VIRY.CZ

Logfile of random's system information tool 1.08 (written by random/random)
Run by MS at 2010-08-18 21:02:32
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 23 GB (44%) free of 53 GB
Total RAM: 2047 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:03:21, on 18.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\hasplms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\MS\My Documents\Preberanie\RSIT.exe
C:\Program Files\trend micro\MS.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {F156768E-81EF-470C-9057-481BA8380DBA} - (no file)
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Stáhnout &vše FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\AutoCAD LT 2010\AdComFolderWatch.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1} (NOXLATE) - file://C:\Program Files\AutoCAD LT 2000i Cz\InstFred.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (Ovládací prvek AcDcToday) - file://C:\Program Files\AutoCAD LT 2000i Cz\AcDcToday.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Prvek AcPreview) - file://C:\Program Files\AutoCAD LT 2000i Cz\AcPreview.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\system32\hasplms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 7570 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-573735546-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-573735546-839522115-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-11-07 1088296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 61952]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2004-12-15 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2004-12-15 5513216]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-06-14 221184]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-08-12 2215064]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2010-06-22 159744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"D:\GAMES\NFS 5 v3.0\Porsche.exe"="D:\GAMES\NFS 5 v3.0\Porsche.exe:*:Enabled:Porsche"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\EA Sports\NHL 09\nhl2009.exe"="C:\Program Files\EA Sports\NHL 09\nhl2009.exe:*:Enabled:nhl2009"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Codemasters\DiRT Demo\DiRTDemo.exe"="C:\Program Files\Codemasters\DiRT Demo\DiRTDemo.exe:*:Enabled:DiRT Demo Executable"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.scr - open - C:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-08-17 20:40:44 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-08-17 20:40:44 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-17 20:28:32 ----D---- C:\Program Files\trend micro
2010-08-17 20:28:30 ----D---- C:\rsit
2010-08-17 19:40:55 ----D---- C:\Documents and Settings\MS\Application Data\Real
2010-08-17 19:19:37 ----D---- C:\Program Files\ESET
2010-08-17 16:57:18 ----D---- C:\Documents and Settings\MS\Application Data\ESET
2010-08-17 07:13:27 ----HDC---- C:\WINDOWS\$NtUninstallKB982214$
2010-08-17 07:13:08 ----HDC---- C:\WINDOWS\$NtUninstallKB2115168$
2010-08-17 07:10:00 ----HDC---- C:\WINDOWS\$NtUninstallKB981852$
2010-08-17 07:09:32 ----HDC---- C:\WINDOWS\$NtUninstallKB2079403$
2010-08-17 07:01:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2160329$
2010-08-17 07:00:58 ----HDC---- C:\WINDOWS\$NtUninstallKB980436$
2010-08-17 06:50:29 ----HDC---- C:\WINDOWS\$NtUninstallKB981997$
2010-08-17 06:46:29 ----HDC---- C:\WINDOWS\$NtUninstallKB982665$
2010-08-16 16:33:41 ----A---- C:\WINDOWS\system32\aticalrt.dll
2010-08-16 16:33:41 ----A---- C:\WINDOWS\system32\aticaldd.dll
2010-08-16 16:33:39 ----A---- C:\WINDOWS\system32\atimpc32.dll
2010-08-16 16:33:39 ----A---- C:\WINDOWS\system32\atibtmon.exe
2010-08-16 16:33:38 ----A---- C:\WINDOWS\system32\atioglxx.dll
2010-08-16 16:33:38 ----A---- C:\WINDOWS\system32\aticalcl.dll
2010-08-16 16:33:38 ----A---- C:\WINDOWS\system32\atiapfxx.exe
2010-08-16 16:33:38 ----A---- C:\WINDOWS\system32\atiadlxx.dll
2010-08-16 16:33:00 ----D---- C:\CIMTEMP
2010-08-16 16:32:48 ----D---- C:\Program Files\ATI
2010-08-16 16:27:20 ----D---- C:\Documents and Settings\MS\Application Data\Download Manager
2010-08-04 16:08:08 ----HDC---- C:\WINDOWS\$NtUninstallKB2286198$
2010-08-03 13:28:36 ----A---- C:\WINDOWS\system32\drivers\epfwtdir.sys

======List of files/folders modified in the last 1 months======

2010-08-18 21:03:11 ----D---- C:\WINDOWS\Temp
2010-08-18 20:53:45 ----D---- C:\WINDOWS\Prefetch
2010-08-18 16:34:04 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-08-18 16:33:34 ----A---- C:\WINDOWS\wincmd.ini
2010-08-18 07:00:05 ----D---- C:\WINDOWS\system32\drivers\etc
2010-08-18 00:13:41 ----D---- C:\WINDOWS\Microsoft.NET
2010-08-18 00:13:25 ----RSD---- C:\WINDOWS\assembly
2010-08-17 20:40:44 ----D---- C:\Program Files
2010-08-17 20:19:51 ----D---- C:\WINDOWS
2010-08-17 20:17:46 ----D---- C:\WINDOWS\system32
2010-08-17 20:12:00 ----D---- C:\WINDOWS\Debug
2010-08-17 20:02:37 ----HD---- C:\Config.Msi
2010-08-17 20:01:27 ----SHD---- C:\WINDOWS\Installer
2010-08-17 19:20:25 ----HD---- C:\WINDOWS\inf
2010-08-17 19:20:25 ----D---- C:\WINDOWS\system32\drivers
2010-08-17 19:19:28 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2010-08-17 19:19:16 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-17 16:52:39 ----D---- C:\Program Files\Microsoft Security Essentials
2010-08-17 16:52:11 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-08-17 16:51:52 ----SD---- C:\WINDOWS\Tasks
2010-08-17 07:13:30 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-08-17 07:13:25 ----HD---- C:\WINDOWS\$hf_mig$
2010-08-17 07:12:25 ----A---- C:\WINDOWS\win.ini
2010-08-17 07:08:54 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-08-17 07:08:21 ----D---- C:\WINDOWS\WinSxS
2010-08-17 07:01:57 ----D---- C:\Program Files\Internet Explorer
2010-08-17 06:50:36 ----D---- C:\Program Files\Movie Maker
2010-08-16 22:24:01 ----A---- C:\debugoutput.txt
2010-08-16 19:26:07 ----D---- C:\Documents and Settings\MS\Application Data\uTorrent
2010-08-16 16:33:53 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-08-16 16:33:38 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-08-16 16:33:33 ----D---- C:\Program Files\ATI Technologies
2010-08-03 20:09:31 ----A---- C:\WINDOWS\system32\MRT.exe
2010-07-27 08:30:35 ----A---- C:\WINDOWS\system32\shell32.dll
2010-07-26 21:25:28 ----D---- C:\Program Files\ICQ6.5
2010-07-26 18:44:02 ----D---- C:\Program Files\Mozilla Firefox
2010-07-26 16:09:33 ----D---- C:\Program Files\Foxit Software

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Texas Instruments OHCI Compliant IEEE 1394 Host Controller; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-10-06 716272]
R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-08-03 95896]
R2 aksfridge;aksfridge; \??\C:\WINDOWS\system32\drivers\aksfridge.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-08-04 140752]
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 Haspnt;Haspnt; \??\C:\WINDOWS\system32\drivers\Haspnt.sys []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-10-05 141312]
R3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 127872]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2010-06-23 5068288]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2005-08-11 393088]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-03-30 230400]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
S3 ah9p8opk;ah9p8opk; C:\WINDOWS\system32\drivers\ah9p8opk.sys []
S3 ahfq26v6;ahfq26v6; C:\WINDOWS\system32\drivers\ahfq26v6.sys []
S3 akshasp;Aladdin HASP Key; C:\WINDOWS\system32\DRIVERS\akshasp.sys [2007-07-05 238976]
S3 aksusb;Aladdin USB Key; C:\WINDOWS\system32\DRIVERS\aksusb.sys [2007-07-05 14976]
S3 BthEnum;Bluetooth Request Block Driver; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
S3 BTHMODEM;Bluetooth Serial Communications Driver; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-13 272128]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\WINDOWS\system32\DRIVERS\hidbth.sys [2008-04-13 25600]
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-06-21 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-06-21 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-06-21 21744]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-12-15 3329504]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
S3 s115bus;Sony Ericsson Device 115 driver (WDM); C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 98568]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S4 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys []
S4 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2010-06-22 602112]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-08-12 810144]
R2 hasplms;HASP License Manager; C:\WINDOWS\system32\hasplms.exe [2008-04-24 2562048]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2004-12-15 139331]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2008-10-30 85096]
S3 Autodesk Network Licensing Service;Autodesk Network Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe [2006-08-11 902760]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-08-12 33584]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-07-21 651720]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-09-03 30192]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-06-02 637952]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

tu je log z Combofix




ComboFix 10-08-18.04 - MS 19.08.2010 18:04:33.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.2047.1599 [GMT 2:00]
Running from: c:\documents and settings\MS\My Documents\Preberanie\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\RelevantKnowledge
c:\program files\RelevantKnowledge\rlservice.exe

.
((((((((((((((((((((((((( Files Created from 2010-07-19 to 2010-08-19 )))))))))))))))))))))))))))))))
.

2010-08-17 18:40 . 2010-08-18 13:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-17 18:40 . 2010-08-17 18:43 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-17 18:28 . 2010-08-18 19:02 -------- d-----w- c:\program files\trend micro
2010-08-17 18:28 . 2010-08-17 18:28 -------- d-----w- C:\rsit
2010-08-17 17:19 . 2010-08-17 17:19 -------- d-----w- c:\program files\ESET
2010-08-17 14:57 . 2010-08-17 14:57 -------- d-----w- c:\documents and settings\MS\Application Data\ESET
2010-08-17 05:02 . 2010-08-17 05:02 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-08-16 14:33 . 2010-06-22 21:17 53248 ----a-w- c:\windows\system32\aticalrt.dll
2010-08-16 14:33 . 2010-06-22 21:16 4337664 ----a-w- c:\windows\system32\aticaldd.dll
2010-08-16 14:33 . 2010-06-22 20:26 65024 ----a-w- c:\windows\system32\atimpc32.dll
2010-08-16 14:33 . 2009-05-11 15:35 118784 ----a-w- c:\windows\system32\atibtmon.exe
2010-08-16 14:33 . 2010-06-22 21:17 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-08-16 14:33 . 2010-06-22 21:01 15499264 ----a-w- c:\windows\system32\atioglxx.dll
2010-08-16 14:33 . 2010-06-22 20:38 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-08-16 14:33 . 2010-06-22 20:33 184320 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-16 14:33 . 2010-08-16 14:33 -------- d-----w- C:\CIMTEMP
2010-08-16 14:32 . 2010-08-16 14:32 -------- d-----w- c:\program files\ATI
2010-08-16 14:27 . 2010-08-16 14:30 -------- d-----w- c:\documents and settings\MS\Application Data\Download Manager
2010-08-03 11:28 . 2010-08-03 11:28 95896 ----a-w- c:\windows\system32\drivers\epfwtdir.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-18 19:49 . 2008-10-06 15:14 -------- d-----w- c:\documents and settings\MS\Application Data\uTorrent
2010-08-18 19:48 . 2008-10-06 15:14 -------- d-----w- c:\program files\uTorrent
2010-08-17 17:19 . 2008-09-29 17:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-08-17 14:52 . 2010-07-06 17:08 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-08-16 14:33 . 2009-07-21 20:50 -------- d-----w- c:\program files\ATI Technologies
2010-08-04 09:50 . 2010-07-02 10:43 140752 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-07-29 11:31 . 2010-04-28 06:17 115008 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-07-26 19:25 . 2009-01-12 20:37 -------- d-----w- c:\program files\ICQ6.5
2010-07-26 14:09 . 2010-07-07 16:09 -------- d-----w- c:\program files\Foxit Software
2010-07-08 23:27 . 2010-07-08 16:27 433752 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-07-08 17:38 . 2008-09-29 16:50 75408 ----a-w- c:\documents and settings\MS\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-08 17:37 . 2010-07-08 17:25 -------- d-----w- c:\program files\AutoCAD LT 2010
2010-07-08 17:34 . 2008-10-06 15:09 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-07-08 17:25 . 2008-10-06 15:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2010-07-07 18:15 . 2010-07-07 18:15 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-07-07 17:13 . 2010-07-07 17:10 -------- d-----w- c:\program files\Cumik
2010-07-07 16:23 . 2008-09-29 17:33 -------- d-----w- c:\documents and settings\MS\Application Data\Skype
2010-07-07 16:22 . 2008-09-29 17:34 -------- d-----w- c:\documents and settings\MS\Application Data\skypePM
2010-07-07 16:09 . 2010-07-07 16:09 -------- d-----w- c:\documents and settings\MS\Application Data\Foxit
2010-07-07 15:57 . 2010-07-07 15:57 -------- d-----w- c:\documents and settings\MS\Application Data\Media Player Classic
2010-07-07 15:57 . 2010-07-07 15:54 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-07-07 15:37 . 2008-10-21 17:29 -------- d-----w- c:\program files\Ahead
2010-07-07 15:34 . 2008-09-29 16:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-07 15:25 . 2009-08-05 15:47 -------- d-----w- c:\program files\AutoCAD MEP 2009
2010-07-06 19:29 . 2009-07-21 21:01 -------- d-----w- c:\documents and settings\MS\Application Data\Gearbox Software
2010-07-06 18:52 . 2008-09-29 17:02 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-30 12:31 . 2004-08-04 01:07 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-28 08:00 . 2010-07-07 15:55 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-06-24 12:22 . 2004-08-04 01:07 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 01:07 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-22 22:00 . 2008-10-07 16:01 5068288 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2010-06-22 21:02 . 2009-07-21 20:51 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2010-06-22 20:58 . 2009-07-21 20:51 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-06-22 20:57 . 2008-10-07 16:01 299520 ----a-w- c:\windows\system32\ati2dvag.dll
2010-06-22 20:57 . 2008-10-07 16:01 3869952 ----a-w- c:\windows\system32\ati3duag.dll
2010-06-22 20:42 . 2008-02-19 13:57 208896 ----a-w- c:\windows\system32\atipdlxx.dll
2010-06-22 20:42 . 2008-02-19 13:57 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2010-06-22 20:42 . 2008-02-19 13:57 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2010-06-22 20:42 . 2008-02-19 13:57 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-06-22 20:42 . 2008-10-07 16:01 2273792 ----a-w- c:\windows\system32\ativvaxx.dll
2010-06-22 20:42 . 2008-02-19 13:56 159744 ----a-w- c:\windows\system32\ati2evxx.dll
2010-06-22 20:41 . 2009-07-21 20:51 887724 ----a-w- c:\windows\system32\ativva6x.dat
2010-06-22 20:41 . 2009-07-21 20:51 3 ----a-w- c:\windows\system32\ativva5x.dat
2010-06-22 20:40 . 2008-02-19 13:55 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2010-06-22 20:39 . 2008-02-19 13:54 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2010-06-22 20:35 . 2008-02-19 13:22 573440 ----a-w- c:\windows\system32\atikvmag.dll
2010-06-22 20:34 . 2008-02-19 13:18 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2010-06-22 20:32 . 2008-02-19 13:21 17408 ----a-w- c:\windows\system32\atitvo32.dll
2010-06-22 20:27 . 2008-10-07 16:01 704512 ----a-w- c:\windows\system32\ati2cqag.dll
2010-06-22 20:26 . 2008-02-19 13:26 65024 ----a-w- c:\windows\system32\amdpcom32.dll
2010-06-22 20:25 . 2008-02-19 13:20 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-06-21 15:27 . 2004-08-04 01:07 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 01:07 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2008-09-29 16:39 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 01:07 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-08 16:10 . 2010-07-07 15:55 790528 ----a-w- c:\windows\system32\xvidcore.dll
2010-06-08 16:10 . 2010-07-07 15:55 134144 ----a-w- c:\windows\system32\xvidvfw.dll
2010-06-01 17:37 . 2010-07-06 17:13 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-23 15:50 . 2010-07-19 14:27 73216 ----a-w- c:\documents and settings\MS\Application Data\Mozilla\Firefox\Profiles\4jmtyzlv.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
2009-09-03 20:54 . 2009-09-03 20:54 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-12-15 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-12-15 5513216]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-14 221184]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1947:TCP"= 1947:TCP:HASP SRM
"1947:UDP"= 1947:UDP:HASP SRM

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [28.4.2010 8:17 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3.8.2010 13:28 95896]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.8.2010 14:16 810144]
R2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe -run --> c:\windows\system32\hasplms.exe -run [?]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3.9.2009 22:54 30192]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23.4.2007 13:54 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23.4.2007 13:54 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23.4.2007 13:54 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23.4.2007 13:54 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23.4.2007 13:54 98568]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.10.2008 16:36 716272]
.
Contents of the 'Scheduled Tasks' folder

2010-08-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-573735546-839522115-1003Core.job
- c:\documents and settings\MS\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-06 18:55]

2010-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-573735546-839522115-1003UA.job
- c:\documents and settings\MS\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-06 18:55]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: &Stáhnout &vše FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1} - file://c:\program files\AutoCAD LT 2000i Cz\InstFred.ocx
FF - ProfilePath - c:\documents and settings\MS\Application Data\Mozilla\Firefox\Profiles\4jmtyzlv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/resul ... EF&v=18&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - component: c:\documents and settings\MS\Application Data\Mozilla\Firefox\Profiles\4jmtyzlv.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
FF - plugin: c:\documents and settings\MS\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
------- File Associations -------
.
.scr=AutoCADLTScriptFile
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-19 18:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll

- - - - - - - > 'explorer.exe'(2844)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\hasplms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-08-19 18:21:04 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-19 16:21

Pre-Run: 22 641 569 792 bytes free
Post-Run: 10 adresárov, 22 491 136 000 voľných bajtov

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 4F0F32444D45523A4ABED3BF35E46011

2 položky smazány, zbytek logu vypadá čistý. Nastala nějaká změna?

Nezmenilo sa v podstate nič, len občas výkon CPU zakolíše okolo 80%, ale žiadne citeľné zmeny.

Nezmenilo sa v podstate nič, len občas výkon CPU zakolíše okolo 80%, ale žiadne citeľné zmeny.

Který z procesů nejvíce zatěžuje procesor?

Momentálne najviac firefox.exe (cca 130 00) potom ekrn.exe (cca 60 000K) a svchost.exe (cca 33 000K)

Zkuste FF přeinstalovat pomocí MozBackup: http://www.slunecnice.cz/sw/mozbackup/ .

Moc to nepomohlo, ale keď sa teraz pozeram na zaťaženie procesora tak najviac mu dava zabrať položka "Procesy systémovej nečinnosti", používanie pamäte minimalne, ale procesor stale 60-99%.

..alebo sa mylim a "proces syst. nečinnosti" na 100% znamena, ze procesor je necinny?

Ano, měl by být nečinný. Máte PC za chodu nějak zpomalen?

Je spomaleny, seka uz aj video, obcas hudbu (1,9Ghz, 2G RAM). Na druhom PC "Procesy syst. necinnosti" dosahuju rovnake hodnoty, ale zatazenie procesora sa pohybuje okolo4-10%. Moj pri rovnakych podmienkach bezi na 80-100%.

Zkuste obnovu systému k datu, kdy korektně fungoval.