Prosím o kontrolu logu - podezření na vir

[ileini]

Dobrý den,
když jsem dneska zapla svůj notebook, tak se mi najednou objevila černá obrázovka s modrými čárami. Notebook se pak restartoval a objevila se mi hláška v tom smyslu, že windows se nespustil, a pod tím pak byly tři nebo čtyři řešení, jak pokračovat dál. Zvolila jsem to, ve kterém bylo napsáno spustit windows. Všechno pak najelo. Na obrazovce se mi pak objevila tabulka, ve které bylo napsáno toto:

Podpis problému:
Název události problému: BlueScreen
Verze operačního systému: 6.0.6000.2.0.0.768.2
ID národního prostředí: 1029

Další informace o problému:
BCCode: 1000008e
BCP1: C0000005
BCP2: 87C62316
BCP3: 98F7BB20
BCP4: 00000000
OS Version: 6_0_6000
Service Pack: 0_0
Product: 768_1

Soubory umožňující popis problému:
C:\Windows\Minidump\Mini021310-01.dmp
C:\Users\Notebook\AppData\Local\Temp\WER-145656-0.sysdata.xml
C:\Users\Notebook\AppData\Local\Temp\WER28F1.tmp.version.txt

Přečtěte si prohlášení o zásadách ochrany osobních údajů:
http://go.microsoft.com/fwlink/?linkid= ... cid=0x0405

Vůbec netuším, co to mělo být. Myslela jsem si, že za to může nějaký vir. Spustila jsem teda avast, ten mi pak našel trojského koně v souboru MEMORY.dmp. Soubor jsem tedy odstranila. Zvláštní je, že v tomto souboru mi našel avast trojského koně už bůhví pokolikáté.
Tady je výpis z logu. Předem děkuji za pomoc.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Notebook at 2010-02-13 17:05:42
Microsoft® Windows Vista™ Home Basic
System drive C: has 36 GB (60%) free of 60 GB
Total RAM: 958 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:06:13, on 13.2.2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\s3trayp.exe
C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Users\Notebook\Desktop\RSIT.exe
C:\Program Files\trend micro\Notebook.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe 1
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Kniha klipů HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Chytrý výběr - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 6731 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2009-07-31 1006264]
"S3Trayp"=C:\Windows\system32\S3trayp.exe [2007-03-07 176128]
"HDAudDeck"=C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe [2007-02-16 1122304]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-10 815104]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-08-02 2171904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-31 1232896]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2009-08-02 3055616]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-02 201728]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-02-13 17:05:42 ----D---- C:\rsit
2010-02-10 21:50:08 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-10 21:50:05 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-10 21:49:43 ----A---- C:\Windows\system32\tcpipcfg.dll
2010-02-10 21:49:43 ----A---- C:\Windows\system32\netiougc.exe
2010-02-10 21:49:35 ----A---- C:\Windows\system32\quartz.dll
2010-02-10 21:49:34 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-10 21:49:33 ----A---- C:\Windows\system32\msyuv.dll
2010-02-10 21:49:33 ----A---- C:\Windows\system32\msrle32.dll
2010-02-10 21:49:32 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-10 21:49:32 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-10 21:49:31 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-10 21:49:30 ----A---- C:\Windows\system32\avifil32.dll
2010-02-10 21:49:29 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-10 21:49:29 ----A---- C:\Windows\system32\avicap32.dll
2010-02-09 11:36:37 ----D---- C:\Windows\Sun
2010-02-09 11:31:20 ----D---- C:\ProgramData\Sun
2010-02-09 11:30:47 ----A---- C:\Windows\system32\deploytk.dll
2010-01-26 15:55:29 ----D---- C:\Program Files\CCleaner
2010-01-22 17:41:15 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 17:41:14 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 17:41:13 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 17:41:11 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 17:41:10 ----A---- C:\Windows\system32\mstime.dll
2010-01-22 17:41:08 ----A---- C:\Windows\system32\ieapfltr.dll
2010-01-22 17:41:08 ----A---- C:\Windows\system32\ie4uinit.exe
2010-01-22 17:41:06 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 17:41:05 ----A---- C:\Windows\system32\mshtmled.dll
2010-01-22 17:41:05 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 17:41:05 ----A---- C:\Windows\system32\icardie.dll
2010-01-22 17:41:05 ----A---- C:\Windows\system32\dxtmsft.dll
2010-01-22 17:41:04 ----A---- C:\Windows\system32\occache.dll
2010-01-22 17:41:03 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 17:41:02 ----A---- C:\Windows\system32\pngfilt.dll
2010-01-22 17:41:02 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 17:41:02 ----A---- C:\Windows\system32\ieaksie.dll
2010-01-22 17:41:02 ----A---- C:\Windows\system32\dxtrans.dll
2010-01-22 17:41:01 ----A---- C:\Windows\system32\iernonce.dll
2010-01-22 17:41:01 ----A---- C:\Windows\system32\advpack.dll
2010-01-22 17:41:00 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 17:41:00 ----A---- C:\Windows\system32\ieencode.dll
2010-01-22 17:40:59 ----A---- C:\Windows\system32\admparse.dll
2010-01-22 17:40:58 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 17:40:57 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 17:40:55 ----A---- C:\Windows\system32\ieakui.dll
2010-01-22 17:40:54 ----A---- C:\Windows\system32\mshtmler.dll
2010-01-18 21:28:42 ----D---- C:\Users\Notebook\AppData\Roaming\AbleFaxTifView
2010-01-18 21:20:26 ----D---- C:\ProgramData\FLEXnet
2010-01-14 12:59:16 ----A---- C:\Windows\system32\t2embed.dll
2010-01-14 12:59:15 ----A---- C:\Windows\system32\fontsub.dll
2010-01-14 12:59:13 ----A---- C:\Windows\system32\lpk.dll
2010-01-14 12:59:13 ----A---- C:\Windows\system32\dciman32.dll
2010-01-14 12:59:12 ----A---- C:\Windows\system32\atmlib.dll
2010-01-14 12:59:12 ----A---- C:\Windows\system32\atmfd.dll

======List of files/folders modified in the last 1 months======

2010-02-13 17:06:13 ----D---- C:\Program Files\Trend Micro
2010-02-13 17:06:04 ----D---- C:\Windows\Temp
2010-02-13 17:05:50 ----D---- C:\Windows\Prefetch
2010-02-13 17:02:39 ----D---- C:\Program Files\Mozilla Firefox
2010-02-13 15:47:17 ----D---- C:\Windows
2010-02-13 15:17:42 ----SHD---- C:\Windows\Installer
2010-02-13 15:17:42 ----HD---- C:\Config.Msi
2010-02-13 15:17:42 ----D---- C:\Program Files\Common Files
2010-02-13 15:17:31 ----RD---- C:\Program Files
2010-02-13 15:17:20 ----D---- C:\Windows\System32
2010-02-13 15:16:18 ----SHD---- C:\System Volume Information
2010-02-13 15:12:08 ----D---- C:\Windows\Minidump
2010-02-12 16:27:37 ----D---- C:\ProgramData\Spyware Terminator
2010-02-12 16:27:30 ----D---- C:\Program Files\Spyware Terminator
2010-02-12 16:24:39 ----D---- C:\Users\Notebook\AppData\Roaming\Spyware Terminator
2010-02-12 16:23:08 ----D---- C:\Windows\Debug
2010-02-11 16:18:53 ----D---- C:\Windows\inf
2010-02-11 16:18:53 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-10 22:09:11 ----D---- C:\Windows\winsxs
2010-02-10 22:09:03 ----D---- C:\Windows\system32\catroot
2010-02-10 22:09:01 ----D---- C:\Windows\system32\catroot2
2010-02-10 22:06:05 ----D---- C:\Windows\system32\migration
2010-02-10 22:06:05 ----D---- C:\Windows\system32\drivers
2010-02-10 22:06:05 ----D---- C:\Program Files\Windows Mail
2010-02-09 11:31:20 ----HD---- C:\ProgramData
2010-02-08 14:45:19 ----D---- C:\Windows\system32\WDI
2010-02-04 16:25:50 ----A---- C:\Windows\win.ini
2010-02-01 20:26:20 ----A---- C:\Windows\system32\mrt.exe
2010-01-22 18:01:12 ----D---- C:\Program Files\Internet Explorer
2010-01-22 18:01:11 ----D---- C:\Windows\AppPatch
2010-01-18 22:29:06 ----D---- C:\Program Files\Common Files\Adobe
2010-01-18 22:26:42 ----D---- C:\Program Files\Adobe
2010-01-18 22:10:11 ----D---- C:\Users\Notebook\AppData\Roaming\Adobe
2010-01-18 22:08:38 ----D---- C:\ProgramData\Adobe
2010-01-18 22:04:52 ----D---- C:\Windows\system32\Tasks
2010-01-18 21:07:28 ----RSD---- C:\Windows\Fonts
2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-25 23120]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 SbFw;SbFw; C:\Windows\system32\drivers\SbFw.sys [2008-10-31 270888]
R1 sbhips;Sunbelt HIPS Driver; C:\Windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2009-08-02 142592]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-11-25 53328]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2009-07-31 14208]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\Windows\system32\DRIVERS\fetnd5bv.sys [2006-12-20 45568]
R3 HdAudAddService;VIA High Definition Audio Service; C:\Windows\system32\drivers\viahduaa.sys [2007-01-16 202752]
R3 S3GIGP;S3GIGP; C:\Windows\system32\DRIVERS\VTGKModeDX32.sys [2007-03-07 844288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\Windows\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver; C:\Windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-11-10 181176]
S3 Dot4;Ovladač MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2006-11-02 131584]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2006-11-02 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2006-11-02 36864]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 FETNDIS;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\Windows\system32\DRIVERS\fetnd5.sys [2006-11-02 45568]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-08-02 487424]
R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[Rudy]

Nevidím nic nebezpečného. Pro jistotu dejte log z MBAM: http://www.malwarebytes.org/mbam.php . Předem nic nemažte.

[ileini]

Provedla jsem sken, ale program nic nebezpečného nenašel. Vypadá to, že v notebooku není nic škodlivého. Jenom nechápu, proč avast pokaždé najde trojského koně v tom samém souboru.

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3733
Windows 6.0.6000
Internet Explorer 7.0.6000.16982

13.2.2010 19:58:07
mbam-log-2010-02-13 (19-58-07).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 104298
Uplynulý čas: 6 minute(s), 4 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

[Rudy]

Ve kterém souboru?

[ileini]

V souboru MEMORY.dmp

[Rudy]

Memory.dmp je v podstatě výpis paměti při pádu systému. Podle mého názoru neexistuje důvod, proč by v něm měla být infekce. Až se avast opět ozve, zkontrolujte soubor online na www.virustotal.com . Mám za to, že jde o planý poplach.

[ileini]

Dobře. Moc děkuji za pomoc a za tvůj čas.

[Rudy]

Nemáte zač!