Spomalený PC pripajam log

rudiB · Příspěvek od **rudiB** » pon 19. lis 2007, 16:10

Pred asi mesiacom som preinstaloval OS XP. Vsetko bolo ok. Ale asi pred 3 dnami mi nejako spomalilo PC. Kontroloval som to NOD-om a Ad-aware ale nic nenasli. Pripajam log. Skontrolujte ho prosim či som nieco nechytil.
Vykon procesora mi neustale kolise medzi 0-2% až 100%.
Najviac mi zatazuje proces System a Procesy systemovej nečinnosti
u je log
Logfile of HijackThis v1.99.1
Scan saved at 15:40:32, on 19.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Rudi Gabika\Desktop\Ochrana\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.sk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{11A739EF-3A0A-4FA9-9269-FC6DA88A903C}: NameServer = 10.10.49.251,217.119.113.244
O17 - HKLM\System\CS1\Services\Tcpip\..\{11A739EF-3A0A-4FA9-9269-FC6DA88A903C}: NameServer = 10.10.49.251,217.119.113.244
O17 - HKLM\System\CS2\Services\Tcpip\..\{11A739EF-3A0A-4FA9-9269-FC6DA88A903C}: NameServer = 10.10.49.251,217.119.113.244
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

BUBINO · Příspěvek od **BUBINO** » pon 19. lis 2007, 20:36

Toto fixnite :
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.sk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

Nemate SP2 ! Nainstalujte : http://www.microsoft.com/downloads/deta ... laylang=en

Pre istotu sem dajte este log z ComboFixu:
Stiahnite si ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Restartuje pocitac do nudzoveho rezimu.
Behom skenu bude vas pocitac restartovany.
Po restartu vytvori log, uložený v C:/Combofix.txt .
Jeho obsah vlozte sem.

rudiB · Příspěvek od **rudiB** » pon 19. lis 2007, 21:58

Stiahol som si ten ComboFix aj z Vasho odkazu aj priamo zo stranky ale vždy mi to vypiše dnešný datum a že doba už vypršala a odinštaluje ho
Ako dalej

BUBINO · Příspěvek od **BUBINO** » pon 19. lis 2007, 22:13

Urobil ste to co som vam napisal hore ?

rudiB · Příspěvek od **rudiB** » pon 19. lis 2007, 22:24

Dufam že ano . Fixoval som z logu Stiahol som ComboFix restartoval dal do nudzoveho a dalo mi to tu hlasku.

Skontroloval som to aj VundoFix a nic nenaslo

Potom VirtumundoBeGone
[11/19/2007, 22:16:49] - VirtumundoBeGone v1.5 ( "D:\STAHOVANE NET\VirtumundoBeGone.exe" )
[11/19/2007, 22:16:54] - Detected System Information:
[11/19/2007, 22:16:54] - Windows Version: 5.1.2600, Service Pack 2
[11/19/2007, 22:16:54] - Current Username: Administrator (Admin)
[11/19/2007, 22:16:54] - Windows is in SAFE mode with Networking.
[11/19/2007, 22:16:54] - Searching for Browser Helper Objects:
[11/19/2007, 22:16:54] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Podpora odkazu pro Adobe PDF Reader)
[11/19/2007, 22:16:54] - Finished Searching Browser Helper Objects
[11/19/2007, 22:16:54] - Finishing up...
[11/19/2007, 22:16:54] - Nothing found! Exiting...

A pripajam aj log z HijackThis
Logfile of HijackThis v1.99.1
Scan saved at 22:20:48, on 19.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Rudi Gabika\Desktop\Ochrana\HijackThis.exe

O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{11A739EF-3A0A-4FA9-9269-FC6DA88A903C}: NameServer = 10.10.49.251,217.119.113.244
O17 - HKLM\System\CS1\Services\Tcpip\..\{11A739EF-3A0A-4FA9-9269-FC6DA88A903C}: NameServer = 10.10.49.251,217.119.113.244
O17 - HKLM\System\CS2\Services\Tcpip\..\{11A739EF-3A0A-4FA9-9269-FC6DA88A903C}: NameServer = 10.10.49.251,217.119.113.244
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

BUBINO · Příspěvek od **BUBINO** » úte 20. lis 2007, 17:46

Ano viem . ComboFix v sucastnoste blbne. Aplikujte SDFix a MWAV :

SDFIX :
http://www.viry.cz/forum/viewtopic.php?t=40395
Log , ktory po skene naskoci , skopirujte sem.

Ak by zresetovalo pripojenie k internetu , pouzite tuto ulitku :
http://www.spyware.cz/go.php?p=spyware&t=aplikace&id=22
Ak by pripojenie aj tak neslo , nastavte spravne LAN a IP.

MWAV:
http://www.viry.cz/forum/viewtopic.php?t=4097
Vypnite obnovu systemu a aplikujte. Po skene sem dajte log v dolnom okne , nie v hornom !

rudiB · Příspěvek od **rudiB** » úte 20. lis 2007, 19:28

Tu je log z SDfix
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-20 19:25:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

S tym druhym to bude asi na dlhšie Da sa nieco vyčitat z SDfixu

BUBINO · Příspěvek od **BUBINO** » úte 20. lis 2007, 19:56

Neda , lebo nie je konpletny. V C:\SDFIX je log ulozeny. Skopirujte ho tu prosim cely.

rudiB · Příspěvek od **rudiB** » úte 20. lis 2007, 20:08

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-20 20:06:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000016
"TracesSuccessful"=dword:0000000d

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

BUBINO · Příspěvek od **BUBINO** » úte 20. lis 2007, 20:17

Toto je vazne cely log ?

Prosim skontrolujte to . Log by mal byt takyto :
http://forum.pctuning.cz/viewtopic.php?t=109557

Spomalený PC pripajam log

Spomalený PC pripajam log

Re: Spomalený PC pripajam log