VIRY.CZ

Zdravím,

poslednom čase som si všimol že môj PC je čoraz pomalejší... Ked si otvorim Mozzila Firefox, tak mi dlho a pomali načítava webstranky pomali mi načítava flashe na webstranke.. Ked mám viac veci otvorených tak to strašne dlho trvá.

Internetom to nebude.. podľa mňa... Rýchlosť Vašeho pripojenia je 4775.4 Kbps (Kilobitov za sekundu) alebo tiež 596.9 KB/sec (Kilobytov za sekundu).

Potom mám ďalší problem. Pri spustení PC mi vyskočí vždy tabulka a v nej ERORR. Screen dodam hned po postnutí topicu
budem to musieť reštartovať..

Edit: Obrazok pridaný,



Log z RSITU je tu,

Logfile of random's system information tool 1.06 (written by random/random)
Run by Adminko at 2010-01-26 14:42:18
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 9 GB (12%) free of 76 GB
Total RAM: 1023 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:42:24, on 26. 1. 2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Adminko\Plocha\RSIT.exe
C:\Program Files\trend micro\Adminko.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.azet.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4881 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-07-23 8466432]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-07-23 81920]
"Monitor"=C:\WINDOWS\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2008-04-23 22058792]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\World of Warcraft\Repair.exe"="C:\Program Files\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\World of Warcraft\Launcher.exe"="C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\World of Warcraft\WoW-3.2.0-enGB-downloader.exe"="C:\Program Files\World of Warcraft\WoW-3.2.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-01-26 14:42:19 ----D---- C:\Program Files\trend micro
2010-01-26 14:42:18 ----D---- C:\rsit
2010-01-11 16:03:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Blizzard Entertainment
2010-01-11 14:14:44 ----D---- C:\Program Files\World of Warcraft
2010-01-11 13:44:35 ----D---- C:\Program Files\World of Warcraft 3.1.3
2010-01-08 23:21:05 ----D---- C:\Program Files\Fraps
2010-01-06 18:38:36 ----D---- C:\Program Files\Common Files\PXIINST64207
2010-01-06 18:38:36 ----D---- C:\Program Files\Common Files\PXIINST207
2010-01-06 18:38:35 ----D---- C:\Program Files\PC Camera
2010-01-06 18:38:35 ----D---- C:\Program Files\Common Files\PAC207
2010-01-05 15:13:54 ----D---- C:\Program Files\AMD
2009-12-29 22:38:00 ----SHD---- C:\RECYCLER
2009-12-29 12:48:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\MySQL

======List of files/folders modified in the last 1 months======

2010-01-26 14:42:19 ----D---- C:\Program Files
2010-01-26 14:40:08 ----D---- C:\Program Files\Mozilla Firefox
2010-01-26 14:24:25 ----D---- C:\WINDOWS\Temp
2010-01-26 14:21:49 ----D---- C:\Documents and Settings\Adminko\Data aplikací\Skype
2010-01-26 14:21:46 ----D---- C:\Documents and Settings\Adminko\Data aplikací\skypePM
2010-01-26 10:45:17 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-26 08:27:30 ----D---- C:\WINDOWS\Prefetch
2010-01-26 07:13:30 ----D---- C:\WINDOWS
2010-01-25 23:24:19 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-25 21:20:25 ----SHD---- C:\WINDOWS\Installer
2010-01-25 21:20:25 ----D---- C:\WINDOWS\WinSxS
2010-01-25 21:19:42 ----D---- C:\Program Files\Common Files\Adobe
2010-01-25 21:17:27 ----D---- C:\Program Files\Adobe
2010-01-25 21:15:26 ----D---- C:\Documents and Settings\Adminko\Data aplikací\Adobe
2010-01-19 17:38:00 ----SHD---- C:\WINDOWS\CSC
2010-01-11 20:25:38 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-01-11 13:51:06 ----A---- C:\WINDOWS\win.ini
2010-01-08 23:18:18 ----HD---- C:\WINDOWS\inf
2010-01-08 23:18:18 ----D---- C:\WINDOWS\system32\drivers
2010-01-08 23:18:18 ----D---- C:\WINDOWS\system32
2010-01-07 14:33:52 ----D---- C:\Documents and Settings\Adminko\Data aplikací\CoreFTP
2010-01-06 18:38:51 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-06 18:38:36 ----D---- C:\WINDOWS\twain_32
2010-01-06 18:38:36 ----D---- C:\WINDOWS\PAC207
2010-01-06 18:38:36 ----D---- C:\Program Files\Common Files
2010-01-05 21:38:57 ----D---- C:\Program Files\Common Files\Akamai
2010-01-05 15:14:02 ----RSH---- C:\boot.ini
2010-01-01 19:01:00 ----D---- C:\WINDOWS\ERDNT
2009-12-29 22:37:20 ----A---- C:\WINDOWS\system.ini
2009-12-29 22:35:47 ----D---- C:\WINDOWS\system32\config
2009-12-29 22:34:43 ----D---- C:\WINDOWS\AppPatch
2009-12-29 12:39:31 ----D---- C:\Program Files\MySQL
2009-12-28 11:15:52 ----D---- C:\Program Files\CoreFTP

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-07-23 6807328]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-11-27 58368]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-11-27 19968]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-10-17 25280]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSICPL;MSICPL; \??\D:\install4\MSICPL.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 npkcrypt;npkcrypt; \??\C:\Program Files\Lineage II\system\npkcrypt.sys []
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 PAC207;PC Camer@; C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2006-11-20 506112]
S3 SetupNTGLM7X;SetupNTGLM7X; \??\D:\NTGLM7X.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 wip0204;Wippien Network Adapter 2.4; C:\WINDOWS\system32\DRIVERS\wip0204.sys [2008-12-30 23480]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-05-15 721904]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-07-23 155716]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-28 655624]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]

-----------------EOF-----------------

Log vyzera byt cisti.. (pravdepodobne to nebude virom
Ale ja asi niesom opravnený to hovoriť

No minule mi tusim nejaky moderator odstranoval
2010-01-05 21:38:57 ----D---- C:\Program Files\Common Files\Akamai

(tusim je to ono, niesom si isty)

A je to tu znova... nehajme to na moderátorov Co povedia oni..

Dobrý večer

Odinstalujte Daemona
Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
A zkuste Daemona znovu nainstalovat, pokud ho používáte

Akamai se Vám tam dostal znovu sám? Používáte ho?

Z mého podpisu stahněte Ccleaner
-nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

záložka čistič
-nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
-po analýze klikněte na Spustit Ccleaner

záložka Registry
-klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy udělat zálohu registrů - nemusíte
-kliknete opravit všechny problémy ok zavřít

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

Deamon Tools Lite... Je v program files stale
ale ked ho idem odinstalovat tak to v polke sekne a zamrzne pc.. v odstraneni programov vobec
nieje zaregistrovany.. Po starte mi to vzdy hadze erorr..

K tomu akamaiu neviem co toje, nepouzivam.

Ccleaner mam kazdy den na konci dna to vsetko zmazujem, a setko cleanujem.
- Registre
- A vsetko co sa tam da odstranit..

Tak isto odstranujem tie veci z firefoxu cookies, hesla atd.. vzdy je vsetko prazdne..

Daemon zkuste odinstalovat přes Ccleaner - nástroje v nouzovém režimu ( po restartu mačkejte F8)

No dal som nudzovy rezim, a odinstalovat ale stale to seklo a musel som odinstalovanie ukoncit.

Tak som to spravil tak ze som to normalne v program files cely priecinok odstranil a cez CCleaner
som dal opravit registre. Boly tam aspon 4 riadny deamon tools a dal som ze opravit.. Uz to po starte error nehadze..

Este by som sa chcel opytat log je v poriadku? A co stym akamaiom co to je?

Ještě prosím udělejte ten Mbam , na Akamai pak koukneme

Stiahol som si ten Malwarebytes Anti-Malware (Mbam)

dal som skenovat cely disk C:

pri skenovani mi avast vyhlasil 2x

C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0067706.pif
Win32:Trojan-gen
Virus/červ
100130-0, 30.01.2010

C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0068400.exe\serwer.exe
Win32:Trojan-gen
Virus/červ
100130-0, 30.01.2010

Dal som presunut do truhly, na konci skenovania toho Malwarebytes sa nasli 4 kriticke objekty
tu je log,

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3510
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

30. 1. 2010 15:38:55
mbam-log-2010-01-30 (15-38-54).txt

Typ kontroly: Kompletní kontrola (C:\|)
Zkontrolované objekty: 203317
Uplynulý čas: 43 minute(s), 25 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 4

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0067785.sys (Malware.Trace) -> No action taken.
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0067841.sys (Malware.Trace) -> No action taken.
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0068006.sys (Malware.Trace) -> No action taken.
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0068203.sys (Malware.Trace) -> No action taken.

Nic som nedal mam to stale otvorene.. mam dat odstranit?

Můžete

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe


- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, skopírujte celý jeho obsah sem

Ok tie 4 z toho Mbamu zmazane, teraz idem na ten combofix

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3510
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

30. 1. 2010 15:47:31
mbam-log-2010-01-30 (15-47-31).txt

Typ kontroly: Kompletní kontrola (C:\|)
Zkontrolované objekty: 203317
Uplynulý čas: 43 minute(s), 25 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 4

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0067785.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0067841.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0068006.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7034AEB2-71B1-4345-903A-2E615548A352}\RP40\A0068203.sys (Malware.Trace) -> Quarantined and deleted successfully.

Ten combofix

ComboFix 10-01-29.09 - Adminko . 01. 2010 16:10:22.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.1023.683 [GMT 1:00]
Running from: c:\documents and settings\Adminko\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100130-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Fonts\MyriadPro-Regular.otf
c:\windows\system32\drivers\kykjg.sys
c:\windows\system32\twain_32.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_pgvn


((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-30 )))))))))))))))))))))))))))))))
.

2010-01-30 13:51 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-30 13:51 . 2010-01-30 13:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-30 13:51 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-30 11:12 . 2010-01-30 12:52 -------- d-----w- c:\program files\Valve
2010-01-29 19:03 . 2010-01-30 11:02 -------- d-----w- c:\program files\Normal CSko
2010-01-11 13:14 . 2010-01-14 17:58 -------- d-----w- c:\program files\World of Warcraft
2010-01-11 12:44 . 2010-01-25 22:18 -------- d-----w- c:\program files\World of Warcraft 3.1.3
2010-01-08 22:21 . 2010-01-08 22:21 -------- d-----w- c:\program files\Fraps
2010-01-06 17:38 . 2010-01-06 17:38 -------- d-----w- c:\program files\Common Files\PXIINST64207
2010-01-06 17:38 . 2010-01-06 17:38 -------- d-----w- c:\program files\Common Files\PXIINST207
2010-01-06 17:38 . 2010-01-06 17:38 -------- d-----w- c:\program files\Common Files\PAC207
2010-01-06 17:38 . 2010-01-06 17:38 -------- d-----w- c:\program files\PC Camera
2010-01-05 14:13 . 2007-06-29 13:47 34304 ----a-w- c:\windows\system32\drivers\AmdLLD.sys
2010-01-05 14:13 . 2010-01-05 14:13 -------- d-----w- c:\program files\AMD

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-29 23:13 . 2008-07-31 13:40 -------- d-----w- c:\program files\Codec Pack - All In 1
2010-01-25 20:19 . 2009-01-30 09:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-11 19:25 . 2008-08-01 18:36 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-06 17:38 . 2008-07-31 17:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-05 20:38 . 2009-11-28 15:54 -------- d-----w- c:\program files\Common Files\Akamai
2009-12-28 10:15 . 2009-09-25 23:30 -------- d-----w- c:\program files\CoreFTP
2009-11-26 09:58 . 2001-10-25 14:00 60714 ----a-w- c:\windows\system32\perfc005.dat
2009-11-26 09:58 . 2001-10-25 14:00 336782 ----a-w- c:\windows\system32\perfh005.dat
2009-11-24 23:54 . 2009-11-14 23:20 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-11-14 23:20 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:49 . 2009-11-14 23:20 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-11-14 23:20 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-11-14 23:20 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-11-14 23:20 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-24 16:31 . 2009-11-24 16:31 236160 ----a-w- c:\windows\EasyGifAnimator_Toolbar_Uninstaller_296.exe
2009-11-21 08:46 . 2009-11-21 08:46 86016 ----a-w- c:\windows\system32\frapsvid.dll
.

------- Sigcheck -------

[-] 2008-05-13 . 07DE423FB70EBAC5136677E3956FDBC3 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2008-04-23 22058792]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-17 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-23 8466432]
"nwiz"="nwiz.exe" [2007-07-23 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-23 81920]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2004-08-17 100352]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0-enGB-downloader.exe"=
"c:\\Program Files\\Normal CSko\\hl.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [15. 11. 2009 0:20 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [15. 11. 2009 0:20 20560]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [20. 11. 2006 7:48 506112]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
S3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [31. 3. 2009 12:32 23480]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1. 8. 2008 19:27 721904]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.azet.sk/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Adminko\Data aplikací\Mozilla\Firefox\Profiles\yzfx9zu7.default\
FF - prefs.js: browser.search.selectedEngine - Wowhead
FF - prefs.js: browser.startup.homepage - www.pokec.sk

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-30 16:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1808)
c:\windows\system32\browselc.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Skype\Phone\Skype.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-01-30 16:19:21 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-30 15:19

Pre-Run: 8 413 663 232
Post-Run: 8 375 418 880

- - End Of File - - 3A945EA613B3E573AEDA555F190A35B9

Este sa chcem spytat co je toto?

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Bonjour\mDNSResponder.exe - to je jedna zbytečná služba, nemáte iPod nebo Abdobe Photoshop?

otestujte na www.virustotal.com
c:\windows\system32\sfcfiles.dll

Jak to ted vypadá s počítačem?

Adobe Photoshop mam.
Otestoval som tu zlozku, tu je vysledok

File sfcfiles.dll received on 2009.10.16 10:10:32 (UTC)
Current status: finished
Result: 0/41 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
a-squared 4.5.0.41 2009.10.16 -
AhnLab-V3 5.0.0.2 2009.10.16 -
AntiVir 7.9.1.35 2009.10.16 -
Antiy-AVL 2.0.3.7 2009.10.16 -
Authentium 5.1.2.4 2009.10.16 -
Avast 4.8.1351.0 2009.10.14 -
AVG 8.5.0.420 2009.10.16 -
BitDefender 7.2 2009.10.16 -
CAT-QuickHeal 10.00 2009.10.16 -
ClamAV 0.94.1 2009.10.16 -
Comodo 2619 2009.10.16 -
DrWeb 5.0.0.12182 2009.10.16 -
eSafe 7.0.17.0 2009.10.15 -
eTrust-Vet 35.1.7071 2009.10.16 -
F-Prot 4.5.1.85 2009.10.15 -
F-Secure 8.0.14470.0 2009.10.16 -
Fortinet 3.120.0.0 2009.10.16 -
GData 19 2009.10.16 -
Ikarus T3.1.1.72.0 2009.10.16 -
Jiangmin 11.0.800 2009.10.16 -
K7AntiVirus 7.10.872 2009.10.16 -
Kaspersky 7.0.0.125 2009.10.16 -
McAfee 5772 2009.10.15 -
McAfee+Artemis 5772 2009.10.15 -
McAfee-GW-Edition 6.8.5 2009.10.16 -
Microsoft 1.5101 2009.10.16 -
NOD32 4513 2009.10.16 -
Norman 6.03.02 2009.10.16 -
nProtect 2009.1.8.0 2009.10.15 -
Panda 10.0.2.2 2009.10.15 -
PCTools 4.4.2.0 2009.10.15 -
Prevx 3.0 2009.10.16 -
Rising 21.51.42.00 2009.10.16 -
Sophos 4.46.0 2009.10.16 -
Sunbelt 3.2.1858.2 2009.10.15 -
Symantec 1.4.4.12 2009.10.16 -
TheHacker 6.5.0.2.043 2009.10.15 -
TrendMicro 8.950.0.1094 2009.10.16 -
VBA32 3.12.10.11 2009.10.15 -
ViRobot 2009.10.16.1988 2009.10.16 -
VirusBuster 4.6.5.0 2009.10.15 -

Additional information
File size: 1548288 bytes
MD5 : 07de423fb70ebac5136677e3956fdbc3
SHA1 : e7abd78687aa60d46984ea5049004e525e9ce674
SHA256: 5ac5979a7ebde155edf57e238716f2da454413547146c107857d5a0b8267285d
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x120D
timedatestamp.....: 0x41107C2B (Wed Aug 4 08:03:23 2004)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xCBF 0xE00 5.91 42137068c1332859090f264da2f41dad
.data 0x2000 0x16EB48 0x16EC00 3.27 96a6a64159d72f8bcbd8fe5d2c7a65c6
.rsrc 0x171000 0x418 0x600 2.53 43635105a50da283794621c347040702
.reloc 0x172000 0x9A68 0x9C00 5.76 6255caf193acb80badcce29f8698e69c

( 1 imports )

> ntdll.dll: LdrDisableThreadCalloutsForDll, NtClose, NtQueryValueKey, NtOpenKey, RtlInitUnicodeString, RtlGetVersion, NtTerminateProcess, RtlUnhandledExceptionFilter, RtlUnwind, NtQueryVirtualMemory

( 1 exports )

> SfcGetFiles
TrID : File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: -
PEiD : -
RDS : NSRL Reference Data Set


Uz to je lepsie, ale budem este musiet asi vymenit chladice.. Tie budu asi zaprasene a nechladia tak ako maju...
a este k tomu Akamai? Co to je zac? Minule ked boli problemi tak tusim ze sme to davali prec a je to tu zas..

A este sa chcem informativne spýtať vedeli by ste mi povedať co su toto za procesy? Je to v pohode, alebo to je nieco ine?