PC sa sprava divne

Zpráva

e-comm · #1 Příspěvek od **e-comm** » 08 bře 2014 11:41

Ahojte

mal som v PC policajny virus, chalani z ESETU mi ho komplet vyliecili.
Odvtedy sa ale pc sprava divne..mrzne, sem tam ide rychlo inokedy velmi pomaly..
Mozete sa mi nato prosim pozriet?

Vopred dakujem

Prikladam log:

Logfile of random's system information tool 1.09 (written by random/random)
Run by MM at 2014-03-08 11:48:40
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 200 GB (84%) free of 238 GB
Total RAM: 1535 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:48:48, on 8.3.2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre7\bin\jqs.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\MM\My Documents\Downloads\CorelDRAWGraphicsSuiteX6Installer_CZ32Bit.exe
C:\Documents and Settings\All Users\Application Data\CorelDRAW Graphics Suite X6\16.1.0.843\SetupARP.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\MM\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\MM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPLTarget\P0000000000000000] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIHLE.EXE /EPT "EPLTarget\P0000000000000000" /M "Epson Stylus SX235"
O4 - HKCU\..\Run: [ITVsoft] regsvr32.exe "C:\Documents and Settings\MM\Local Settings\Application Data\ITVsoft\dwcjid.dll"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: TrayMenu.lnk = C:\WINDOWS\system32\C2MP\TrayMenu.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

--
End of file - 5766 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-19 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}]
Easy Photo Print - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-03-30 266240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-19 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} - Easy Photo Print - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-03-30 266240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2013-09-12 5110672]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2014-02-12 43848]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-17 577536]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2014-02-21 152392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"EPLTarget\P0000000000000000"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIHLE.EXE [2012-02-29 249440]
"ITVsoft"=regsvr32.exe C:\Documents and Settings\MM\Local Settings\Application Data\ITVsoft\dwcjid.dll []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedUpMyComputer]
C:\Program Files\SmartTweak\SpeedUpMyComputer\SpeedUpMyComputer.exe /ot /as []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
TrayMenu.lnk - C:\WINDOWS\system32\C2MP\TrayMenu.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-11 239496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Documents and Settings\MM\Local Settings\Temporary Internet Files\Content.IE5\SJ27GL6B\winbox[1].exe"="C:\Documents and Settings\MM\Local Settings\Temporary Internet Files\Content.IE5\SJ27GL6B\winbox[1].exe:*:Enabled:winbox[1]"
"C:\Documents and Settings\MM\Local Settings\Temporary Internet Files\Content.IE5\AZ8HA36R\winbox[1].exe"="C:\Documents and Settings\MM\Local Settings\Temporary Internet Files\Content.IE5\AZ8HA36R\winbox[1].exe:*:Enabled:winbox[1]"
"C:\Documents and Settings\MM\Local Settings\Temporary Internet Files\Content.IE5\EFUPQHGN\winbox[1].exe"="C:\Documents and Settings\MM\Local Settings\Temporary Internet Files\Content.IE5\EFUPQHGN\winbox[1].exe:*:Enabled:winbox[1]"
"C:\Documents and Settings\MM\My Documents\Downloads\winbox.exe"="C:\Documents and Settings\MM\My Documents\Downloads\winbox.exe:*:Enabled:winbox"
"C:\Documents and Settings\MM\My Documents\Downloads\winbox (2).exe"="C:\Documents and Settings\MM\My Documents\Downloads\winbox (2).exe:*:Enabled:winbox (2)"
"C:\Documents and Settings\MM\My Documents\Downloads\winbox (3).exe"="C:\Documents and Settings\MM\My Documents\Downloads\winbox (3).exe:*:Enabled:winbox (3)"
"C:\Documents and Settings\MM\My Documents\Downloads\winbox (4).exe"="C:\Documents and Settings\MM\My Documents\Downloads\winbox (4).exe:*:Enabled:winbox (4)"
"C:\Documents and Settings\MM\My Documents\Downloads\winbox (5).exe"="C:\Documents and Settings\MM\My Documents\Downloads\winbox (5).exe:*:Enabled:winbox (5)"
"C:\Documents and Settings\MM\My Documents\Downloads\winbox (6).exe"="C:\Documents and Settings\MM\My Documents\Downloads\winbox (6).exe:*:Enabled:winbox (6)"
"C:\Documents and Settings\MM\My Documents\Downloads\winbox (7).exe"="C:\Documents and Settings\MM\My Documents\Downloads\winbox (7).exe:*:Enabled:winbox (7)"
"C:\Documents and Settings\MM\Application Data\Spotify\spotify.exe"="C:\Documents and Settings\MM\Application Data\Spotify\spotify.exe:*:Enabled:Spotify"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Windows Expolrer"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Windows host process (Rundll32)"
"C:\Program Files\TeamViewer\Version8\TeamViewer.exe"="C:\Program Files\TeamViewer\Version8\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe"="C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Documents and Settings\MM\My Documents\Downloads\utorrent (1).exe"="C:\Documents and Settings\MM\My Documents\Downloads\utorrent (1).exe:*:Enabled:μTorrent2"
"C:\Documents and Settings\MM\Application Data\uTorrent\uTorrent.exe"="C:\Documents and Settings\MM\Application Data\uTorrent\uTorrent.exe:*:Enabled:μTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"vidc.ffds"=ff_vfw.dll
"vidc.xvid"=xvidvfw.dll
"vidc.x264"=x264vfw.dll
"vidc.lags"=lagarith.dll
"msacm.lameacm"=LameACM.acm
"msacm.divxa32"=DivXa32.acm

======List of files/folders created in the last 1 month======

2014-03-08 11:48:41 ----D---- C:\Program Files\trend micro
2014-03-08 11:48:40 ----D---- C:\rsit
2014-03-08 11:35:58 ----D---- C:\WINDOWS\LastGood
2014-03-08 11:17:13 ----D---- C:\WINDOWS\system32\XPSViewer
2014-03-08 11:17:09 ----D---- C:\Program Files\MSBuild
2014-03-04 13:32:43 ----D---- C:\f0620e427d64021c63
2014-02-27 10:36:47 ----D---- C:\Program Files\iPod
2014-02-27 10:36:31 ----D---- C:\Program Files\iTunes
2014-02-27 10:36:31 ----D---- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-21 12:52:06 ----D---- C:\Program Files\Common Files\Adobe
2014-02-21 11:41:28 ----D---- C:\Program Files\Microsoft SDKs
2014-02-21 11:41:21 ----D---- C:\Program Files\Microsoft Visual Studio 9.0
2014-02-21 11:33:48 ----D---- C:\WINDOWS\system32\appmgmt
2014-02-18 10:51:32 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2014-02-18 10:51:31 ----D---- C:\Documents and Settings\All Users\Application Data\Protexis
2014-02-18 10:51:03 ----D---- C:\Program Files\Common Files\Corel
2014-02-18 10:50:57 ----D---- C:\Program Files\Common Files\Protexis
2014-02-18 10:49:03 ----D---- C:\39a8ca3f8ba2ce32cacf
2014-02-18 10:48:49 ----D---- C:\Documents and Settings\All Users\Application Data\CorelDRAW Graphics Suite X6
2014-02-18 10:48:48 ----D---- C:\Documents and Settings\MM\Application Data\GHISLER
2014-02-18 10:39:32 ----D---- C:\Config.Msi
2014-02-18 09:22:09 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2014-02-17 23:15:16 ----D---- C:\Program Files\Mozilla Firefox
2014-02-17 16:08:03 ----D---- C:\Documents and Settings\MM\Application Data\Skype
2014-02-17 14:42:41 ----D---- C:\Documents and Settings\MM\Application Data\Corel
2014-02-17 14:35:00 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2014-02-17 14:33:08 ----D---- C:\Documents and Settings\All Users\Application Data\Corel
2014-02-17 14:22:53 ----D---- C:\Program Files\Corel
2014-02-17 14:06:41 ----D---- C:\81d4df330600d7496ee3
2014-02-17 14:04:32 ----D---- C:\Program Files\Reference Assemblies
2014-02-17 14:03:07 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2014-02-17 14:03:07 ----N---- C:\WINDOWS\system32\prntvpt.dll
2014-02-17 14:03:06 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2014-02-17 13:41:21 ----D---- C:\totalcmd
2014-02-17 13:41:21 ----A---- C:\WINDOWS\UC.PIF
2014-02-17 13:41:21 ----A---- C:\WINDOWS\RAR.PIF
2014-02-17 13:41:21 ----A---- C:\WINDOWS\PKZIP.PIF
2014-02-17 13:41:21 ----A---- C:\WINDOWS\PKUNZIP.PIF
2014-02-17 13:41:21 ----A---- C:\WINDOWS\LHA.PIF
2014-02-17 13:41:21 ----A---- C:\WINDOWS\ARJ.PIF
2014-02-14 09:58:58 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-02-14 09:58:54 ----ASH---- C:\hiberfil.sys
2014-02-14 08:33:09 ----A---- C:\WINDOWS\system32\d3d9caps.dat
2014-02-14 08:30:33 ----D---- C:\WINDOWS\CSC
2014-02-12 14:14:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2909921$
2014-02-12 14:09:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2916036$
2014-02-12 14:02:06 ----HDC---- C:\WINDOWS\$NtUninstallKB2909212$
2014-02-12 10:55:44 ----D---- C:\WINDOWS\pss
2014-02-12 10:43:42 ----D---- C:\Documents and Settings\MM\Application Data\WinRAR
2014-02-12 10:43:25 ----D---- C:\Program Files\WinRAR

======List of files/folders modified in the last 1 month======

2014-03-08 11:48:41 ----RD---- C:\Program Files
2014-03-08 11:36:39 ----HD---- C:\WINDOWS\inf
2014-03-08 11:36:37 ----D---- C:\WINDOWS\system32\CatRoot2
2014-03-08 11:36:37 ----D---- C:\WINDOWS
2014-03-08 11:36:36 ----D---- C:\WINDOWS\system32\CatRoot
2014-03-08 11:31:55 ----D---- C:\WINDOWS\Microsoft.NET
2014-03-08 11:31:53 ----RSD---- C:\WINDOWS\assembly
2014-03-08 11:25:29 ----D---- C:\WINDOWS\Temp
2014-03-08 11:25:03 ----D---- C:\WINDOWS\system32
2014-03-08 11:20:13 ----D---- C:\Documents and Settings\MM\Application Data\Spotify
2014-03-08 11:19:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2014-03-08 11:18:18 ----SHD---- C:\WINDOWS\Installer
2014-03-08 11:17:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2014-03-08 11:17:06 ----RSD---- C:\WINDOWS\Fonts
2014-03-08 11:16:11 ----D---- C:\WINDOWS\WinSxS
2014-03-08 11:14:45 ----D---- C:\WINDOWS\Prefetch
2014-03-08 11:06:10 ----D---- C:\Documents and Settings\MM\Application Data\uTorrent
2014-03-08 10:50:07 ----D---- C:\Documents and Settings\MM\Application Data\eM Client
2014-03-08 10:27:45 ----D---- C:\WINDOWS\system32\en-US
2014-03-08 10:27:17 ----D---- C:\WINDOWS\system32\mui
2014-03-05 11:35:21 ----D---- C:\Program Files\Defraggler
2014-03-05 10:28:17 ----D---- C:\Program Files\Google
2014-03-05 10:27:38 ----SD---- C:\WINDOWS\Tasks
2014-03-04 14:09:15 ----D---- C:\Program Files\BOSSAFX
2014-03-04 13:50:35 ----D---- C:\Documents and Settings\MM\Application Data\MetaQuotes
2014-03-04 11:03:33 ----D---- C:\Program Files\Common Files
2014-03-04 11:02:38 ----SD---- C:\Documents and Settings\MM\Application Data\Microsoft
2014-03-01 17:35:25 ----D---- C:\Program Files\Common Files\Microsoft Shared
2014-02-28 20:30:33 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2014-02-27 10:36:46 ----D---- C:\Program Files\Common Files\Apple
2014-02-27 10:36:10 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2014-02-26 08:45:10 ----D---- C:\Program Files\CCleaner
2014-02-26 08:10:25 ----D---- C:\Documents and Settings\MM\Application Data\TeamViewer
2014-02-21 21:03:24 ----D---- C:\Program Files\ESET
2014-02-21 18:56:23 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2014-02-21 12:52:09 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2014-02-21 11:46:34 ----D---- C:\WINDOWS\pchealth
2014-02-21 11:41:21 ----D---- C:\Program Files\Microsoft.NET
2014-02-18 10:48:23 ----D---- C:\Documents and Settings\MM\Application Data\Adobe
2014-02-18 10:39:08 ----D---- C:\WINDOWS\system32\Restore
2014-02-17 14:04:01 ----D---- C:\WINDOWS\system32\spool
2014-02-14 16:41:54 ----D---- C:\WINDOWS\SoftwareDistribution
2014-02-13 21:07:50 ----SHD---- C:\System Volume Information
2014-02-13 14:11:10 ----D---- C:\Documents and Settings\All Users\Application Data\Bitser
2014-02-13 14:10:57 ----D---- C:\Documents and Settings\MM\Application Data\Bazwise
2014-02-12 16:17:31 ----D---- C:\WINDOWS\Debug
2014-02-12 14:43:57 ----D---- C:\Program Files\TeamViewer
2014-02-12 14:14:08 ----D---- C:\WINDOWS\system32\MRT
2014-02-12 14:09:39 ----A---- C:\WINDOWS\system32\MRT.exe
2014-02-12 10:56:35 ----SH---- C:\boot.ini
2014-02-12 10:56:35 ----A---- C:\WINDOWS\win.ini
2014-02-12 10:56:35 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 uagp35;Microsoft AGPv3.5 Filter; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-14 44672]
R1 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2013-09-18 184664]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2013-09-18 134248]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2013-09-18 61600]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2013-09-18 174400]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-09-24 4122368]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-04-13 701440]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2013-09-18 38952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 26840]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2007-07-27 12160]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
S3 esihdrv;esihdrv; \??\C:\DOCUME~1\MM\LOCALS~1\Temp\esihdrv.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2012-12-13 45056]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2014-02-12 43336]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-31 390504]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2013-09-12 1337752]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2013-12-19 182696]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2010-03-10 189728]
R2 TeamViewer8;TeamViewer 8; C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe [2014-02-07 5093216]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2014-02-21 553288]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-05 116648]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-21 257928]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-05 116648]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-07-20 754856]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **cernohous13** » 08 bře 2014 18:03

Zdravím,

v logu nic neobvyklého nevidím ale zkusíme to vyčistit

Stáhni Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe
Ulož jej na plochu a spusť - zobrazí se licenční podminky -> start libovolnou klávesou.
Bude vytvořena záloha a proběhne skenování.
Vyskočí log (nebo je uložen zde c:\JRT jako JRT.txt) - zkopíruj jej sem

Stáhni AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Ulož nejlépe na plochu -> ukonči všechny programy -> spusť AdwCleaner -> klikni na Scan po dokončení na Clean
bude provedena oprava, restartuje se - (případně restartuj) a vypadne log C:\AdwCleaner\AdwCleaner[S?].txt , jeho obsah vložíš sem

e-comm · #3 Příspěvek od **e-comm** » 09 bře 2014 09:44

Ahoj

ty si mi uz pomahal, dakujem za rychlu odpoved.
Posielam LOG JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Microsoft Windows XP x86
Ran by MM on ne 09.03.2014 at 9:28:13,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smarttweak

~~~ Files

~~~ Folders

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 09.03.2014 at 9:47:31,82
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

e-comm · #4 Příspěvek od **e-comm** » 09 bře 2014 10:16

Zda sa mi, ze po ADW claner sa mi dost zpomalil PC..?

#5 Příspěvek od **cernohous13** » 09 bře 2014 10:28

log v C:\AdwCleaner bys nenašel?

e-comm · #6 Příspěvek od **e-comm** » 09 bře 2014 11:01

Nenasiel som ho..akurat hladam dalej
Spravim celu operaciu este raz?

#7 Příspěvek od **cernohous13** » 09 bře 2014 11:24

Zkus opakovat

e-comm · #8 Příspěvek od **e-comm** » 09 bře 2014 11:47

# AdwCleaner v3.020 - Report created 09/03/2014 at 11:27:51
# Updated 27/02/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : MM - SLOVCAPITALGROU
# Running from : C:\Documents and Settings\MM\My Documents\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v6.0.2900.5512

-\\ Google Chrome v33.0.1750.146

[ File : C:\Documents and Settings\MM\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [822 octets] - [09/03/2014 11:25:06]
AdwCleaner[S0].txt - [744 octets] - [09/03/2014 11:27:51]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [803 octets] ##########

#9 Příspěvek od **cernohous13** » 09 bře 2014 14:51

Tak tady čisto, ještě se podíváme

Stáhni a nainstaluj MBAM zde http://www.malwarebytes.org/products/malwarebytes_free/
Spustit -> na 3.záložce "Aktualizace" -> Kontrola aktualizací
následně na 1.záložce "Kontrolor" -> Rychlá kontrola -> Prohledat
po dokončení scanu vyskočí okno Notepad s výsledkem - obsah zkopíruj do své odpovědi
zatím nic nemazat - počkej na posouzení

e-comm · #10 Příspěvek od **e-comm** » 09 bře 2014 17:55

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verzia databázy: v2014.03.09.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
MM :: SLOVCAPITALGROU [administrátor]

9.3.2014 17:42:07
MBAM-log-2014-03-09 (18-00-06).txt

Typ kontroly: Rýchla kontrola
Možnosti kontroly zapnuté: Pamäť | Po spustení | Registre | Systémové súbory | Heuristika/Extra | Heuristika/Shuriken | PUP | PUM
Možnosti kontroly vypnuté: P2P
Objektov kontrolovaných: 211612
Uplynutý čas: 15 min, 34 sek

Detegované služby pamäte: 0
(Škodlivé položky neboli zistené)

Detegované moduly pamäte: 1
C:\Documents and Settings\MM\Local Settings\Application Data\ITVsoft\dwcjid.dll (VirTool.Vbcrypt) -> Žiadna úloha nevykonaná.

Detegované registračné kľúče: 0
(Škodlivé položky neboli zistené)

Detegované registračné hodnoty: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ITVsoft (VirTool.Vbcrypt) -> Dáta: regsvr32.exe "C:\Documents and Settings\MM\Local Settings\Application Data\ITVsoft\dwcjid.dll" -> Žiadna úloha nevykonaná.

Detegované položky registračných dát: 0
(Škodlivé položky neboli zistené)

Detegované priečinky: 0
(Škodlivé položky neboli zistené)

Detegované súbory: 1
C:\Documents and Settings\MM\Local Settings\Application Data\ITVsoft\dwcjid.dll (VirTool.Vbcrypt) -> Žiadna úloha nevykonaná.

(koniec)

#11 Příspěvek od **cernohous13** » 09 bře 2014 18:51

Klikni na https://www.virustotal.com
po kliknutí na "Choose File" jen zkopíruj do řádku "Název souboru":

C:\Documents and Settings\MM\Local Settings\Application Data\ITVsoft\dwcjid.dll

"Scan It" (pokud byl již testován, nech testovat znovu - Reanalyse)
Trpělivě vyčkej dokončení scanu dokud se neobjeví konečný výsledek např.0/41
Do fóra zkopíruj výsledný log. nebo odkaz z adresního řádku na stránku.
Pokud nebude nález stačí jen oznámit

e-comm · #12 Příspěvek od **e-comm** » 09 bře 2014 19:01

SHA256: 743ee9bcdd64ff4bcc921f42eb47dfa365f61b5417707900664fbaf35e57bc09
File name: dwcjid.dll
Detection ratio: 9 / 49
Analysis date: 2014-03-09 18:05:09 UTC ( 1 minúta ago )
0 0
Analysis
File detail
Additional information
Comments
Votes
Antivirus Result Update
AntiVir PCK/Themida 20140309
Bkav HW32.CDB.3b9f 20140308
CAT-QuickHeal (Suspicious) - DNAScan 20140309
Comodo Packed.Win32.Themida.AAI 20140309
Ikarus Trojan.Win32.Spy 20140309
Malwarebytes VirTool.Vbcrypt 20140309
McAfee Sefnit-FAT!6F7486BD45C7 20140309
McAfee-GW-Edition Sefnit-FAT!6F7486BD45C7 20140309
Panda Trj/Genetic.gen 20140309
AVG 20140309
Ad-Aware 20140309
Agnitum 20140309
AhnLab-V3 20140309
Antiy-AVL 20140309
Avast 20140309
Baidu-International 20140309
BitDefender 20140309
ByteHero 20140309
CMC 20140307
ClamAV 20140309
Commtouch 20140309
DrWeb 20140309
ESET-NOD32 20140309
Emsisoft 20140309
F-Prot 20140309
F-Secure 20140309
Fortinet 20140309
GData 20140309
Jiangmin 20140309
K7AntiVirus 20140307
K7GW 20140307
Kaspersky 20140309
Kingsoft 20140309
MicroWorld-eScan 20140309
Microsoft 20140309
NANO-Antivirus 20140309
Norman 20140309
Qihoo-360 20140302
Rising 20140309
SUPERAntiSpyware 20140309
Sophos 20140309
Symantec 20140309
TheHacker 20140309
TotalDefense 20140309
TrendMicro 20140309
TrendMicro-HouseCall 20140309
VBA32 20140308
VIPRE 20140309
ViRobot 20140309
nProtect 20140309

#13 Příspěvek od **cernohous13** » 09 bře 2014 19:04

Výsledek na VT mě nutí doporučit nález MBAM odstranit

e-comm · #14 Příspěvek od **e-comm** » 09 bře 2014 19:05

Odstranit?

#15 Příspěvek od **cernohous13** » 09 bře 2014 19:08

cernohous13 píše:Výsledek na VT mě nutí doporučit nález MBAM odstranit

pak můžeš MBAM odinstalovat

VIRY.CZ

PC sa sprava divne

PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne

Re: PC sa sprava divne