no bohužel vysvětlování moc nepomáhá to dělám už nejméně rok, takže takhle mám aspoň přehled co kde lumpačí. Jinak nevím jak to, ale nyní jsem pc po půl dni zapnul a běží naprosto bez problému, tak nevím.
Logfile of random's system information tool 1.08 (written by random/random)
Run by fotr at 2011-05-04 16:59:03
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 10 GB (51%) free of 20 GB
Total RAM: 1023 MB (70% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:59:08, on 4.5.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVAST Software\Avast\setup\avast.setup
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\kernell.dll
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Documents and Settings\fotr\Plocha\All In One Keylogger 3.5.8 + Serial Cislo\iSafe AllInOne Keylogger 3.5.8 + Serial Cislo\Keylogger\winsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\fotr\Plocha\RSIT.exe
C:\Program Files\trend micro\fotr.exe
C:\WINDOWS\system32\wuauclt.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.cz/webhp?hl=cs
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IHPIEHook Class - {0eceeac0-8a08-11d4-a521-0020af300fc7} - C:\gpmplwaf\HPIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iSafeCW] C:\Documents and Settings\fotr\Plocha\All In One Keylogger 3.5.8 + Serial Cislo\iSafe AllInOne Keylogger 3.5.8 + Serial Cislo\Keylogger\winsrv.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 3803 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0eceeac0-8a08-11d4-a521-0020af300fc7}]
IHPIEHook Class - C:\gpmplwaf\HPIE.dll [2011-03-28 40960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15 62376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-02-23 814160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-02-23 814160]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2011-02-23 3451496]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2010-11-15 35736]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ7.4\ICQ.exe [2011-03-28 119608]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Real Spy Monitor]
C:\Program Files\Real Spy Monitor\winrsm.exe []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2010-02-11 155648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{DAE0285D-0788-4E87-985E-01DF2EDE4ACD}"=C:\WINDOWS\system32\Wshxt.dll [2011-03-28 53248]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
======List of files/folders created in the last 1 months======
2011-05-04 08:11:35 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\TEMP
2011-05-04 08:11:18 ----A---- C:\WINDOWS\system32\MSSTDFMT.DLL
2011-05-04 08:11:18 ----A---- C:\WINDOWS\system32\IJL_11.DLL
2011-04-28 19:40:34 ----D---- C:\WINDOWS\system32\NtmsData
2011-04-21 11:35:55 ----D---- C:\Documents and Settings\fotr\Data aplikací\Skype
2011-04-19 20:54:28 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Windows Genuine Advantage
2011-04-12 10:34:49 ----D---- C:\Program Files\trend micro
2011-04-12 10:34:48 ----D---- C:\rsit
2011-04-11 19:41:11 ----D---- C:\WINDOWS\Minidump
2011-04-09 21:23:36 ----A---- C:\WINDOWS\system32\drivers\usbser.sys
2011-04-09 21:23:17 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll
2011-04-09 21:22:22 ----D---- C:\Documents and Settings\fotr\Data aplikací\Nokia
2011-04-09 21:22:20 ----D---- C:\Documents and Settings\fotr\Data aplikací\PC Suite
2011-04-09 21:22:20 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\PC Suite
2011-04-09 21:21:41 ----A---- C:\WINDOWS\system32\drivers\pccsmcfd.sys
2011-04-09 21:21:25 ----A---- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2011-04-09 21:21:25 ----A---- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2011-04-09 21:21:24 ----A---- C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011-04-09 21:21:22 ----A---- C:\WINDOWS\system32\wdfcoinstaller01009.dll
2011-04-09 21:21:22 ----A---- C:\WINDOWS\system32\nmwcdcocls.dll
2011-04-09 21:21:22 ----A---- C:\WINDOWS\system32\drivers\ccdcmb.sys
2011-04-09 21:21:22 ----A---- C:\WINDOWS\system32\ccdcmbwu.dll
2011-04-09 21:21:21 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2011-04-09 21:20:35 ----D---- C:\Documents and Settings\fotr\Data aplikací\Macromedia
2011-04-09 21:19:47 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Installations
2011-04-08 09:53:29 ----D---- C:\Documents and Settings\fotr\Data aplikací\Adobe
2011-04-05 19:31:37 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\HtmlData
======List of files/folders modified in the last 1 months======
2011-05-04 16:58:55 ----HD---- C:\WINDOWS\Temp
2011-05-04 16:58:47 ----D---- C:\WINDOWS
2011-05-04 12:20:24 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-05-04 11:11:28 ----D---- C:\WINDOWS\Prefetch
2011-05-04 08:48:19 ----D---- C:\WINDOWS\system32
2011-05-04 08:39:48 ----SD---- C:\Documents and Settings\fotr\Data aplikací\Microsoft
2011-05-04 08:36:41 ----HD---- C:\Program Files\Ojuztqytejd
2011-05-04 08:11:17 ----RD---- C:\Program Files
2011-05-04 08:09:45 ----D---- C:\Documents and Settings\fotr\Data aplikací\WinRAR
2011-05-01 11:24:48 ----SHD---- C:\WINDOWS\Installer
2011-04-27 17:56:20 ----D---- C:\WINDOWS\system32\CatRoot2
2011-04-11 12:07:35 ----D---- C:\Documents and Settings
2011-04-11 06:27:12 ----HD---- C:\WINDOWS\inf
2011-04-11 06:27:00 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-04-09 21:24:43 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-04-09 21:23:41 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-04-09 21:23:39 ----D---- C:\WINDOWS\system32\drivers
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 nv_agp;NVIDIA nForce AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\nv_agp.sys [2004-04-02 21760]
R0 nvatabus;nvatabus; C:\WINDOWS\system32\DRIVERS\nvatabus.sys [2004-06-03 79360]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-02-23 30680]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41600]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-02-23 25432]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-02-23 371544]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-02-23 301528]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-02-23 49240]
R1 Winhpfile;Winhpfile; \??\C:\gpmplwaf\HPFile.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-02-23 19544]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-02-23 102232]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-12-29 4026112]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2010-02-11 3565056]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2004-05-17 33280]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2004-05-17 12928]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-07-30 18048]
S3 nmwcdc;Nokia USB Communication Driver; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2010-07-30 23040]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2010-07-30 8192]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2010-07-30 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2010-02-11 602112]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-02-23 42184]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2010-02-10 593920]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-12-08 628736]
-----------------EOF-----------------
Lumparny keyloggerem neomezite, to chce vysvetlit 
