VIRY.CZ

Dobrý den, nemohu stáhnout aktualizace windows, firewall norton stále blokuje "windows file sharing" a Microsoft windows 2000 SMB a také all inbound microsoft files, podle popisu v historii zabezpečení Norton security. Přeinstalovala jsem nortona z instalačního cd, nastavila výchozí nastavení firewallu, ale vše se rychle vrátilo ke starému nastavení a blokace aktualizací windows trvá. Něco mi to znovu přeinstalovává. Při skenování pc v nouzovém režimu se vyplo centrum zabezpečení. Musela jsem je znovu zapínat v normálním režimu. Skenování PC viry nenašlo.
Moc prosím o pomoc

Logfile of random's system information tool 1.10 (written by random/random)
Run by Uživatel at 2016-04-16 14:39:39
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 62 GB (27%) free of 230 GB
Total RAM: 3327 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:39:58, on 16.4.2016
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16749)
Boot mode: Normal

Running processes:
C:\Program Files\Norton Security\Engine\22.5.2.15\NS.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Jade\Downloads\RSIT.exe
C:\Program Files\trend micro\Uživatel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security\Engine\22.5.2.15\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Engine\22.5.2.15\coIEPlg.dll
O4 - HKLM\..\Run: [NvBackend] "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"
O4 - HKLM\..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3204517323-1476771048-2940318784-1001\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'Jade')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Norton Security (NS) - Symantec Corporation - C:\Program Files\Norton Security\Engine\22.5.2.15\NS.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 4731 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\jnhehrhl.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.0.0.110\coFFPlgn\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=1.1.11]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files\Norton Security\Engine\22.5.2.15\coIEPlg.dll [2015-07-10 798008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Security\Engine\22.5.2.15\coIEPlg.dll [2015-07-10 798008]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"=C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2015-08-18 2585744]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2012-06-11 10996368]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2006-11-23 56928]
"LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2006-12-05 54832]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-09-28 185896]
"OpwareSE4"=C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [2006-10-11 75304]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2016-03-01 50670720]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-04-16 13:10:00 ----D---- C:\Program Files\Common Files\Symantec Shared
2016-04-16 13:10:00 ----A---- C:\Windows\system32\drivers\SYMEVENT.SYS
2016-04-16 13:08:38 ----D---- C:\Windows\system32\drivers\NS
2016-04-16 13:08:36 ----D---- C:\Program Files\Norton Security
2016-04-16 13:08:02 ----D---- C:\Program Files\NortonInstaller
2016-04-16 12:54:06 ----ASH---- C:\hiberfil.sys
2016-04-01 15:18:49 ----D---- C:\Program Files\Common Files\Skype
2016-04-01 13:49:19 ----A---- C:\Windows\amcap.exe
2016-04-01 13:36:07 ----D---- C:\Program Files\Watchtower
2016-03-26 14:37:59 ----D---- C:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2016-04-16 14:39:58 ----D---- C:\Program Files\trend micro
2016-04-16 14:39:34 ----D---- C:\Windows\Temp
2016-04-16 14:09:57 ----D---- C:\Windows\System32
2016-04-16 13:50:22 ----D---- C:\Users\Uživatel\AppData\Roaming\Skype
2016-04-16 13:27:17 ----D---- C:\Windows\system32\Tasks
2016-04-16 13:22:40 ----SHD---- C:\System Volume Information
2016-04-16 13:12:30 ----D---- C:\Windows\inf
2016-04-16 13:12:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-04-16 13:10:00 ----D---- C:\Windows\system32\drivers
2016-04-16 13:10:00 ----D---- C:\Program Files\Common Files
2016-04-16 13:08:36 ----RD---- C:\Program Files
2016-04-16 13:08:31 ----D---- C:\ProgramData\NortonInstaller
2016-04-16 11:42:47 ----D---- C:\Users\Uživatel\AppData\Roaming\GHISLER
2016-04-16 11:38:07 ----D---- C:\Zaloha dat
2016-04-16 11:27:07 ----A---- C:\Windows\ntbtlog.txt
2016-04-15 10:49:30 ----D---- C:\Windows\Prefetch
2016-04-10 15:00:15 ----D---- C:\Windows\ehome
2016-04-10 10:05:27 ----HD---- C:\Program Files\InstallShield Installation Information
2016-04-10 10:05:27 ----D---- C:\Windows
2016-04-10 10:05:27 ----A---- C:\Windows\win.ini
2016-04-10 10:05:26 ----D---- C:\Windows\twain_32
2016-04-01 15:18:58 ----SHD---- C:\Windows\Installer
2016-04-01 15:18:50 ----RD---- C:\Program Files\Skype
2016-04-01 15:18:26 ----D---- C:\ProgramData\Skype
2016-04-01 14:23:23 ----D---- C:\Windows\system32\catroot
2016-04-01 14:14:41 ----D---- C:\Windows\system32\catroot2
2016-03-28 11:29:47 ----D---- C:\Windows\system32\WDI
2016-03-28 08:18:20 ----D---- C:\Program Files\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 SymEFASI;Symantec Extended File Attributes (SI); C:\Windows\system32\drivers\NS\1605020.00F\SYMEFASI.SYS [2015-07-11 1286896]
R1 BHDrvx86;BHDrvx86; \??\C:\Program Files\Norton Security\NortonData\22.0.0.110\Definitions\BASHDefs\20160414.001\BHDrvx86.sys [2016-04-14 1269488]
R1 ccSet_NS;NS Settings Manager; C:\Windows\system32\drivers\NS\1605020.00F\ccSetx86.sys [2015-07-11 137456]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2016-04-15 389968]
R1 IDSVix86;IDSVix86; \??\C:\Program Files\Norton Security\NortonData\22.0.0.110\Definitions\IPSDefs\20160415.001\IDSvix86.sys [2016-04-15 580344]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NS\1605020.00F\SRTSPX.SYS [2015-07-11 44792]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NS\1605020.00F\Ironx86.SYS [2015-07-11 234744]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver; C:\Windows\System32\Drivers\NS\1605020.00F\SYMTDIV.SYS [2015-07-11 358104]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2012-06-19 3240400]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
R3 NAVENG;NAVENG; \??\C:\Program Files\Norton Security\NortonData\22.0.0.110\Definitions\VirusDefs\20160415.021\NAVENG.SYS [2016-04-15 104440]
R3 NAVEX15;NAVEX15; \??\C:\Program Files\Norton Security\NortonData\22.0.0.110\Definitions\VirusDefs\20160415.021\NAVEX15.SYS [2016-04-15 1647216]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2015-08-18 10704560]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2010-03-04 261152]
R3 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NS\1605020.00F\SRTSP.SYS [2015-07-11 711408]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2016-04-16 103152]
R3 WudfPf;@%SystemRoot%\system32\drivers\Wudfpf.sys,-1000; C:\Windows\system32\drivers\WudfPf.sys [2012-07-26 66560]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2012-07-26 155136]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 EraserUtilDrv11520;EraserUtilDrv11520; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11520.sys [2016-04-15 125264]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2012-06-11 19072]
S3 usb2vcom;USB to Serial Bridge Controller; C:\Windows\System32\Drivers\usb2vcom.sys [2006-07-17 30368]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 35328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-12-14 82128]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2015-08-18 915600]
R2 NS;Norton Security; C:\Program Files\Norton Security\Engine\22.5.2.15\NS.exe [2015-07-16 282016]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [2015-08-18 1706128]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2015-08-18 670512]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2005-08-08 167936]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2016-01-29 327296]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2016-03-26 146888]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2014-04-11 772296]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2014-04-11 45744]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]

-----------------EOF-----------------

Zdravím!
Pokud vám Norton aktualizace blokuje, po dobu aktualizování ho vypněte. Slyším to ale dnes poprvé, Norton by měl aktualizace pustit v defaultním nastavení. Zkusíme to vyčistit. Spusťte tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

dobrý den, musí to být zavirované, svchost velmi zatěžuje CPU, snaží se ukončit nortona, aktualizace nortona se také začaly odinstalovávat. Blokace aktualizací windows trvají, ještě se blokuje EPMAP a UpnP Discovery a další pravidla fw se vytvořila sama, nerozumím nastavení fw, proto jej nechávám ve výchozím nastavení, ale to se vzápětí mění.
Adwcleaner jsem spustila jako správce, pokusil se zastavit nortona a byl zablokován, vyžádalo si to restart, ale nevytvořil se žádný log. Když tak mohu zkusit spustit znovu s vypnutým AV ale doufám, že neztratím kontrolu nad pc úplně

problémy se zhoršily po aktualizaci skype, myslím že jsem dostala s touto aktualizací vira, proto jsem skype odinstalovala. Účet správce má jiné grafické nastavení, než měl, změna písma i grafiky. V březnu jsem ještě aktualizace nainstalovala, i program televize pro tv kartu se stahoval sám i ručně ještě nedávno, teď je vše blokováno. Když otevřu správce úloh, pokusí se taky zastavit nortona. Když se snažím otestovat pc nortonem, přeskočí třeba 20000 souborů.

Právě se ho snažím vyčistit. Můžete dát ten log z ADW?

Log se nevytvořil, jedině mohu spustit znovu přihlášená na účet správce a vypnout při tom skenování AV, nebo norton zase ADW zablokuje. Ale riskuju ztrátu kontroly nad PC. No tak já to zkusím.

Takže druhá zkouška na účtu správce s vypnutým AV, pouze firewall zůstal zapnutý -
nenašlo nic. Když jsem pustila ADWcleaner včera (a byl zablokován) našel jen 2 položky registru
HKLR/PC Suite, dala jsem to smazat, ale blokace AV zřejmě vše zastavila. Teď vypadám jak paranoik, aktualizace windows jsou vyhledány, ale stále nelze stáhnout, v historii windows update je vidět mnohokrát neúspěšná instalace aktualizací, v historii nortona vidím pravidlo Default block Remote Desktop rejected TCP provoz s ..., default block SSDP rejected UDP provoz, default block LLMNR, default block Windows file sharing.

Také se samo změnilo nastavení Mozilly kterou používám, je zde nově doplněk od nortona toolbar Norton Identity safe, a mrcha mozilla se pokusila zastavit nortona. Toolbar jsem pak zakázala. Svchost zatěžuje pc na 99% achjo

# AdwCleaner v5.112 - Log soubor vytvořen 18/04/2016 o 14:45:15
# Aktualizováno 17/04/2016 by Xplode
# Databáze : 2016-04-17.1 [Místní]
# Operační systém : Windows Vista (TM) Home Premium Service Pack 2 (X86)
# Jméno uživatele : Uživatel - UŽIVATEL-PC
# Spuštěno z : C:\Users\Uživatel\Desktop\adwcleaner_5.112.exe
# Volba : Skenovat
# Podpora : http://toolslib.net/forum

***** [ Služby ] *****


***** [ Složky ] *****


***** [ Soubory ] *****


***** [ DLL ] *****


***** [ Zástupci ] *****


***** [ Naplánované úkoly ] *****


***** [ Registr ] *****


***** [ Webové prohlížeče ] *****


*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [1135 bytes] - [17/04/2016 21:43:57]
C:\AdwCleaner\AdwCleaner[S1].txt - [949 bytes] - [17/04/2016 21:41:12]
C:\AdwCleaner\AdwCleaner[S2].txt - [827 bytes] - [18/04/2016 14:45:15]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [899 bytes] ##########

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.

OTM spuštěno z účtu správce, AV jsem nechala zapnuté, v pravém okně OTM se zobrazilo postupně 5 userů, počítač má 3 účty, jsem z toho jelen
v mozille historie zůstala
aktualizace win neúspěšné, win update už na ně neupozorňuje dávám je znovu vyhledat

nový rsit.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Uživatel at 2016-04-19 16:18:18
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 60 GB (26%) free of 230 GB
Total RAM: 3327 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:18:43, on 19.4.2016
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16749)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Norton Security\Engine\22.6.0.142\NS.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Uživatel\Desktop\RSIT.exe
C:\Users\Uživatel\Desktop\RSIT.exe
C:\Program Files\trend micro\Uživatel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security\Engine\22.6.0.142\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Engine\22.6.0.142\coIEPlg.dll
O4 - HKLM\..\Run: [NvBackend] "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"
O4 - HKLM\..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Norton Security (NS) - Symantec Corporation - C:\Program Files\Norton Security\Engine\22.6.0.142\NS.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4501 bytes

=========Mozilla firefox=========

ProfilePath - C:\Users\Uživatel\AppData\Roaming\Mozilla\Firefox\Profiles\jnhehrhl.default

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"{C1A2A613-35F1-4FCF-B27F-2840527B6556}"=C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=1.1.11]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files\Norton Security\Engine\22.6.0.142\coIEPlg.dll [2016-02-21 805560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Security\Engine\22.6.0.142\coIEPlg.dll [2016-02-21 805560]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"=C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2015-08-18 2585744]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2012-06-11 10996368]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2006-11-23 56928]
"LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2006-12-05 54832]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-09-28 185896]
"OpwareSE4"=C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [2006-10-11 75304]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-04-19 16:07:39 ----D---- C:\_OTM
2016-04-19 07:37:12 ----A---- C:\Windows\system32\ole32.dll
2016-04-19 07:37:11 ----A---- C:\Windows\system32\ntdll.dll
2016-04-19 07:37:11 ----A---- C:\Windows\system32\kernel32.dll
2016-04-19 07:35:50 ----A---- C:\Windows\system32\msorcl32.dll
2016-04-19 07:35:49 ----A---- C:\Windows\system32\mtxoci.dll
2016-04-17 21:40:53 ----D---- C:\AdwCleaner
2016-04-16 14:46:32 ----D---- C:\Program Files\Mozilla Firefox
2016-04-16 13:10:00 ----D---- C:\Program Files\Common Files\Symantec Shared
2016-04-16 13:10:00 ----A---- C:\Windows\system32\drivers\SYMEVENT.SYS
2016-04-16 13:08:38 ----D---- C:\Windows\system32\drivers\NS
2016-04-16 13:08:36 ----D---- C:\Program Files\Norton Security
2016-04-16 13:08:02 ----D---- C:\Program Files\NortonInstaller
2016-04-16 12:54:06 ----ASH---- C:\hiberfil.sys
2016-04-01 13:49:19 ----A---- C:\Windows\amcap.exe
2016-04-01 13:36:07 ----D---- C:\Program Files\Watchtower

======List of files/folders modified in the last 1 month======

2016-04-19 16:18:29 ----D---- C:\Windows\Prefetch
2016-04-19 16:18:20 ----D---- C:\Program Files\trend micro
2016-04-19 16:18:15 ----D---- C:\Windows\Temp
2016-04-19 16:16:53 ----SHD---- C:\System Volume Information
2016-04-19 15:43:40 ----D---- C:\Windows\System32
2016-04-19 07:38:17 ----D---- C:\Windows\system32\MRT
2016-04-19 07:38:07 ----A---- C:\Windows\system32\mrt.exe
2016-04-19 07:37:38 ----D---- C:\Windows\winsxs
2016-04-19 07:37:35 ----D---- C:\Windows\system32\catroot2
2016-04-19 07:37:35 ----D---- C:\Windows\system32\catroot
2016-04-18 08:43:33 ----D---- C:\Windows\ehome
2016-04-16 22:11:23 ----SHD---- C:\Windows\Installer
2016-04-16 22:11:23 ----D---- C:\ProgramData\Skype
2016-04-16 22:11:20 ----RD---- C:\Program Files
2016-04-16 22:11:20 ----D---- C:\Program Files\Common Files
2016-04-16 22:08:36 ----D---- C:\Users\Uživatel\AppData\Roaming\Skype
2016-04-16 21:40:15 ----D---- C:\Windows\system32\Tasks
2016-04-16 21:35:11 ----D---- C:\ProgramData\Norton
2016-04-16 15:53:57 ----D---- C:\Program Files\Mozilla Maintenance Service
2016-04-16 13:12:30 ----D---- C:\Windows\inf
2016-04-16 13:12:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-04-16 13:10:00 ----D---- C:\Windows\system32\drivers
2016-04-16 13:08:31 ----D---- C:\ProgramData\NortonInstaller
2016-04-16 11:42:47 ----D---- C:\Users\Uživatel\AppData\Roaming\GHISLER
2016-04-16 11:38:07 ----D---- C:\Zaloha dat
2016-04-16 11:27:07 ----A---- C:\Windows\ntbtlog.txt
2016-04-10 10:05:27 ----HD---- C:\Program Files\InstallShield Installation Information
2016-04-10 10:05:27 ----D---- C:\Windows
2016-04-10 10:05:27 ----A---- C:\Windows\win.ini
2016-04-10 10:05:26 ----D---- C:\Windows\twain_32
2016-03-28 11:29:47 ----D---- C:\Windows\system32\WDI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 SymEFASI;Symantec Extended File Attributes (SI); C:\Windows\system32\drivers\NS\1606000.08E\SYMEFASI.SYS [2016-02-24 1287408]
R1 BHDrvx86;BHDrvx86; \??\C:\Program Files\Norton Security\NortonData\22.6.0.142\Definitions\BASHDefs\20160414.001\BHDrvx86.sys [2016-04-14 1269488]
R1 ccSet_NS;NS Settings Manager; C:\Windows\system32\drivers\NS\1606000.08E\ccSetx86.sys [2016-02-24 137456]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2016-04-15 389968]
R1 IDSVix86;IDSVix86; \??\C:\Program Files\Norton Security\NortonData\22.6.0.142\Definitions\IPSDefs\20160418.001\IDSvix86.sys [2016-04-15 580344]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NS\1606000.08E\SRTSPX.SYS [2016-02-24 44792]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NS\1606000.08E\Ironx86.SYS [2016-02-24 234736]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver; C:\Windows\System32\Drivers\NS\1606000.08E\SYMTDIV.SYS [2016-02-24 358104]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2016-04-15 125264]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2012-06-19 3240400]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
R3 NAVENG;NAVENG; \??\C:\Program Files\Norton Security\NortonData\22.6.0.142\Definitions\VirusDefs\20160418.025\NAVENG.SYS [2016-02-04 104440]
R3 NAVEX15;NAVEX15; \??\C:\Program Files\Norton Security\NortonData\22.6.0.142\Definitions\VirusDefs\20160418.025\NAVEX15.SYS [2016-02-04 1647216]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2015-08-18 10704560]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2010-03-04 261152]
R3 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NS\1606000.08E\SRTSP.SYS [2016-02-24 713968]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2016-04-16 103152]
R3 WudfPf;@%SystemRoot%\system32\drivers\Wudfpf.sys,-1000; C:\Windows\system32\drivers\WudfPf.sys [2012-07-26 66560]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2012-07-26 155136]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2012-06-11 19072]
S3 usb2vcom;USB to Serial Bridge Controller; C:\Windows\System32\Drivers\usb2vcom.sys [2006-07-17 30368]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 35328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-12-14 82128]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2015-08-18 915600]
R2 NS;Norton Security; C:\Program Files\Norton Security\Engine\22.6.0.142\NS.exe [2016-02-26 289080]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [2015-08-18 1706128]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2015-08-18 670512]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2005-08-08 167936]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2016-04-16 146888]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2014-04-11 772296]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2014-04-11 45744]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]

-----------------EOF-----------------

Smazáno. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?

Dobrý den, všechno je při starém, aktualizace win nelze stáhnout, jen tam lítá zelený pruh "Příprava instalace". Dokončeno 0%
Je ještě nějaký skener, který bychom mohli vyzkoušet? Prosím navrhněte.

Jistě. Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Omlouvám se za prodlevu, mbam mám spustit raději s vypnutým AV a firewallem a z účtu správce? Děkuji

Z účtu, který má plná práva (administrátorská). Zapnutý AV nevadí,

Děkuji, tak se do toho dám

OK.

skenováno se zapnutým AV. AV blokoval mbam, tak jsem ho vypnula, přesto další blokace mbam, skenovala jsem tedy v nouzovém režimu s vypnutým AV a firewallem. Ve všech případech mbam přeskočil skenování registru.

stav pc: problémy i s aktualizacemi nortona, aktualizace Nortona jsou rušeny, musím je stahovat znovu
svchost zatěžuje procesor na 99% a snaží se přenastavit bezpečnostní klíč registru HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHDRVX86\0000\Control\
kdykoli otevřu správce úloh, snaží se otevřít token procesu a je blokován, cesta: C:\Program Files\Norton Security\Engine\22.6.0.142\NS.exe

v minulosti byly zavirované klíče registru, pomohlo až Vaše forum, odvirování v servisu bez úspěchu, byla přeinstalace systému
existuje prosím ještě nějaký skener přímo pro registr, tuším že problém je tam? Děkuji moc za pomoc

log mbam bez nálezu:

Malwarebytes Anti-Malware
http://www.malwarebytes.org

Datum skenování: 30.4.2016
Čas skenování: 14:21:27
Protokol: mbam log 30_4_2016
Správce: Ano

Verze: 2.2.1.1043
Databáze malwaru: v2016.04.30.02
Databáze rootkitů: v2016.04.17.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows Vista Service Pack 2
CPU: x86
Souborový systém: NTFS
Uživatel: Uživatel

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 538372
Uplynulý čas: 1 hod, 50 min, 34 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Zapnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)