TROJAN V PC

Zpráva

#16 Příspěvek od **Caroprd111** » 05 Kvě 2010 17:04

Doporučuji odinstalovat Ad-Aware.

Obrázek

Spusťte OTL a do spodního okna vložte následující skript.

Kód: Vybrat vše

:OTL
[6 C:\Documents and Settings\Andread\Desktop\*.tmp files -> C:\Documents and Settings\Andread\Desktop\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2010.05.05 16:24:44 | 000,451,584 | ---- | M] () -- C:\Documents and Settings\Andread\Desktop\CKScanner.exe
[2010.05.04 15:46:40 | 000,157,184 | ---- | C] () -- C:\Documents and Settings\Andread\Local Settings\Application Data\test.exe

:Commands
[EMPTYTEMP] 
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[CREATERESTOREPOINT]

Poté klikněte na Opravit, PC se restartuje, log vložte sem.

Obrázek

Tohle otestujte na http://www.virustotal.com/cs/
C:\WINDOWS\system32\oleaccrc.dll

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

Pravnik1 · #17 Příspěvek od **Pravnik1** » 05 Kvě 2010 17:13

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.05.05 -
AhnLab-V3 2010.05.05.00 2010.05.05 -
AntiVir 8.2.1.236 2010.05.05 -
Antiy-AVL 2.0.3.7 2010.05.05 -
Authentium 5.2.0.5 2010.05.05 -
Avast 4.8.1351.0 2010.05.05 -
Avast5 5.0.332.0 2010.05.05 -
AVG 9.0.0.787 2010.05.05 -
BitDefender 7.2 2010.05.05 -
CAT-QuickHeal 10.00 2010.05.04 -
ClamAV 0.96.0.3-git 2010.05.05 -
Comodo 4772 2010.05.05 -
DrWeb 5.0.2.03300 2010.05.05 -
eSafe 7.0.17.0 2010.05.05 -
eTrust-Vet 35.2.7469 2010.05.05 -
F-Prot 4.5.1.85 2010.05.05 -
F-Secure 9.0.15370.0 2010.05.05 -
Fortinet 4.0.14.0 2010.05.05 -
GData 21 2010.05.05 -
Ikarus T3.1.1.84.0 2010.05.05 -
Jiangmin 13.0.900 2010.05.05 -
Kaspersky 7.0.0.125 2010.05.05 -
McAfee 5.400.0.1158 2010.05.05 -
McAfee-GW-Edition 2010.1 2010.05.05 -
Microsoft 1.5703 2010.05.04 -
NOD32 5088 2010.05.05 -
Norman 6.04.12 2010.05.05 -
nProtect 2010-05-05.01 2010.05.05 -
Panda 10.0.2.7 2010.05.05 -
PCTools 7.0.3.5 2010.05.05 -
Prevx 3.0 2010.05.05 -
Rising 22.46.02.03 2010.05.05 -
Sophos 4.53.0 2010.05.05 -
Sunbelt 6263 2010.05.05 -
Symantec 20091.2.0.41 2010.05.05 -
TheHacker 6.5.2.0.275 2010.05.03 -
TrendMicro 9.120.0.1004 2010.05.05 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.05 -
VBA32 3.12.12.4 2010.05.05 -
ViRobot 2010.5.4.2303 2010.05.05 -
VirusBuster 5.0.27.0 2010.05.05 -
Rozšiřující informace
File size: 16896 bytes
MD5...: 6654698f76cf6e46d5d321c53721947c
SHA1..: b38154ff27cbf46219ed62e25b673de928e46d47
SHA256: 542eb60e54807528ff64e8789363d69af019dd4c3f6c861b955e831e4b5c4a27
ssdeep: 384:l0WL3WYxAww2+fR/T8ggO7UgQhapO+O2GskypUKLw3TpFr0bbyEu65wUYhul
ip24:7lAww2+fR/T8ggO7UnhkO+LkLKL6krYR
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x0
timedatestamp.....: 0x3b7dfeae (Sat Aug 18 05:35:42 2001)
machinetype.......: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.rsrc 0x1000 0x3db0 0x3e00 3.41 a81e18970fa78fe83780ad37e50faec2
.reloc 0x5000 0x8 0x200 0.02 2c38765194d27b75f56d0565088a53ee

( 0 imports )

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Active Accessibility Resource DLL
original name: OLEACCRC.DLL
internal name: OLEACCRC
file version.: 4.2.5406.0 (xpclient.010817-1148)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

#18 Příspěvek od **Caroprd111** » 05 Kvě 2010 17:23

Ok, ještě OTL.

Pravnik1 · #19 Příspěvek od **Pravnik1** » 05 Kvě 2010 17:31

All processes killed
========== OTL ==========
C:\Documents and Settings\Andread\Desktop\~WRL1246.tmp deleted successfully.
C:\Documents and Settings\Andread\Desktop\~WRL1451.tmp deleted successfully.
C:\Documents and Settings\Andread\Desktop\~WRL2463.tmp deleted successfully.
C:\Documents and Settings\Andread\Desktop\~WRL2617.tmp deleted successfully.
C:\Documents and Settings\Andread\Desktop\~WRL2790.tmp deleted successfully.
C:\Documents and Settings\Andread\Desktop\~WRL3292.tmp deleted successfully.
C:\WINDOWS\002881_.tmp deleted successfully.
C:\WINDOWS\SET29.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\Documents and Settings\Andread\Desktop\CKScanner.exe moved successfully.
C:\Documents and Settings\Andread\Local Settings\Application Data\test.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Andread
->Temp folder emptied: 231532145 bytes
->Temporary Internet Files folder emptied: 618997 bytes
->FireFox cache emptied: 12655863 bytes
->Google Chrome cache emptied: 30580212 bytes
->Flash cache emptied: 765 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 447958799 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 690,00 mb

[EMPTYFLASH]

User: All Users

User: Andread
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.4.1 log created on 05052010_182525

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

#20 Příspěvek od **Caroprd111** » 05 Kvě 2010 17:35

Jak to vypadá s PC

Pravnik1 · #21 Příspěvek od **Pravnik1** » 05 Kvě 2010 17:43

Caroprd111 napsal:Jak to vypadá s PC

PC ide, zda sa mi ze ide o cosi rychlejsie

Bol tam nejaky vazny problem????

#22 Příspěvek od **Caroprd111** » 05 Kvě 2010 17:51

nějaké drobnosti. Poprosím o nový log z RSIT.

Pravnik1 · #23 Příspěvek od **Pravnik1** » 05 Kvě 2010 17:52

Caroprd111 napsal:nějaké drobnosti. Poprosím o nový log z RSIT.

Idem spracovat

Pravnik1 · #24 Příspěvek od **Pravnik1** » 05 Kvě 2010 17:55

Pravnik1 napsal:
Caroprd111 napsal:nějaké drobnosti. Poprosím o nový log z RSIT.

Idem spracovat

Logfile of random's system information tool 1.06 (written by random/random)
Run by Andread at 2010-05-05 18:52:46
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 1 GB (22%) free of 7 GB
Total RAM: 239 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:53:13, on 5.5.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\sistray.EXE
C:\WINDOWS\system32\khooker.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\LTSMMSG.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andread\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\Andread.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\system32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3846491457
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3846614834
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4214 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-790525478-1060284298-854245398-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-790525478-1060284298-854245398-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SiS Tray"=C:\WINDOWS\system32\sistray.EXE [2002-05-09 303104]
"SiS KHooker"=C:\WINDOWS\system32\khooker.exe [2002-01-25 290816]
"SiSUSBRG"=C:\WINDOWS\sisUSBrg.exe [2002-04-25 32768]
"SoundMan"=C:\WINDOWS\soundman.exe [2002-04-18 46592]
"LTSMMSG"=C:\WINDOWS\LTSMMSG.exe [2002-06-01 141880]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-02-06 2021400]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"Google Update"=C:\Documents and Settings\Andread\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-01 136176]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-05-05 18:25:25 ----D---- C:\_OTL
2010-05-05 17:01:53 ----D---- C:\Program Files\trend micro
2010-05-05 17:01:45 ----D---- C:\rsit
2010-05-05 15:35:24 ----AH---- C:\aaw7boot.cmd
2010-05-05 14:35:58 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2010-05-05 13:13:42 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-05-05 13:13:42 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-04 16:00:41 ----D---- C:\WINDOWS\Minidump
2010-05-04 15:44:06 ----D---- C:\Documents and Settings\Andread\Application Data\WinRAR
2010-05-04 15:43:15 ----D---- C:\Program Files\WinRAR
2010-05-04 12:39:21 ----D---- C:\Documents and Settings\Andread\Application Data\Uniblue
2010-05-04 12:38:43 ----D---- C:\WINDOWS\SxsCaPendDel
2010-05-04 12:33:00 ----D---- C:\Documents and Settings\Andread\Application Data\BSplayer Pro
2010-05-04 12:32:35 ----D---- C:\Program Files\Webteh
2010-05-03 13:29:42 ----D---- C:\Program Files\QuickTime
2010-04-30 22:10:22 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-04-30 22:10:13 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-04-30 22:09:25 ----D---- C:\WINDOWS\Logs
2010-04-30 22:02:17 ----D---- C:\Program Files\The KMPlayer
2010-04-30 15:38:38 ----D---- C:\Documents and Settings\Andread\Application Data\Mozilla
2010-04-30 15:38:37 ----D---- C:\Documents and Settings\Andread\Application Data\Thunderbird

======List of files/folders modified in the last 1 months======

2010-05-05 18:52:15 ----D---- C:\WINDOWS\Temp
2010-05-05 18:42:31 ----D---- C:\WINDOWS
2010-05-05 18:27:19 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-05-05 18:25:59 ----SHD---- C:\System Volume Information
2010-05-05 18:25:59 ----D---- C:\WINDOWS\system32\Restore
2010-05-05 18:25:35 ----D---- C:\WINDOWS\system32
2010-05-05 18:12:23 ----SHD---- C:\WINDOWS\Installer
2010-05-05 18:12:19 ----RD---- C:\Program Files
2010-05-05 18:11:17 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-05-05 18:11:17 ----D---- C:\WINDOWS\system32\drivers
2010-05-05 15:58:42 ----SD---- C:\WINDOWS\Tasks
2010-05-05 15:30:07 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-05 14:44:09 ----HD---- C:\WINDOWS\inf
2010-05-05 14:43:56 ----D---- C:\WINDOWS\security
2010-05-05 14:42:26 ----D---- C:\WINDOWS\WinSxS
2010-05-05 14:26:28 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-05-05 14:25:18 ----D---- C:\WINDOWS\system32\inetsrv
2010-05-05 13:06:57 ----D---- C:\Program Files\Common Files
2010-05-05 12:22:57 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-05-04 16:46:28 ----D---- C:\Program Files\CCleaner
2010-05-04 16:25:44 ----D---- C:\WINDOWS\system32\config
2010-05-03 13:31:19 ----D---- C:\Program Files\Internet Explorer
2010-05-03 11:02:35 ----SD---- C:\Documents and Settings\Andread\Application Data\Microsoft
2010-05-01 20:48:35 ----D---- C:\WINDOWS\Help
2010-05-01 20:48:35 ----D---- C:\Program Files\Windows Media Player
2010-05-01 19:28:40 ----A---- C:\WINDOWS\WINCMD.INI
2010-05-01 19:27:43 ----D---- C:\WINDOWS\ie7updates
2010-05-01 19:26:12 ----D---- C:\WINDOWS\WBEM
2010-05-01 19:26:12 ----D---- C:\WINDOWS\system32\en-us
2010-05-01 19:26:11 ----D---- C:\WINDOWS\Media
2010-04-30 22:10:44 ----D---- C:\WINDOWS\system32\DirectX
2010-04-30 22:08:09 ----D---- C:\WINDOWS\Prefetch
2010-04-30 21:43:07 ----D---- C:\Program Files\ESET
2010-04-30 15:58:08 ----D---- C:\Program Files\soundbase
2010-04-30 15:48:37 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-30 12:38:44 ----D---- C:\Documents and Settings\Andread\Application Data\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-02-06 93336]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\drivers\srvkp.sys [2002-04-02 5760]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R2 STEC3;STEC3; \??\C:\WINDOWS\system32\STEC3.sys []
R3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-04-18 305100]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 LucentSoftModem;Lucent Technologies Soft Modem; C:\WINDOWS\system32\DRIVERS\LTSM.sys [2002-08-02 816043]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2009-03-25 130432]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2002-05-15 194176]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-02-06 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ServiceLayer;ServiceLayer; C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#25 Příspěvek od **Caroprd111** » 05 Kvě 2010 18:16

Stáhněte TFC http://oldtimer.geekstogo.com/TFC.exe

Spusťte.
Klikněte na "Start". Potvrďte hlášku kliknutím na "Ok" (Bude následovat restart)

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

Spusťte.
Klikněte na "CleanUp!". Potvrďte hlášky kliknutím na "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.

Záložka Čistič
Dejte analyzovat, po dokončení dejte Spustit Ccleaner.

Záložka Registry
Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
OK Zavřít

V logu nevidím firewall, doinstalujte

Přehled: http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

Pravnik1 · #26 Příspěvek od **Pravnik1** » 05 Kvě 2010 18:41

Je to hotove podla postupu. idem este naistalovat firewall. Mimochodom PC ide zase pomalsie..

#27 Příspěvek od **Caroprd111** » 05 Kvě 2010 18:43

Defragmentujte disk.

Pravnik1 · #28 Příspěvek od **Pravnik1** » 05 Kvě 2010 18:55

Caroprd111 napsal:Defragmentujte disk.

O.K. idem defragmentovat

#29 Příspěvek od **Caroprd111** » 05 Kvě 2010 18:56

Pravnik1 · #30 Příspěvek od **Pravnik1** » 05 Kvě 2010 19:19

Caroprd111 napsal:

podla teba je to o.k. ??

VIRY.CZ

TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC

Re: TROJAN V PC