zpomalený ntb eee

[Písa]

za týden snad budu mít víc času a ještě ho zkusím teda rozebrat a vyčistit, tady je log z combofixu:

ComboFix 14-11-18.01 - Adéla 22.11.2014 11:20:18.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.895.247 [GMT 1:00]
Spuštěný z: g:\documents and settings\AdÚla\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-10-22 do 2014-11-22 )))))))))))))))))))))))))))))))
.
.
2014-11-15 10:17 . 2014-11-15 10:18 -------- d-----w- g:\program files\Defraggler
2014-11-12 16:10 . 2014-11-12 16:11 -------- d-----w- g:\program files\Hewlett-Packard
2014-11-12 15:45 . 2014-11-15 10:03 -------- d-----w- g:\program files\trend micro
2014-11-12 14:51 . 2001-08-17 20:47 12928 -c--a-w- g:\windows\system32\dllcache\dot4prt.sys
2014-11-12 14:51 . 2001-08-17 20:47 12928 ----a-w- g:\windows\system32\drivers\Dot4Prt.sys
2014-11-12 14:28 . 2008-04-13 23:09 206976 -c--a-w- g:\windows\system32\dllcache\dot4.sys
2014-11-12 14:28 . 2008-04-13 23:09 206976 ----a-w- g:\windows\system32\drivers\Dot4.sys
2014-11-12 14:28 . 2001-10-24 10:43 23808 -c--a-w- g:\windows\system32\dllcache\dot4usb.sys
2014-11-12 14:28 . 2001-10-24 10:43 23808 ----a-w- g:\windows\system32\drivers\Dot4usb.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-10 17:09 . 2014-03-02 15:16 414520 ----a-w- g:\windows\system32\drivers\aswsp.sys
2014-09-10 17:08 . 2014-09-10 17:08 24184 ----a-w- g:\windows\system32\drivers\aswHwid.sys
2014-09-10 17:08 . 2014-03-02 15:16 779536 ----a-w- g:\windows\system32\drivers\aswSnx.sys
2014-09-10 17:08 . 2014-03-02 15:16 57800 ----a-w- g:\windows\system32\drivers\aswTdi.sys
2014-09-10 17:08 . 2014-03-02 15:16 192352 ----a-w- g:\windows\system32\drivers\aswVmm.sys
2014-09-10 17:08 . 2014-03-02 15:16 67824 ----a-w- g:\windows\system32\drivers\aswmonflt.sys
2014-09-10 17:08 . 2014-03-02 15:16 49944 ----a-w- g:\windows\system32\drivers\aswRvrt.sys
2014-09-10 17:08 . 2014-03-02 15:16 55112 ----a-w- g:\windows\system32\drivers\aswRdr.sys
2014-09-10 17:08 . 2014-09-10 17:08 43152 ----a-w- g:\windows\avastSS.scr
2014-09-10 17:08 . 2014-03-02 15:16 276432 ----a-w- g:\windows\system32\aswBoot.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-08-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . g:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-09-10 17:08 578240 ----a-w- g:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- g:\documents and settings\Adéla\Data aplikací\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- g:\documents and settings\Adéla\Data aplikací\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- g:\documents and settings\Adéla\Data aplikací\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- g:\documents and settings\Adéla\Data aplikací\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsusACPIServer"="g:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2010-04-30 1245608]
"AsusEPCMonitor"="g:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-05-08 98304]
"RTHDCPL"="RTHDCPL.EXE" [2009-11-18 18789408]
"SynTPEnh"="g:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-04-09 1512744]
"AvastUI.exe"="g:\program files\AVAST Software\Avast\AvastUI.exe" [2014-09-10 4085896]
"NvCplDaemon"="g:\windows\system32\NvCpl.dll" [2013-10-29 15678752]
"nwiz"="g:\program files\NVIDIA Corporation\nview\nwiz.exe" [2013-11-22 2602784]
"SynAsusAcpi"="g:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-04-09 79144]
"StatusClient"="g:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="g:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\G:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^SuperHybridEngine.lnk]
path=g:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\SuperHybridEngine.lnk
backup=g:\windows\pss\SuperHybridEngine.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\seznam-listicka-distribuce]
2013-05-16 13:25 1062472 ----a-w- g:\program files\Seznam.cz\distribution\szninstall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup]
2003-03-31 18:28 155648 ----a-w- g:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Apple Mobile Device"=2 (0x2)
"Bonjour Service"=2 (0x2)
"TeamViewer9"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"g:\\Program Files\\TeamViewer\\Version9\\TeamViewer.exe"=
"g:\\Program Files\\TeamViewer\\Version9\\TeamViewer_Service.exe"=
"g:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"g:\\Documents and Settings\\Adéla\\Data aplikací\\Dropbox\\bin\\Dropbox.exe"=
"g:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
"g:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"g:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"g:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"g:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=
"g:\\Program Files\\Skype\\Phone\\Skype.exe"=
"g:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
.
R0 aswRvrt;avast! Revert;g:\windows\system32\drivers\aswRvrt.sys [2.3.2014 16:16 49944]
R0 aswVmm;avast! VM Monitor;g:\windows\system32\drivers\aswVmm.sys [2.3.2014 16:16 192352]
R1 aswSnx;aswSnx;g:\windows\system32\drivers\aswSnx.sys [2.3.2014 16:16 779536]
R1 aswSP;aswSP;g:\windows\system32\drivers\aswsp.sys [2.3.2014 16:16 414520]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;g:\windows\system32\drivers\dtsoftbus01.sys [2.3.2014 17:14 243128]
R2 aswHwid;avast! HardwareID;g:\windows\system32\drivers\aswHwid.sys [10.9.2014 18:08 24184]
R2 aswMonFlt;aswMonFlt;g:\windows\system32\drivers\aswmonflt.sys [2.3.2014 16:16 67824]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;g:\windows\system32\drivers\l1c51x86.sys [2.3.2014 13:50 38912]
R3 RTL8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;g:\windows\system32\drivers\rtl8192se.sys [2.3.2014 13:59 561024]
R3 usbsmi;USB2.0 UVC WebCam ;g:\windows\system32\drivers\SMIksdrv.sys [2.3.2014 13:56 182144]
S3 Ambfilt;Ambfilt;g:\windows\system32\drivers\Ambfilt.sys [2.3.2014 13:55 1684736]
S4 TeamViewer9;TeamViewer 9;g:\program files\TeamViewer\Version9\TeamViewer_Service.exe [10.3.2014 19:42 4915040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-10-28 12:52 1089352 ----a-w- g:\program files\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-11-20 g:\windows\Tasks\avast! Emergency Update.job
- g:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-10 17:08]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local;<local>
IE: E&xportovat do aplikace Microsoft Excel - g:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-11-22 11:32
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2014-11-22 11:35:47
ComboFix-quarantined-files.txt 2014-11-22 10:35
.
Před spuštěním: Volných bajtů: 28 407 238 656
Po spuštění: Volných bajtů: 28 357 787 648
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[Boot Loader]
timeout=2
Default=multi(0)disk(0)rdisk(0)partition(4)\WINDOWS
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(4)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - F402A2679D2B7979E7DE46EFC6C2F285
413FC2A0C716421B3158746D63736515

[Márty84]

Pokud nepouzivate, odinstalujte Seznam Software (listicka atd.)

Jinak i toto je ciste, takze softwarem uz tomu asi nepomuzem

[Písa]

každopádně díky moc za tuhle pomoc, za týden to ještě pročistím mechanicky a napíšu jak to prospělo, díky

[Márty84]

Nemate zac!

Budu vyhlizet dobrou zpravu



21.12. http://forum.viry.cz/viewtopic.php?f=12&t=123975