Prosím o radu a kontrolu, zpomalený ntb, podezření na havěť

[milwociii]

14:17:15.0296 0308 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:17:15.0296 0308 Rdbss - ok
14:17:15.0312 0308 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:17:15.0312 0308 RDPCDD - ok
14:17:15.0359 0308 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:17:15.0359 0308 rdpdr - ok
14:17:15.0421 0308 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
14:17:15.0421 0308 RDPWD - ok
14:17:15.0468 0308 [ C0D9D9711CB74EE9BC66353D8CBDAB0E ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
14:17:15.0468 0308 RDSessMgr - ok
14:17:15.0515 0308 [ 611BFD220305BE3A85AE876EA47D4AA5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
14:17:15.0515 0308 redbook - ok
14:17:15.0562 0308 [ 127C26B5371651043450E52542099ABA ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
14:17:15.0562 0308 RemoteAccess - ok
14:17:15.0578 0308 [ 8F31505484A190D5B22274708799F4EC ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
14:17:15.0578 0308 RemoteRegistry - ok
14:17:15.0609 0308 [ 718B3BDC0BC3C2F7D065A53D26202AF9 ] RpcLocator C:\WINDOWS\system32\locator.exe
14:17:15.0609 0308 RpcLocator - ok
14:17:15.0656 0308 [ BE27674D1CBC3214AEC84B4336A38BBF ] RpcSs C:\WINDOWS\system32\rpcss.dll
14:17:15.0656 0308 RpcSs - ok
14:17:15.0734 0308 [ 09AB2E71E58B078038E3BFDBA7FFC984 ] RSVP C:\WINDOWS\system32\rsvp.exe
14:17:15.0734 0308 RSVP - ok
14:17:15.0765 0308 [ D507C1400284176573224903819FFDA3 ] rtl8139 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
14:17:15.0765 0308 rtl8139 - ok
14:17:15.0781 0308 [ ED0A176354487CEED65B80A7148AB739 ] SamSs C:\WINDOWS\system32\lsass.exe
14:17:15.0781 0308 SamSs - ok
14:17:15.0812 0308 [ 410046E401EB11E1E6749E9DEEA41D4A ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
14:17:15.0812 0308 SCardSvr - ok
14:17:15.0859 0308 [ 3FF232A7731621B8902D81D42418C93C ] Schedule C:\WINDOWS\system32\schedsvc.dll
14:17:15.0859 0308 Schedule - ok
14:17:15.0921 0308 [ 8D04819A3CE51B9EB47E5689B44D43C4 ] sdbus C:\WINDOWS\system32\DRIVERS\sdbus.sys
14:17:15.0921 0308 sdbus - ok
14:17:15.0937 0308 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:17:15.0953 0308 Secdrv - ok
14:17:15.0953 0308 [ 477E2C3CC5E4A0D635BCB0EA8DCAC3C6 ] seclogon C:\WINDOWS\System32\seclogon.dll
14:17:15.0953 0308 seclogon - ok
14:17:15.0968 0308 [ A530B75C10C23C9AB28FDB6CE719E21F ] SENS C:\WINDOWS\system32\sens.dll
14:17:15.0968 0308 SENS - ok
14:17:16.0000 0308 [ B842729337C9B921615C40D3C1A1AF96 ] Serial C:\WINDOWS\system32\drivers\Serial.sys
14:17:16.0000 0308 Serial - ok
14:17:16.0031 0308 [ 0FA803C64DF0914B41F807EA276BF2A6 ] sffdisk C:\WINDOWS\system32\DRIVERS\sffdisk.sys
14:17:16.0031 0308 sffdisk - ok
14:17:16.0046 0308 [ C17C331E435ED8737525C86A7557B3AC ] sffp_sd C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
14:17:16.0046 0308 sffp_sd - ok
14:17:16.0078 0308 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
14:17:16.0078 0308 Sfloppy - ok
14:17:16.0140 0308 [ F58FACA9621D2DB01BD0927D9A0A208E ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
14:17:16.0140 0308 SharedAccess - ok
14:17:16.0171 0308 [ EE9A2B9EA968A792A053C9D1A86BF870 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
14:17:16.0171 0308 ShellHWDetection - ok
14:17:16.0171 0308 Simbad - ok
14:17:16.0218 0308 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
14:17:16.0218 0308 SLIP - ok
14:17:16.0296 0308 [ 5E62BA073C90E6C9D4EA199D6080F919 ] smserial C:\WINDOWS\system32\DRIVERS\smserial.sys
14:17:16.0312 0308 smserial - ok
14:17:16.0406 0308 [ EAEE05416AE891D3A9F61C923033CEA9 ] snpstd C:\WINDOWS\system32\DRIVERS\snpstd.sys
14:17:16.0406 0308 snpstd - ok
14:17:16.0406 0308 Sparrow - ok
14:17:16.0437 0308 [ 3FA2E254BFBCE52B3C6F1BF23AAB6911 ] speedfan C:\WINDOWS\system32\speedfan.sys
14:17:16.0437 0308 speedfan - ok
14:17:16.0500 0308 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
14:17:16.0500 0308 splitter - ok
14:17:16.0546 0308 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
14:17:16.0546 0308 Spooler - ok
14:17:16.0578 0308 [ 94610C8653635E4459316A0050D55CE7 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
14:17:16.0578 0308 sr - ok
14:17:16.0625 0308 [ 35B91147124F64AC8081A2EDB9EA4DEE ] srservice C:\WINDOWS\system32\srsvc.dll
14:17:16.0625 0308 srservice - ok
14:17:16.0671 0308 [ 3EED76A0C1412F52860F7E7EAB5AECCA ] SRS_AE_Service C:\WINDOWS\system32\drivers\SRS_AE_i386.sys
14:17:16.0671 0308 SRS_AE_Service - ok
14:17:16.0718 0308 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
14:17:16.0734 0308 Srv - ok
14:17:16.0796 0308 [ BECD5271DC4E3B7C3D035F790FCBC1E5 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
14:17:16.0796 0308 SSDPSRV - ok
14:17:16.0859 0308 [ C1CDD9275F6A115BB0AE1D55D8D27BA6 ] stisvc C:\WINDOWS\system32\wiaservc.dll
14:17:16.0859 0308 stisvc - ok
14:17:16.0890 0308 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
14:17:16.0890 0308 streamip - ok
14:17:16.0921 0308 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
14:17:16.0921 0308 swenum - ok
14:17:16.0937 0308 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
14:17:16.0937 0308 swmidi - ok
14:17:16.0937 0308 SwPrv - ok
14:17:16.0953 0308 symc810 - ok
14:17:16.0953 0308 symc8xx - ok
14:17:16.0968 0308 sym_hi - ok
14:17:16.0968 0308 sym_u3 - ok
14:17:17.0015 0308 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
14:17:17.0015 0308 sysaudio - ok
14:17:17.0078 0308 [ CE06F01B88ACE199A1BF460CAC29C110 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
14:17:17.0078 0308 SysmonLog - ok
14:17:17.0125 0308 [ FD90A16CEB10D4FDAA00AAF39B8FF58F ] taphss C:\WINDOWS\system32\DRIVERS\taphss.sys
14:17:17.0125 0308 taphss - ok
14:17:17.0171 0308 [ C2546CD7A398476F9DF5614B2AE160E8 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
14:17:17.0171 0308 TapiSrv - ok
14:17:17.0234 0308 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:17:17.0234 0308 Tcpip - ok
14:17:17.0296 0308 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
14:17:17.0296 0308 TDPIPE - ok
14:17:17.0312 0308 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
14:17:17.0312 0308 TDTCP - ok
14:17:17.0343 0308 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
14:17:17.0343 0308 TermDD - ok
14:17:17.0421 0308 [ A75DD6FC3DBEE4FFF5EBC9F2C28BB66E ] TermService C:\WINDOWS\System32\termsrv.dll
14:17:17.0421 0308 TermService - ok
14:17:17.0453 0308 [ EE9A2B9EA968A792A053C9D1A86BF870 ] Themes C:\WINDOWS\System32\shsvcs.dll
14:17:17.0453 0308 Themes - ok
14:17:17.0500 0308 [ CD0CC7B167D78043A41C98D4921EFB54 ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
14:17:17.0500 0308 TlntSvr - ok
14:17:17.0500 0308 TosIde - ok
14:17:17.0531 0308 [ 38853304CCB938D30E0C4CDE8D2C2A8A ] TrkWks C:\WINDOWS\system32\trkwks.dll
14:17:17.0546 0308 TrkWks - ok
14:17:17.0593 0308 [ 9016639C71328E4667D06119937AA20A ] trufos C:\WINDOWS\system32\DRIVERS\trufos.sys
14:17:17.0609 0308 trufos - ok
14:17:17.0656 0308 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
14:17:17.0656 0308 Udfs - ok
14:17:17.0671 0308 ultra - ok
14:17:17.0734 0308 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
14:17:17.0734 0308 Update - ok
14:17:17.0796 0308 [ 651BD90DCEE5B7BDC74A2EB7C9266F9E ] upnphost C:\WINDOWS\System32\upnphost.dll
14:17:17.0796 0308 upnphost - ok
14:17:17.0828 0308 [ 20A0F6A11959E92908717D09E87D670D ] UPS C:\WINDOWS\System32\ups.exe
14:17:17.0828 0308 UPS - ok
14:17:17.0859 0308 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
14:17:17.0859 0308 usbaudio - ok
14:17:17.0906 0308 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:17:17.0906 0308 usbccgp - ok
14:17:17.0968 0308 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:17:17.0968 0308 usbehci - ok
14:17:17.0968 0308 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:17:17.0968 0308 usbhub - ok
14:17:17.0984 0308 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
14:17:17.0984 0308 usbohci - ok
14:17:18.0015 0308 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
14:17:18.0015 0308 usbprint - ok
14:17:18.0046 0308 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:17:18.0046 0308 usbstor - ok
14:17:18.0109 0308 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
14:17:18.0109 0308 usb_rndisx - ok
14:17:18.0140 0308 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
14:17:18.0140 0308 VgaSave - ok
14:17:18.0140 0308 ViaIde - ok
14:17:18.0156 0308 [ 28A4B296B47782173C346E376CB374D1 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
14:17:18.0156 0308 VolSnap - ok
14:17:18.0234 0308 [ D6BA1A63D9E00933F1CD2A885573AFB2 ] VSS C:\WINDOWS\System32\vssvc.exe
14:17:18.0234 0308 VSS - ok
14:17:18.0265 0308 [ FA4E1CDBA256787F2149F4AAD07BC91F ] W32Time C:\WINDOWS\system32\w32time.dll
14:17:18.0281 0308 W32Time - ok
14:17:18.0296 0308 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:17:18.0296 0308 Wanarp - ok
14:17:18.0375 0308 [ 4769596D7CC0F5FA447D2BABC239672A ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys
14:17:18.0375 0308 Wdf01000 - ok
14:17:18.0375 0308 WDICA - ok
14:17:18.0437 0308 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
14:17:18.0437 0308 wdmaud - ok
14:17:18.0453 0308 [ 47AE51048A82DFA1CD6B51D369F7E169 ] WebClient C:\WINDOWS\System32\webclnt.dll
14:17:18.0453 0308 WebClient - ok
14:17:18.0578 0308 [ E488332126E3B1182D2B8A0C35408EC6 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
14:17:18.0593 0308 winmgmt - ok
14:17:18.0640 0308 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
14:17:18.0640 0308 WmdmPmSN - ok
14:17:18.0703 0308 [ 0171CFF34BBA8C5977F18C48D8AEF8C6 ] Wmi C:\WINDOWS\System32\advapi32.dll
14:17:18.0703 0308 Wmi - ok
14:17:18.0765 0308 [ 23F6F03272F7E5679F1F050AED5ACEE6 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
14:17:18.0781 0308 WmiApSrv - ok
14:17:18.0890 0308 [ 3739866D20ABD42F26A7B85F9E2560AF ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
14:17:18.0890 0308 WMPNetworkSvc - ok
14:17:18.0953 0308 [ 4C86D5FAF78194995AF9CC1075F65DD3 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
14:17:18.0953 0308 wscsvc - ok
14:17:19.0000 0308 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
14:17:19.0000 0308 WSTCODEC - ok
14:17:19.0046 0308 [ C1364564800EE9784192145324A23308 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
14:17:19.0046 0308 wuauserv - ok
14:17:19.0093 0308 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:17:19.0093 0308 WudfPf - ok
14:17:19.0125 0308 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:17:19.0140 0308 WudfRd - ok
14:17:19.0171 0308 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
14:17:19.0171 0308 WudfSvc - ok
14:17:19.0234 0308 [ A27D4BA7264C0BF52F32D10405BEA1D4 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
14:17:19.0234 0308 WZCSVC - ok
14:17:19.0312 0308 [ EAA4BB9EDB3FB10CF8979FE65E63658F ] xmlprov C:\WINDOWS\System32\xmlprov.dll
14:17:19.0312 0308 xmlprov - ok
14:17:19.0343 0308 ================ Scan global ===============================
14:17:19.0390 0308 [ F36278E42C8C5DF03CE17DAC8231C91C ] C:\WINDOWS\system32\basesrv.dll
14:17:19.0453 0308 [ F3FA14A297BC687D0B51289D034033C9 ] C:\WINDOWS\system32\winsrv.dll
14:17:19.0468 0308 [ F3FA14A297BC687D0B51289D034033C9 ] C:\WINDOWS\system32\winsrv.dll
14:17:19.0484 0308 [ 9EF697AF07BB8DD82C3B02CA953A95B7 ] C:\WINDOWS\system32\services.exe
14:17:19.0484 0308 [Global] - ok
14:17:19.0484 0308 ================ Scan MBR ==================================
14:17:19.0515 0308 [ 413FC2A0C716421B3158746D63736515 ] \Device\Harddisk0\DR0
14:17:19.0750 0308 \Device\Harddisk0\DR0 - ok
14:17:19.0750 0308 ================ Scan VBR ==================================
14:17:19.0750 0308 [ 56FA96B2893E5CA85E44FCE129AB4CDD ] \Device\Harddisk0\DR0\Partition1
14:17:19.0750 0308 \Device\Harddisk0\DR0\Partition1 - ok
14:17:19.0765 0308 ============================================================
14:17:19.0765 0308 Scan finished
14:17:19.0765 0308 ============================================================
14:17:19.0765 3908 Detected object count: 0
14:17:19.0765 3908 Actual detected object count: 0
14:17:25.0265 2108 Deinitialize success

[Reklama]

[memphisto]

Ok a ještě ten log z Combofixu

[milwociii]

ComboFix 12-10-04.02 - homes 07.10.2012 16:00:30.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.894.424 [GMT 2:00]
Spuštěný z: c:\documents and settings\homes\Dokumenty\Downloads\ComboFix.exe
FW: AVG Internet Security 2012 *Enabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
ADS - system32: deleted 12 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\WinPCap
c:\program files\WinPCap\LICENSE
c:\program files\WinPCap\rpcapd.exe
c:\program files\WinPCap\uninstall.exe
c:\windows\system32\Cache
c:\windows\system32\Cache\0f158cca3d773853.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\38626edbb8d67532.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\SET114.tmp
c:\windows\system32\SETC7.tmp
c:\windows\system32\SETCC.tmp
c:\windows\system32\SETD3.tmp
c:\windows\system32\URTTemp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-07 do 2012-10-07 )))))))))))))))))))))))))))))))
.
.
2012-10-07 12:46 . 2012-10-07 12:46 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-10-06 16:42 . 2012-10-06 16:42 -------- d-----w- c:\documents and settings\homes\Data aplikací\Malwarebytes
2012-10-06 16:42 . 2012-10-06 16:42 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Data aplikací\Malwarebytes
2012-10-06 16:42 . 2012-10-06 16:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-10-06 16:42 . 2012-09-07 15:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-05 22:05 . 2012-10-05 22:05 388096 ----a-r- c:\documents and settings\homes\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-10-05 22:05 . 2012-10-05 22:05 -------- d-----w- c:\program files\Trend Micro
2012-09-28 21:48 . 2012-10-02 01:02 -------- d-----w- c:\documents and settings\homes\Data aplikací\vlc
2012-09-27 21:25 . 2012-09-27 21:25 -------- d-----w- c:\documents and settings\homes\Local Settings\Data aplikací\CRE
2012-09-27 21:25 . 2012-09-27 21:25 -------- d-----w- c:\program files\Conduit
2012-09-27 21:25 . 2012-10-06 16:18 -------- d-----w- c:\documents and settings\homes\Local Settings\Data aplikací\Conduit
2012-09-27 21:23 . 2012-10-07 11:39 -------- d-----w- c:\documents and settings\homes\Data aplikací\uTorrent
2012-09-27 21:17 . 2012-09-27 21:20 154 -c--a-w- C:\prefs.js
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 00:24 . 2012-05-27 12:11 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 00:24 . 2012-05-27 12:11 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-28 15:18 . 2012-05-26 16:18 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:18 . 2012-05-26 16:17 43520 ------w- c:\windows\system32\licmgr10.dll
2012-08-28 15:18 . 2012-05-26 16:17 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2012-05-26 16:17 385024 ------w- c:\windows\system32\html.iec
2012-08-11 22:24 . 2012-08-11 22:24 8266 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.4048.bin
2012-08-11 22:24 . 2012-08-11 22:23 3572 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3096.bin
2012-08-11 22:24 . 2012-08-11 22:23 3948 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3056.bin
2012-08-11 22:24 . 2012-08-11 22:23 94520 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3936.bin
2012-08-11 22:24 . 2012-08-11 22:24 8354 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.2688.bin
2012-08-11 22:24 . 2012-08-11 22:24 1861 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.2352.bin
2012-08-11 22:24 . 2012-08-11 22:24 739 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3856.bin
2012-08-11 22:24 . 2012-08-11 22:24 739 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.2804.bin
2012-08-11 22:24 . 2012-08-11 22:23 2266 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3196.bin
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0022C09-7DE4-ED8A-5CA9-F9CAB1A10C90}]
2012-08-28 15:33 142848 ----a-w- c:\documents and settings\All Users.WINDOWS\Data aplikací\Bcool\bhoclass.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
"RTHDCPL"="RTHDCPL.EXE" [2011-08-09 20055144]
"HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-03-08 585728]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2008-06-11 1454080]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PANDORA.TV\\PanService\\PandoraService.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2987:TCP"= 2987:TCP:Connectify File Sharing
"67:UDP"= 67:UDP:Internet Connection Sharing (DHCP Server-In)
"1317:UDP"= 1317:UDP:Internet Connection Sharing (DHCP Server-In, DS-Shifted)
"68:UDP"= 68:UDP:Internet Connection Sharing (DHCPv4-In)
"547:UDP"= 547:UDP:Internet Connection Sharing (DHCPv6-In)
"53:UDP"= 53:UDP:Internet Connection Sharing (DNS Server-In)
"1303:UDP"= 1303:UDP:Internet Connection Sharing (DNS Server-In, DS-Shifted)
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R2 AVWEBCAM;AV WebCam, WDM Video Capture;c:\windows\system32\drivers\avwebcam.sys [29.5.2012 18:22 13696]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [18.7.2012 0:12 21992]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [23.3.2012 14:25 87040]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [27.5.2012 11:27 52128]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6.10.2012 18:42 676936]
S3 2hotspot controller;2hotspot Miniport;c:\windows\system32\DRIVERS\acontrol.sys --> c:\windows\system32\DRIVERS\acontrol.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [27.5.2012 14:11 250288]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [26.5.2012 19:52 1691480]
S3 cnnctfy2MP;cnnctfy2MP;c:\windows\system32\DRIVERS\cnnctfy2.sys --> c:\windows\system32\DRIVERS\cnnctfy2.sys [?]
S3 CV2K1;CommView Network Monitor;c:\windows\system32\DRIVERS\cv2k1.sys --> c:\windows\system32\DRIVERS\cv2k1.sys [?]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [13.7.2012 20:51 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [22.6.2010 18:01 21248]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6.10.2012 18:42 22856]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [7.10.2012 14:46 40776]
S3 SRS_AE_Service;SRS Audio Essentials;c:\windows\system32\drivers\SRS_AE_i386.sys [26.6.2012 18:34 404256]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2012-10-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-27 00:24]
.
2012-10-07 c:\windows\Tasks\User_Feed_Synchronization-{388C51D2-5F67-44ED-B5EB-43A7569CB994}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 192.168.0.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-07 16:10
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2012-10-07 16:12:59
ComboFix-quarantined-files.txt 2012-10-07 14:12
.
Před spuštěním: Volných bajtů: 40 079 740 928
Po spuštění: Volných bajtů: 40 164 245 504
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - A69B2151B0E450C647394F14687B1098

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::

KillAll::
File::
c:\documents and settings\All Users.WINDOWS\Data aplikací\Bcool\bhoclass.dll

Folder::
c:\program files\Conduit
c:\documents and settings\homes\Local Settings\Data aplikací\Conduit

Driver::
2hotspot controller
cnnctfy2MP
CV2K1

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A0022C09-7DE4-ED8A-5CA9-F9CAB1A10C90}]

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.4048.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3096.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3056.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3936.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.2688.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.2352.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3856.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.2804.bin
c:\documents and settings\All Users.WINDOWS\Data aplikací\1344723817.3196.bin

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Nebo na:
http://www.virscan.org/

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2987:TCP"= 2987:TCP:Connectify File Sharing
"67:UDP"= 67:UDP:Internet Connection Sharing (DHCP Server-In)
"1317:UDP"= 1317:UDP:Internet Connection Sharing (DHCP Server-In, DS-Shifted)
"68:UDP"= 68:UDP:Internet Connection Sharing (DHCPv4-In)
"547:UDP"= 547:UDP:Internet Connection Sharing (DHCPv6-In)
"53:UDP"= 53:UDP:Internet Connection Sharing (DNS Server-In)
"1303:UDP"= 1303:UDP:Internet Connection Sharing (DNS Server-In, DS-Shifted)
Sis povoloval sám??

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.