Výrazné zpomalení PC s WinXP.

[Saman321]

druhý log z GMERu v nouz.režimu :

GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-13 12:02:17
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T1L0-5 WDC_WD5000AAKS-00A7B2 rev.01.03B01
Running: gmer.exe; Driver: C:\DOCUME~1\Tom\LOCALS~1\Temp\kwldypod.sys


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD4 0xF7 0x07 0x49 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xE4 0x4D 0xE4 0x73 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xEF 0x3B 0x5B 0xDB ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD4 0xF7 0x07 0x49 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xE4 0x4D 0xE4 0x73 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xEF 0x3B 0x5B 0xDB ...

---- EOF - GMER 1.0.15 ----

[vyosek]

Tak gmer je tez cisty, zkusime jeste CFko

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[Saman321]

log z CFka :

ComboFix 11-05-12.02 - Tom 13.05.2011 12:36:55.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1791.1258 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tom\Plocha\ComboFix.exe
AV: Kaspersky Anti-Virus *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Anti-Virus *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-04-13 do 2011-05-13 )))))))))))))))))))))))))))))))
.
.
2011-05-13 10:20 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-13 10:20 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-12 09:56 . 2011-05-12 09:56 -------- d-----w- c:\program files\CCleaner
2011-05-12 09:17 . 2011-05-12 09:17 -------- d-----w- C:\_OTL
2011-05-12 06:47 . 2011-05-12 06:48 -------- d-----w- C:\rsit
2011-05-12 05:19 . 2011-05-12 05:19 -------- d-----w- c:\windows\system32\wbem\Repository
2011-05-10 09:58 . 2011-05-10 09:59 -------- d-----w- C:\CD zadavatele
2011-05-06 09:15 . 2011-05-06 09:15 -------- d-----w- C:\spoolerlogs
2011-05-06 08:12 . 2011-05-06 08:12 -------- d-----w- c:\documents and settings\Tom\Data aplikací\IObit
2011-05-06 07:56 . 2011-05-06 07:56 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\Opera
2011-05-06 07:56 . 2011-05-06 07:56 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2011-05-06 06:12 . 2011-05-06 07:21 -------- d-----w- c:\windows\system32\NtmsData
2011-05-04 06:04 . 2011-05-04 06:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVS4YOU
2011-05-04 06:03 . 2011-05-04 06:03 -------- d-----w- c:\documents and settings\Tom\Data aplikací\AVS4YOU
2011-05-04 06:02 . 2011-05-04 06:20 -------- d-----w- c:\program files\Common Files\AVSMedia
2011-05-04 06:02 . 2011-05-04 06:21 -------- d-----w- c:\program files\AVS4YOU
2011-05-04 06:02 . 2010-06-22 07:43 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2011-05-04 06:02 . 2010-06-22 07:43 24576 ----a-w- c:\windows\system32\msxml3a.dll
2011-05-02 06:25 . 2011-05-02 06:25 -------- d-----w- c:\program files\Pegasys Inc
2011-04-29 09:00 . 2011-04-29 09:00 -------- d-----w- c:\program files\MP3Parse
2011-04-28 11:01 . 2011-04-28 11:05 -------- d-----w- c:\documents and settings\Tom\Data aplikací\WindSolutions
2011-04-28 11:01 . 2011-04-28 11:01 -------- d-----w- c:\documents and settings\All Users\Data aplikací\WindSolutions
2011-04-27 06:22 . 2011-04-27 06:22 -------- d-----w- c:\program files\iPod
2011-04-27 06:19 . 2011-04-27 06:19 -------- d-----w- c:\program files\Bonjour
2011-04-22 08:00 . 2011-04-22 08:00 9861288 ----a-w- C:\Opera_1110_int_Setup.exe
2011-04-20 11:42 . 2011-04-22 07:09 -------- d-----w- c:\program files\DVDlabPro2
2011-04-14 10:59 . 2011-05-03 04:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Corel
2011-04-14 10:19 . 2011-04-14 10:19 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Protexis
2011-04-14 10:18 . 2011-04-14 10:27 -------- d-----w- c:\documents and settings\Tom\Data aplikací\Corel
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 05:14 . 2011-04-29 05:14 2739681 ----a-w- C:\pgcedit_winexe.zip
2011-04-14 11:03 . 2010-07-27 10:07 348256 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\VSTAHost\CorelPHOTOPAINT\9.0\1033\ResourceCache.dll
2011-04-14 11:00 . 2010-07-27 10:06 348256 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\VSTAHost\CorelDRAW\9.0\1033\ResourceCache.dll
2011-04-11 11:07 . 2011-04-11 11:06 37033368 ----a-w- C:\AdbeRdr1000_cs_CZ.exe
2011-04-06 14:20 . 2011-04-06 14:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2011-04-06 14:20 . 2011-04-06 14:20 197920 ----a-w- c:\windows\system32\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-02-18 15:36 . 2010-07-27 06:24 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2011-02-18 15:36 . 2010-07-27 06:24 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2011-02-17 13:50 . 2008-04-14 04:50 370176 ----a-w- c:\windows\system32\html.iec
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Display Stix - System tray"="c:\program files\Fractalis Software\Display Stix 2.5\dstix.exe" [2004-04-24 245760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-10-11 1085440]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe" [2009-10-28 315736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Canon\\DIAS\\CnxDIAS.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"54925:UDP"= 54925:UDP:BrotherNetwork Scanner
.
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [14.5.2009 18:07 759048]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3.9.2009 15:24 24848]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14.9.2009 13:42 32272]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys --> c:\windows\system32\drivers\nmwcdnsu.sys [?]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys --> c:\windows\system32\drivers\nmwcdnsuc.sys [?]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;\??\c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys --> c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
mStart Page =
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Přidat do Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\ie_banner_deny.htm
.
.
------- Asociace souborů -------
.
.scr=DWGTrueViewScriptFile
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-13 13:01
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-515967899-287218729-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:60,d1,90,fc,02,bc,40,bc,8c,ce,06,21,d7,a3,9d,28,15,38,91,82,fa,
78,2b,8f,16,f6,de,73,ba,52,70,46,d4,68,40,5a,3a,fb,a9,5d,50,ab,33,2e,4c,fc,\
"rkeysecu"=hex:71,32,df,3b,6e,b5,2e,06,21,98,cd,90,94,51,ae,10
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1084)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(6724)
c:\program files\Unlocker\UnlockerHook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\DIAS\CnxDIAS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\Brother\Brmfcmon\BrMfimon.exe
.
**************************************************************************
.
Celkový čas: 2011-05-13 13:08:51 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-05-13 11:08
ComboFix2.txt 2011-03-01 09:31
.
Před spuštěním: Volných bajtů: 381 736 906 752
Po spuštění: Volných bajtů: 381 688 975 360
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 25C2E787FD80FD57C018FCF1D2F999C2

[vyosek]

Z logu je patrno, ze nemate aktualni verzi Windows - chybi Vam ServicePack 3 - doinstalujte jej

• Vice info mate zde http://www.viry.cz/forum/viewtopic.php?f=46&t=86100

SP3 resi mnoho problemu, nehlede na to, ze bez nej Vam microsoft nebude poskytovat dalsi podporu

[Saman321]

Hmm, tak tady bude možná nějakej zakopanej pes, protože ServicePack3 mám nainstalovanej zcela jistě, mohu dodat screen z informacemi o systému.

[vyosek]

Omlouvam se, podival jsem se o cislo vedle

Nastala nejaka zmena po aplikaci ComboFixu

[Saman321]

Vůbec ne, potíže přetrvávají stále.

[vyosek]

To vypada na naboreny system, notabene kdyz jste uz problem jednou mel...Zkuste provest opravnou instalaci z instal. media - ta prepise systemove casti ale data zustanou zachovana

[Saman321]

OK, vyzkouším. Moc moc děkuji za Vaše vynaložené úsilí a přeji hezký víkend.

[vyosek]

Prozatim nemate zac, pak napiste ci to pomohlo

Pekny vikend i Vam