:03 15708448 ----a-w- c:\windows\system32\nvcpl.dll
2013-12-19 18:17 . 2007-05-10 22:03 156960 ----a-w- c:\windows\system32\nvsvc32.exe
2013-12-19 18:17 . 2007-05-10 22:03 376096 ----a-w- c:\windows\system32\nvmctray.dll
2013-12-19 18:17 . 2007-05-10 22:03 144160 ----a-w- c:\windows\system32\nvcolor.exe
2013-12-17 13:36 . 2013-03-04 09:48 90400 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-17 13:36 . 2013-03-04 09:48 135648 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-05 11:26 . 2007-10-29 12:00 1172992 ----a-w- c:\windows\system32\msxml3.dll
2013-11-27 20:21 . 2007-10-29 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2013-11-27 19:34 . 2013-03-04 09:48 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2009-09-17 18:13 . 2009-09-17 18:13 1822848 ----a-w- c:\program files\instmsiw.exe
2009-09-17 18:13 . 2009-09-17 18:13 1709160 ----a-w- c:\program files\instmsia.exe
2009-09-17 18:12 . 2009-09-17 18:12 9795072 ----a-w- c:\program files\openofficeorg31.msi
2004-07-09 03:08 . 2004-07-09 03:08 472576 ----a-w- c:\program files\dxsetup.exe
2004-07-09 03:08 . 2004-07-09 03:08 2242560 ----a-w- c:\program files\dsetup32.dll
2004-07-09 02:03 . 2004-07-09 02:03 62976 ----a-w- c:\program files\DSETUP.dll
1998-05-24 13:26 . 2008-08-01 22:52 351232 ----a-w- c:\program files\SALAMAND.EXE
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-12-17 684600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2013-12-19 15708448]
"NvMediaCenter"="NvMCTray.dll" [2013-12-19 376096]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2013-12-19 2602784]
"NvBackend"="c:\program files\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
"MacrokeyManager"="WTMKM.exe" [2010-12-24 7134952]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-08-01 499608]
"tvncontrol"="c:\program files\Common Files\COMODO\GeekBuddyRSP.exe" [2013-10-11 2327248]
"PrivDogService"="c:\program files\AdTrustMedia\PrivDog\1.8.0.15\trustedadssvc.exe" [2013-11-15 525480]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2013-11-11 1576152]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2008-8-2 155648]
Start GeekBuddy.lnk - c:\program files\Comodo\GeekBuddy\launcher.exe "unit_manager.exe" [2013-10-11 49360]
ZyXEL G-302 v3 Utility.lnk - c:\program files\ZyXEL\G-302v3\G-302v3.exe /H [2014-2-12 1593856]
.
c:\documents and settings\Luboš\Nabídka Start\Programy\Po spuštění\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetService\\NvNetworkService.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5340:TCP"= 5340:TCP:warrock
"5330:TCP"= 5330:TCP:warrock
"5350:UDP"= 5350:UDP:warrock
"5351:UDP"= 5351:UDP:warrock
.
R0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys [15.2.2014 14:17 131192]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [4.3.2013 10:48 37352]
R1 CFRMD;CFRMD;c:\windows\system32\drivers\CFRMD.sys [7.5.2013 8:00 36112]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [24.9.2013 10:54 15704]
R1 cmdGuard;COMODO Internet Security Driver;c:\windows\system32\drivers\cmdGuard.sys [14.11.2013 11:38 587864]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [24.9.2013 10:54 30552]
R1 HMD;COMODO livePCsupport Hardware Monitor Driver;c:\windows\system32\drivers\hmd.sys [7.10.2013 6:17 14272]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4.3.2013 10:48 440376]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [4.3.2013 10:48 1011768]
R2 CLPSLauncher;COMODO LPS Launcher;c:\program files\Common Files\COMODO\launcher_service.exe [11.10.2013 12:23 70352]
R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\Comodo\Dragon\dragon_updater.exe [11.11.2013 16:23 2098880]
R2 GeekBuddyRSP;GeekBuddyRSP Server;c:\program files\Common Files\COMODO\GeekBuddyRSP.exe [11.10.2013 10:35 2327248]
R2 NvNetworkService;NVIDIA Network Service;c:\program files\NVIDIA Corporation\NetService\NvNetworkService.exe [8.1.2014 10:21 1494304]
R2 WTService;WTService;c:\windows\system32\atwtusb.exe -s --> c:\windows\system32\atwtusb.exe -s [?]
S1 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [13.7.2012 12:28 160944]
S3 ActivHidSerMini;Promethean Serial Board Driver;c:\windows\system32\drivers\activhidsermini.sys [16.6.2008 14:38 57088]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6.12.2013 14:05 1691480]
S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\Comodo\COMODO Internet Security\cmdvirth.exe [24.9.2013 10:53 131288]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [5.4.2010 15:58 47360]
S3 prmvmouse;Promethean HID Mouse Service;c:\windows\system32\DRIVERS\activmouse.sys --> c:\windows\system32\DRIVERS\activmouse.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 12:37 517096]
.
Obsah adresáře 'Naplánované úlohy'
.
2014-02-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-25 19:44]
.
2014-02-12 c:\windows\Tasks\AdobeAAMUpdater-1.0-LUBOM-0652195B6-Luboš.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-08-01 14:08]
.
2014-02-18 c:\windows\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
- c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11 13:58]
.
2014-02-18 c:\windows\Tasks\User_Feed_Synchronization-{4D1DB19F-50B6-475F-A537-015A6E441331}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
uInternet Connection Wizard,ShellNext = iexplore
IE: {{2F5C139F-79BD-4C84-A95A-E7140525BC55} - {5B06364D-FF00-4BD5-9D01-4379952513F2} - c:\program files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\sign
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojeplatba.cz\www
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{25E69404-793D-4115-813C-7BF45440F623}: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{512BF48C-FC8F-4DAE-8417-9D883414CF73}: NameServer = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Luboš\Data aplikací\Mozilla\Firefox\Profiles\6ti99htx.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.svetnicka.webnode.cz/
FF - ExtSQL: 2014-02-18 16:22; PrivDog@AdTrustMedia.com; c:\documents and settings\Luboš\Data aplikací\Mozilla\Firefox\Profiles\6ti99htx.default\extensions\PrivDog@AdTrustMedia.com.xpi
FF - ExtSQL: !HIDDEN! 2009-10-20 09:07; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-02-18 22:18
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-57989841-1035525444-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@SACL=
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
.
- - - - - - - > 'explorer.exe'(1596)
c:\windows\system32\guard32.dll
c:\program files\NVIDIA Corporation\nview\nview.dll
c:\program files\NVIDIA Corporation\nview\NVWRSCS.DLL
c:\windows\System32\WS2_32.dll
c:\windows\System32\WS2HELP.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
- - - - - - - > 'csrss.exe'(616)
c:\windows\system32\cmdcsr.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\DVDRAMSV.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\atwtusb.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\windows\system32\RunDLL32.exe
c:\windows\system32\WTMKM.exe
c:\windows\system32\rundll32.exe
c:\program files\ZyXEL\G-302v3\G-302v3.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Comodo\GeekBuddy\unit_manager.exe
c:\program files\Comodo\GeekBuddy\unit.exe
c:\program files\COMODO\COMODO Internet Security\cavwp.exe
c:\windows\system32\atwtusb.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\COMODO\COMODO Internet Security\cis.exe
.
**************************************************************************
.
Celkový čas: 2014-02-18 22:22:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-02-18 21:22
ComboFix2.txt 2014-02-18 19:49
.
Před spuštěním: 980 230 144
Po spuštění: 866 566 144
.
- - End Of File - - 46E8D9D0049F30490AD4988DB4198DF9
413FC2A0C716421B3158746D63736515

Smazáno. Nastala nějaká změna?

po posledním restartu jsme musel připojení k wifi obnovit, ale už se samo neodpojuje, což je dobrý zpráva

OK. Nějakou chvíli to testujte a ozvěte se.

děkuji mockrát, ozvu.

Zatím není za co.

Dobrý večer, tak jsem celý den nezaznamenal žádný problém, až teď večer opět se neustále odpojuje a znovu se připojí po jen restartu. Schválně jsem znovu přeinstaloval driver k Realtek 8185 a vyskočila na mě poprvé za 6 let totohle počítače modrá smrt kvůli aegisp.sys

To je ovladač wifi. Před tím jste tam měl jinou verzi?

Dobrý den,

ano, wifi.

ano jinou verzi.

Správce sítě v budově, kde mám kancelář, mi tam pro připojení instaloval novější, se kterým začaly ty potíže.