Podozrenie na Trojana

[Martin1982]

Zdravim Vas,

poprosim o kontrolu LOG-u. PC sa sprava divne a dost sa spomalilo.

Dakujem

Logfile of random's system information tool 1.09 (written by random/random)
Run by OFFICE at 2011-12-22 15:23:22
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 8 GB (43%) free of 18 GB
Total RAM: 1503 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:23:30, on 22.12.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LGScsiCommandService.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Programy instalacie\firefox.exe
D:\Programy instalacie\plugin-container.exe
C:\Documents and Settings\OFFICE\Desktop\RSIT.exe
C:\Program Files\trend micro\OFFICE.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cas.sk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LG SCSI command service (LGScsiCommandService) - Mobile Leader Co.,Ltd. - C:\WINDOWS\system32\LGScsiCommandService.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 4851 bytes

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\OFFICE\Application Data\Mozilla\Firefox\Profiles\jk1lnkpq.default

prefs.js - "browser.startup.homepage" - "www.google.sk"
prefs.js - "keyword.URL" - "http://search.sweetim.com/search.asp?src=2&q="

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

D:\Programy instalacie\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

D:\Programy instalacie\components\
binary.manifest
browsercomps.dll

D:\Programy instalacie\plugins\
nppdf32.dll
npwachk.dll

C:\Documents and Settings\OFFICE\Application Data\Mozilla\Firefox\Profiles\jk1lnkpq.default\extensions\
centrumpomocnik@centrum.cz
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
{EEE6C361-6118-11DC-9C72-001320C79847}

C:\Documents and Settings\OFFICE\Application Data\Mozilla\Firefox\Profiles\jk1lnkpq.default\searchplugins\
sweetim.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-05-04 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-05-04 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]
"MP10_EnsureFileVer"=C:\WINDOWS\inf\unregmp2.exe [2008-04-14 208896]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^OFFICE^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2010-06-07 1195520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-11 239496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Winamp\winamp.exe"="C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp"
"D:\Programy instalacie\Winamp\winamp.exe"="D:\Programy instalacie\Winamp\winamp.exe:*:Enabled:Winamp"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\Programy instalacie\opera.exe"="D:\Programy instalacie\opera.exe:*:Enabled:Opera Internet Browser"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.VP70"=vp7vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2011-12-22 09:01:15 ----A---- C:\Program Files\ccsetup314.exe
2011-12-20 21:36:30 ----D---- C:\Program Files\Reviversoft
2011-12-20 21:35:27 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-12-20 21:35:26 ----D---- C:\Program Files\Webteh
2011-12-20 21:35:26 ----D---- C:\Program Files\trend micro
2011-12-20 21:35:26 ----D---- C:\Program Files\MSXML 4.0
2011-12-20 21:35:26 ----D---- C:\Program Files\Markets.com MetaTrader
2011-12-20 21:35:26 ----D---- C:\Program Files\history
2011-12-20 21:35:26 ----D---- C:\Program Files\Fast Download Manager
2011-12-20 21:35:26 ----D---- C:\Program Files\deleted
2011-12-20 21:35:26 ----D---- C:\Program Files\AVAST Software
2011-12-20 21:35:19 ----D---- C:\Program Files\The KMPlayer
2011-12-20 21:35:19 ----D---- C:\Program Files\KMPlayer
2011-12-20 21:35:18 ----D---- C:\Program Files\QuickTime
2011-12-20 21:35:17 ----D---- C:\Program Files\Opera
2011-12-20 21:34:47 ----D---- C:\Program Files\Zrychlenie PC
2011-12-20 21:34:47 ----D---- C:\Program Files\iTunes
2011-12-20 21:25:47 ----D---- C:\Program Files\Windows Media Connect 2
2011-12-20 21:25:47 ----D---- C:\Program Files\Mozilla Firefox
2011-12-20 21:25:47 ----D---- C:\Program Files\ComPlus Applications
2011-12-20 21:25:46 ----D---- C:\Program Files\Winamp
2011-12-20 21:25:46 ----D---- C:\Program Files\tester
2011-12-20 21:25:46 ----D---- C:\Program Files\liveupdate
2011-12-20 21:25:46 ----D---- C:\Program Files\Google
2011-12-20 21:25:46 ----D---- C:\Program Files\experts
2011-12-20 21:25:45 ----D---- C:\rsit
2011-12-20 21:25:45 ----D---- C:\Program Files\Online Services
2011-12-20 21:25:45 ----D---- C:\Program Files\DivX
2011-12-20 21:25:45 ----D---- C:\Inetpub
2011-12-19 12:45:14 ----SHD---- C:\Config.Msi
2011-12-18 12:28:53 ----D---- C:\Documents and Settings\All Users\Application Data\IObit
2011-12-18 12:27:59 ----D---- C:\Documents and Settings\OFFICE\Application Data\IObit
2011-12-18 11:44:09 ----D---- C:\Documents and Settings\OFFICE\Application Data\Reviversoft
2011-12-18 11:43:45 ----A---- C:\WINDOWS\system32\roboot.exe
2011-12-15 18:34:33 ----A---- C:\WINDOWS\system32\lagarith.dll
2011-12-15 18:34:31 ----A---- C:\WINDOWS\system32\vp7vfw.dll
2011-12-15 18:34:30 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2011-12-15 18:34:29 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2011-12-15 18:34:20 ----D---- C:\Program Files\K-Lite Codec Pack
2011-12-15 18:30:52 ----A---- C:\Program Files\K-Lite_Codec_Pack_800_Full.exe
2011-12-15 18:29:30 ----A---- C:\Program Files\SoftonicDownloader_for_k-lite-codec-pack.exe
2011-12-14 20:58:04 ----D---- C:\Program Files\profiles
2011-12-14 20:58:02 ----D---- C:\Program Files\languages
2011-12-14 20:56:47 ----A---- C:\Program Files\MetaTraderFIX.exe
2011-12-11 19:20:41 ----D---- C:\Documents and Settings\OFFICE\Application Data\DivX
2011-12-11 19:14:40 ----D---- C:\Documents and Settings\All Users\Application Data\DivX
2011-12-09 11:45:51 ----D---- C:\Program Files\Common Files\Adobe
2011-11-24 16:49:33 ----D---- C:\Documents and Settings\All Users\Application Data\Protexis
2011-11-24 16:49:25 ----D---- C:\Documents and Settings\OFFICE\Application Data\Corel
2011-11-24 16:37:02 ----D---- C:\Program Files\Common Files\Corel
2011-11-24 16:35:52 ----D---- C:\Program Files\Common Files\Protexis
2011-11-24 16:35:51 ----D---- C:\Documents and Settings\All Users\Application Data\Corel

======List of files/folders modified in the last 1 month======

2011-12-22 15:23:29 ----D---- C:\WINDOWS\Prefetch
2011-12-22 09:38:17 ----D---- C:\Documents and Settings\OFFICE\Application Data\Winamp
2011-12-22 09:02:30 ----RD---- C:\Program Files
2011-12-22 09:02:14 ----D---- C:\WINDOWS\system32
2011-12-22 09:02:13 ----D---- C:\WINDOWS
2011-12-22 07:59:50 ----D---- C:\WINDOWS\Temp
2011-12-21 23:34:50 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-12-20 21:38:26 ----D---- C:\WINDOWS\system32\config
2011-12-20 21:37:54 ----D---- C:\WINDOWS\system32\wbem
2011-12-20 21:37:51 ----D---- C:\WINDOWS\Registration
2011-12-20 21:32:46 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-12-20 21:28:37 ----SHD---- C:\WINDOWS\Installer
2011-12-20 21:28:36 ----RSD---- C:\WINDOWS\Fonts
2011-12-19 13:01:35 ----RSD---- C:\WINDOWS\assembly
2011-12-19 12:47:50 ----D---- C:\Program Files\OpenOffice.org 3
2011-12-19 11:46:43 ----D---- C:\WINDOWS\system32\CatRoot2
2011-12-15 10:43:47 ----D---- C:\WINDOWS\Debug
2011-12-15 08:53:47 ----HD---- C:\WINDOWS\inf
2011-12-15 08:52:39 ----D---- C:\Program Files\Internet Explorer
2011-12-15 08:52:01 ----HD---- C:\WINDOWS\$hf_mig$
2011-12-15 08:42:31 ----A---- C:\WINDOWS\system32\MRT.exe
2011-12-14 21:02:50 ----D---- C:\Documents and Settings\OFFICE\Application Data\Skype
2011-12-14 14:37:06 ----SD---- C:\WINDOWS\Downloaded Program Files
2011-12-14 11:31:21 ----D---- C:\WINDOWS\system32\inetsrv
2011-12-11 19:17:03 ----D---- C:\Program Files\Common Files
2011-12-09 11:45:56 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2011-12-09 11:45:51 ----D---- C:\Program Files\Adobe
2011-12-08 22:02:14 ----SD---- C:\WINDOWS\Tasks
2011-12-08 21:36:56 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-12-08 21:35:06 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2011-12-06 21:57:24 ----A---- C:\Program Files\ChromeSetup.exe
2011-12-04 10:44:55 ----D---- C:\Documents and Settings\OFFICE\Application Data\Opera
2011-11-30 20:46:50 ----D---- C:\Documents and Settings\OFFICE\Application Data\vlc
2011-11-25 19:20:07 ----D---- C:\WINDOWS\Microsoft.NET
2011-11-24 16:42:27 ----SD---- C:\Documents and Settings\OFFICE\Application Data\Microsoft
2011-11-24 16:42:27 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2011-11-24 16:24:19 ----D---- C:\WINDOWS\WinSxS
2011-11-23 23:41:08 ----A---- C:\WINDOWS\iun6002.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;NEC FireWarden OHCI Compliant IEEE 1394 Host Controller; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2011-03-04 45648]
R0 sisagp;SiS AGP Filter; C:\WINDOWS\system32\DRIVERS\SISAGPX.sys [2003-01-13 30720]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\drivers\srvkp.sys [2003-10-03 11264]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2004-01-07 432384]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S2 Scutum50;Scutum50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\Scutum50.sys []
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt2870.sys []
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys []
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys []
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys []
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-05-04 153376]
R2 LGScsiCommandService;LG SCSI command service; C:\WINDOWS\system32\LGScsiCommandService.exe [2010-04-12 47616]
R2 PSI_SVC_2;Protexis Licensing V2; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2009-07-24 189728]
S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[cernohous13]

Zdravím,

zatím jsem tam nic závažného nenešel - zkusíme nástroje

Stáhni a nainstaluj MBAM zde http://www.download.com/Malwarebytes-An ... tag=button
Spustit > na 3.záložce "Aktualizace" > Kontrola aktualizací
následně na 1.záložce "Kontrolor" -> Rychlá kontrola -> Prohledat
po dokončení scanu vyskočí okno Notepad s výsledkem - obsah zkopíruj do své odpovědi
zatím nic nemazat - počkej na posouzení

[Martin1982]

O.k. provadim kontrolu.. Mimochodom PC sa za posledne dni vyrazne zpomalilo..

[Martin1982]

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verze databáze: 911122204

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

22.12.2011 17:44:45
mbam-log-2011-12-22 (17-44-45).txt

Typ: Rychlá kontrola
Kontrolované objekty: 153454
Uplynulý čas: 9 minut, 9 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[cernohous13]

Start -> Spustit... - zadej devmgmt.msc -> OK

rozbal Řadiče IDE ATA/ATAPI
klik pravým na Primární kanál IDE -> Vlastnosti -> Upřesnit nastavení -> Režim přenosu by měl být DMA -
co máš v okně Aktuální režim přenosu?

zopakuj i na Sekundární kanál IDE (pokud máš)

[Martin1982]

V okne aktualni rezim prenosu mam : primary: Ultra DMA mode 5
secondary: not apllicable

[cernohous13]

Abychom měli jistotu, použijeme kvalitní a osvědčený nástroj AVPTool podle návodu - http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

[Martin1982]

mam to spusti hned teraz? podla navodu to trva dost dlho..

[cernohous13]

spustíš až na to budeš mít čas