VIRY.CZ

zdravim,
mam problem s notebookem (operacni system win XP prof. eng.)
uz jsem pouzil:

scandisk
vycisteni disku
defragmentaci
aktualizace
scan avg
Avast! Free Antivirus 5.0
Anti-Malware 1.44
AVG Free ALL 9.0.73
BootVist 1.3.37
CCleaner 2.19.9
Spybot Search and Destroy 1.6.2
Spyware Terminator 2.5.6.316

ani jeden program nenasel zadnou nakazu.. nic se nezrychlilo

ve spravci uloh neni zadna aplikace ktera by vyrazne vytizila CPU

jedine co mi prijde podezrele je, ze v Process Explorer v11.33,
jsou vypsana u kazde bezici aplikace divna hesla (viz obrazek)


problem se objevil pred cca mesicem

tady prikladam log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Owner at 2010-02-07 23:59:53
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 12 GB (41%) free of 29 GB
Total RAM: 510 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:01:18, on 08.02.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Logovani\RSIT.exe
C:\Program Files\trend micro\Owner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://kateandjenspage.com/c`mhj`lhr^`mhqhn
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: &Ýęńďîđň â Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Ńďđŕâî÷íűĺ ěŕňĺđčŕëű - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 4708 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-19 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-19 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-05-13 98304]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-05-14 536576]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-19 148888]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"DadApp"=C:\Program Files\Dell\AccessDirect\dadapp.exe [2004-03-04 211828]
"Dell QuickSet"=C:\Program Files\Dell\QuickSet\quickset.exe [2004-03-04 487424]
"DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2004-04-11 53248]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2004-02-25 118784]
"PCMService"=C:\Program Files\Dell\Media Experience\PCMService.exe [2004-04-11 290816]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2004-02-25 155648]
"SigmaTel StacMon"=C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe [2004-04-29 90169]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-02-25 339968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Far\Far.exe"="C:\Program Files\Far\Far.exe:*:Enabled:File and archive manager"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 2 months======

2010-02-07 23:51:36 ----D---- C:\Program Files\trend micro
2010-02-07 23:51:35 ----D---- C:\rsit
2010-02-07 22:20:03 ----A---- C:\ComboFix.txt
2010-02-07 21:21:35 ----A---- C:\Boot.bak
2010-02-07 21:21:17 ----RASHD---- C:\cmdcons
2010-02-07 21:16:34 ----A---- C:\WINDOWS\zip.exe
2010-02-07 21:16:34 ----A---- C:\WINDOWS\SWREG.exe
2010-02-07 21:16:34 ----A---- C:\WINDOWS\sed.exe
2010-02-07 21:16:34 ----A---- C:\WINDOWS\PEV.exe
2010-02-07 21:16:34 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-07 21:16:34 ----A---- C:\WINDOWS\MBR.exe
2010-02-07 21:16:34 ----A---- C:\WINDOWS\grep.exe
2010-02-07 21:16:33 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-07 21:16:33 ----A---- C:\WINDOWS\SWSC.exe
2010-02-07 21:14:37 ----D---- C:\WINDOWS\ERDNT
2010-02-07 21:13:54 ----D---- C:\Qoobox
2010-02-07 20:53:54 ----D---- C:\Program Files\CCleaner
2010-02-07 20:29:36 ----A---- C:\WINDOWS\system32\tmp.txt
2010-02-07 20:28:46 ----A---- C:\rapport.txt
2010-02-07 02:16:24 ----D---- C:\Program Files\Alwil Software
2010-02-07 02:16:24 ----D---- C:\Documents and Settings\All Users\Application Data\Alwil Software
2010-02-06 11:47:06 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2010-02-06 11:46:54 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-02-05 00:01:57 ----D---- C:\$AVG
2010-02-04 23:58:12 ----D---- C:\Program Files\AVG
2010-02-04 23:58:12 ----D---- C:\Documents and Settings\All Users\Application Data\avg9
2010-02-04 23:16:20 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-02-04 23:16:00 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-02-02 20:38:37 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-02-02 20:37:55 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2010-02-02 20:37:06 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-02-02 20:36:17 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-02-02 20:35:43 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-02-02 20:35:07 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2010-02-02 20:34:30 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-02-02 20:33:27 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-02-02 20:32:44 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-02-02 20:31:48 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-02-02 20:31:03 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-02-02 20:30:25 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2010-02-02 20:28:35 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-02-02 20:24:52 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-02-02 20:22:37 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-02-02 20:20:43 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-02-02 20:18:37 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-02-02 20:17:22 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2010-02-02 20:08:43 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2010-02-02 20:08:18 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2010-02-02 20:07:43 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-02-02 19:55:07 ----D---- C:\WINDOWS\ie8updates
2010-02-02 19:42:26 ----HDC---- C:\WINDOWS\ie8
2010-02-02 18:46:31 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-02-02 18:45:59 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-02-02 18:45:30 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-02-02 18:45:11 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-02-02 18:44:28 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-02-02 18:43:35 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2010-02-02 18:43:13 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-02-02 18:42:16 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2010-02-02 18:41:15 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-02-02 18:21:19 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2010-01-29 14:39:04 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-01-29 14:39:04 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-20 23:59:54 ----A---- C:\WINDOWS\ntbtlog.txt

======List of files/folders modified in the last 2 months======

2010-02-07 23:54:33 ----D---- C:\WINDOWS\Prefetch
2010-02-07 23:51:36 ----RD---- C:\Program Files
2010-02-07 23:47:51 ----D---- C:\WINDOWS\system32\drivers
2010-02-07 23:39:14 ----D---- C:\Documents and Settings\Owner\Application Data\Skype
2010-02-07 23:38:45 ----D---- C:\Documents and Settings\Owner\Application Data\skypePM
2010-02-07 23:37:21 ----D---- C:\WINDOWS\Temp
2010-02-07 23:35:50 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-07 22:20:09 ----D---- C:\WINDOWS\system32
2010-02-07 22:05:29 ----D---- C:\WINDOWS
2010-02-07 22:05:29 ----A---- C:\WINDOWS\system.ini
2010-02-07 21:36:45 ----D---- C:\WINDOWS\AppPatch
2010-02-07 21:36:31 ----D---- C:\Program Files\Common Files
2010-02-07 21:24:25 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-07 21:21:35 ----RASH---- C:\boot.ini
2010-02-07 21:16:31 ----SHD---- C:\System Volume Information
2010-02-07 21:16:31 ----D---- C:\WINDOWS\system32\Restore
2010-02-07 19:52:05 ----D---- C:\Documents and Settings
2010-02-07 02:19:24 ----SHD---- C:\WINDOWS\Installer
2010-02-07 02:19:16 ----D---- C:\WINDOWS\WinSxS
2010-02-06 21:57:22 ----SD---- C:\Documents and Settings\Owner\Application Data\Microsoft
2010-02-04 23:58:01 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-02-04 23:23:06 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-04 23:16:28 ----HD---- C:\WINDOWS\inf
2010-02-04 23:16:24 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-04 23:16:08 ----A---- C:\WINDOWS\imsins.BAK
2010-02-04 23:15:37 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-02 21:12:20 ----D---- C:\WINDOWS\system32\en-US
2010-02-02 21:12:18 ----D---- C:\WINDOWS\Media
2010-02-02 21:12:18 ----D---- C:\WINDOWS\Help
2010-02-02 21:12:18 ----D---- C:\Program Files\Internet Explorer
2010-02-02 18:44:39 ----D---- C:\Program Files\Outlook Express
2010-02-02 17:49:28 ----D---- C:\WINDOWS\SoftwareDistribution
2010-01-21 00:32:43 ----A---- C:\WINDOWS\OEWABLog.txt
2010-01-20 23:02:26 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-01-04 16:17:48 ----A---- C:\WINDOWS\system32\MRT.exe
2009-12-21 22:14:05 ----N---- C:\WINDOWS\system32\wininet.dll
2009-12-21 22:14:05 ----A---- C:\WINDOWS\system32\urlmon.dll
2009-12-21 22:14:04 ----N---- C:\WINDOWS\system32\occache.dll
2009-12-21 22:14:04 ----N---- C:\WINDOWS\system32\mshtml.dll
2009-12-21 22:14:03 ----N---- C:\WINDOWS\system32\jsproxy.dll
2009-12-21 22:14:03 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2009-12-21 22:14:03 ----A---- C:\WINDOWS\system32\msfeeds.dll
2009-12-21 22:14:03 ----A---- C:\WINDOWS\system32\iertutil.dll
2009-12-21 22:14:03 ----A---- C:\WINDOWS\system32\iepeers.dll
2009-12-21 22:14:02 ----A---- C:\WINDOWS\system32\ieframe.dll
2009-12-21 22:14:01 ----N---- C:\WINDOWS\system32\iedkcs32.dll
2009-12-21 16:19:18 ----N---- C:\WINDOWS\system32\ie4uinit.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 OMCI;OMCI WDM Device Driver; C:\WINDOWS\system32\DRIVERS\omci.sys [2004-02-13 17153]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]
R3 AR9271;Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athuw.sys [2009-07-09 1668352]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2003-09-26 44032]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2003-11-13 1042816]
R3 HSFHWICH;HSFHWICH; C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2003-11-13 197120]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-02-25 681629]
R3 STAC97;Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\stac97.sys [2004-05-12 258704]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-05-13 182688]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2003-11-13 679808]
S3 catchme;catchme; \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys []
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-12 12160]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-19 152984]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

ahoj,
stiahni a uloz na plochu ComboFix

potom spust pod uctom s administratorskym opravnenim


akcia trva cca. 5-10 minut, niekedy i dlhsie -, Pocas scanu nespustaj ziadne ine aplikacie

Nie je dovod na paniku ak stroj bude restartovany
upozornenie: ak pouzivas antispyware s rezidentnim stitem, ten pred scanom vypni.

po restarte aplikacie vytvori log, ulozeny na C:\Combofix.txt (jeho obsah vloz sem)

tady to je



ComboFix 10-02-07.01 - Owner 08.02.2010 9:57.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1251.7.1033.18.510.313 [GMT 3:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-01-08 to 2010-02-08 )))))))))))))))))))))))))))))))
.

2010-02-07 21:10 . 2010-01-07 13:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-07 21:10 . 2010-02-07 21:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-07 21:10 . 2010-01-07 13:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-07 20:51 . 2010-02-07 21:00 -------- d-----w- c:\program files\trend micro
2010-02-07 20:51 . 2010-02-07 20:53 -------- d-----w- C:\rsit
2010-02-06 23:16 . 2010-02-06 23:16 -------- d-----w- c:\program files\Alwil Software
2010-02-06 23:16 . 2010-02-06 23:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-06 08:47 . 2010-02-06 08:47 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-02-06 08:46 . 2010-02-06 08:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-05 19:13 . 2010-02-04 20:58 1260800 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-02-05 19:13 . 2010-02-04 20:58 3777280 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-02-05 18:49 . 2010-02-05 18:49 0 ----a-w- c:\windows\system32\svc_host.dat
2010-02-04 21:01 . 2010-02-05 00:48 -------- d-----w- C:\$AVG
2010-02-04 20:58 . 2010-02-06 19:02 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-04 20:58 . 2010-02-04 20:58 -------- d-----w- c:\program files\AVG
2010-02-04 20:11 . 2010-02-04 20:11 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2010-02-04 20:11 . 2010-02-04 20:11 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE
2010-02-02 18:14 . 2010-02-02 18:14 -------- d-sh--w- c:\documents and settings\Owner\IETldCache
2010-02-02 16:58 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-02-02 16:55 . 2010-02-02 17:03 -------- d-----w- c:\windows\ie8updates
2010-02-02 16:51 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-02-02 16:50 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-02 16:42 . 2010-02-02 16:49 -------- dc-h--w- c:\windows\ie8
2010-02-02 15:27 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-02-02 15:24 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-29 11:39 . 2010-02-08 06:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-29 11:39 . 2010-02-07 21:31 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-20 20:02 . 2009-07-09 04:24 1668352 ----a-r- c:\windows\system32\drivers\athuw.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-08 06:53 . 2009-07-18 15:15 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2010-02-08 06:51 . 2009-11-04 13:55 -------- d-----w- c:\documents and settings\Owner\Application Data\skypePM
2010-02-08 05:49 . 2009-07-18 12:51 63976 -c--a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-21 19:14 . 2004-08-12 14:09 916480 ------w- c:\windows\system32\wininet.dll
2009-11-21 15:51 . 2004-08-12 13:55 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 536576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-19 148888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"DadApp"="c:\program files\Dell\AccessDirect\dadapp.exe" [2004-03-04 211828]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2004-03-04 487424]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-02-25 118784]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-25 155648]
"SigmaTel StacMon"="c:\program files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe" [2004-04-29 90169]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Far\\Far.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S3 AR9271;Wireless Network Adapter Service;c:\windows\system32\drivers\athuw.sys [20.01.2010 23:02 1668352]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = hxxp://kateandjenspage.com/c`mhj`lhr^`mhqhn
IE: &Ýęńďîđň â Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-08 10:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3892)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
.
Completion time: 2010-02-08 10:21:01
ComboFix-quarantined-files.txt 2010-02-08 07:20
ComboFix2.txt 2010-02-07 19:20

Pre-Run: 12 119 826 432 bytes free
Post-Run: 12 092 784 640 bytes free

- - End Of File - - 048DDCF3B11D1D9E14CF0E51D2634B00

odinstaluj SpyBot a prescanuj PC so SUPERAntiSpyware

kontrola doběhla, našlo to jenom cca 150 adware tracking cookie

aby sa vyjasnilo po AV stranke - prescanuj PC s AVPTool

AVPTool nic nenašlo.

otestuj disk programom z www.hdtune.com >> vysledky vloz min/max, pristup. doba apod.

Tak jsem přišel na to, že za to nejspíš může kombinace interních usb a usb-wifi karty tp-link.
Zajimavé je, že když dam do PCMCIA rozšiřující usb kartu a do ní zapojim zmíněnou wifi kartu notebook běží normálně, ale jakmile zapojim wifikartu do interních usb, celý systém se zpomalý (permanentní vytížení 50%).

I po odpojení wifi karty od interních usb problém přetrvává dokud nerestartuji notebooka.
Teď jsem zkusmo nahrál nový OS Win XP a vypozoroval to...

kedze to nie je AV problem, skus sa so ziskanymi poznatkami obratit na forum.zive.cz

Ok, děkuji za pomoc v řešení problému.

no nemas zac, ale snaha bola