- strasznie muli, żeby pulpit się pojawił należy czekać około 6 minut.
- następnie pasek wczytuje się chyba wieczność (nic nie można robić, komp, jest jakby zawieszony, oprócz tego, że mogę ruszać myszką)
- następnie mogę wykonywać proste czynności, przenieść plik, zmienić nazwę, wejść w jakiś folder - ale strasznie wolno!
- NIE CZYTA MI DYSKU "G". Coś się z nim stało. Pojawił mi się komunikat przy "przywracaniu systemu windows", że dysk ten został wyłączony...
- "Przywracanie systemu" nic nie dało.
- Nie mogę nic zrobić, bo komputer się co chwilę wiesza.
- Gdy chcę wejść przez tryb awaryjny, to podczas wczytywania, pojawia się czarna strona i niczym z matriksa linie tekstów przechodzą w dół. Zdołałem uchwycić, że pojawia się tam często .../system32/...
Co mogę zrobić?
Poniżej zamieszczam log z ComboFixa.
- Kod: Zaznacz wszystko
ComboFix 08-07-09.4 - Adrian 2008-07-10 8:09:31.1 - [color=red][b]FAT32[/b][/color]x86
Running from: D:\Documents and Settings\Adrian.BLADEMASTER\Pulpit\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\Documents and Settings\Adrian.BLADEMASTER\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows Media\10.0\WMSDKNSD.XML
D:\Program Files\myglobalsearch
D:\WINDOWS\system32\Cache
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_POWERMANAGER
((((((((((((((((((((((((( Files Created from 2008-06-10 to 2008-07-10 )))))))))))))))))))))))))))))))
.
2008-07-07 21:23 . 2008-07-07 21:23 <DIR> d--hs---- D:\FOUND.192
2008-06-29 08:23 . 2008-06-29 08:23 <DIR> d--hs---- D:\FOUND.191
2008-06-13 19:39 . 2008-06-13 19:39 <DIR> d--hs---- D:\FOUND.009
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-23 06:49 --------- d-----w D:\Program Files\Przeglądarka migawek
2008-05-23 06:49 --------- d-----w D:\Documents and Settings\All Users\Dane aplikacji\SBT
2008-05-23 06:49 --------- d-----w D:\Documents and Settings\Adrian.BLADEMASTER\Dane aplikacji\Microsoft Web Folders
2008-05-20 21:54 --------- d-----w D:\Documents and Settings\Adrian.BLADEMASTER\Dane aplikacji\OpenOffice.ux.pl2
2008-05-20 21:51 --------- d-----w D:\Program Files\OpenOffice.ux.pl 2.0.1
2008-05-19 17:57 --------- d-----w D:\Program Files\WapSter
2008-05-19 14:45 --------- d-----w D:\Program Files\Hide IP NG
2008-05-19 14:45 --------- d-----w D:\Documents and Settings\Adrian.BLADEMASTER\Dane aplikacji\Hide IP NG
2008-05-15 12:16 --------- d-----w D:\Program Files\Common Files\Macrovision Shared
2008-05-14 12:22 --------- d-----w D:\Documents and Settings\Adrian.BLADEMASTER\Dane aplikacji\Quark
2008-04-19 12:56 56,880 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-11-23 21:01 81,920 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\Dane aplikacji\ezpinst.exe
2007-11-23 21:01 47,360 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\Dane aplikacji\pcouffin.sys
2007-08-12 23:04 36 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\klextlock.dat
2006-06-22 13:40 2,616 ----a-w D:\Program Files\dat14.tmp
2006-06-08 11:51 8,192 ------w D:\Program Files\Empire Interactive
2006-06-08 11:51 8,192 ------w D:\Program Files\directx
2006-03-18 06:01 827 ----a-w D:\Program Files\datF.tmp
2006-03-17 20:44 16,384 ----a-w D:\Program Files\dat11C.tmp
2006-02-28 20:08 525 ----a-w D:\Program Files\datE0.tmp
2005-12-08 08:06 525 ----a-w D:\Program Files\dat9.tmp
2001-04-14 06:19 345,636 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\CAPELLA.EXE
1998-04-27 16:00 70,822 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\VEGA.EXE
1997-12-08 17:21 15,850 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\SETUP.EXE
1997-12-08 17:09 61,234 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\ALTAIR.EXE
1997-12-08 17:09 53,286 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\RIGEL.EXE
1997-12-08 17:09 37,728 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\SPICA.EXE
1997-12-08 17:09 32,270 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\ORBA.EXE
1997-12-08 17:09 30,096 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\KWINTYL.EXE
1997-12-08 17:09 19,378 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\MIASTA.EXE
1997-12-07 18:25 1,211 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\NAPISY.DAT
1997-12-06 10:58 2,089 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\NOTKI.DAT
1996-10-09 18:28 1,004 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\LET_PL.DAT
1996-09-04 05:09 234 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\PLACIDUS.DAT
1996-09-02 15:55 399 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\POZHOR2.DAT
1996-09-02 15:55 399 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\POZHOR1.DAT
1996-07-18 18:46 12,270 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\BANK.DAT
1996-06-29 09:07 25,206 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\EFEM.DAT
1996-06-27 13:59 353 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\EFER10.DAT
1996-05-29 04:51 2,643 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\GLOBMST.DAT
1996-05-29 04:39 5,876 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\MIASTA.DAT
1996-05-22 20:17 5,431 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\SIATKA.DAT
1996-05-18 08:01 44 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\LICZ1.DAT
1996-05-18 08:01 140 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\LICZ2.DAT
1996-05-10 20:46 699 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\ORBA.DAT
1996-04-23 13:14 4,392 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\MAPA_S.DAT
1996-04-13 09:46 169 ----a-w D:\Documents and Settings\Adrian.BLADEMASTER\SYMBOLE.DAT
2002-11-19 14:01 28,672 ----a-w D:\Program Files\opera\program\plugins\PlugDef.dll
.
------- Sigcheck -------
2006-04-20 12:51 359808 cee1276a4a71e3f8545d97c1aad2a6b0 D:\WINDOWS\system32\drivers\tcpip.sys
2006-04-20 12:51 359808 1dbf125862891817f374f407626967f4 D:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c D:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2005-05-25 20:07 359936 63fdfea54eb53de2d863ee454937ce1e D:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 18:07 360448 5562cc0a47b2aef06d3417b733f3c195 D:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 13:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 D:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2002-08-29 01:58 332928 244a2f9816bc9b593957281ef577d976 D:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c D:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2005-05-25 20:04 359808 88763a98a4c26c409741b4aa162720c9 D:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-13 03:28 359808 583e063fdc888ca30d05c2724b0d7ef4 D:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Orb"="D:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 495616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acecad.Wtxpload"="D:\WINDOWS\Acecad\Wtxpload.exe" [2002-03-22 02:07 45056]
"ZPOINT32"="D:\WINDOWS\system32\ZPOINT32.exe" [2002-07-04 13:49 20480]
"StormCodec_Helper"="D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [2006-04-08 09:17 296631]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 D:\WINDOWS\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Logitech SetPoint.lnk - E:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-29 16:39:36 784912]
Adobe Acrobat Speed Launcher.lnk - D:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2008-05-15 14:16:08 295606]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50 734872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2007-11-15 10:10 72208 d:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.wmv3"= D:\PROGRA~1\COMBIN~1\Filters\wmv9vcm.dll
"aux"= ctwdm32.dll
"aux1"= ctwdm32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk]
backup=D:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
--a------ 2006-08-01 17:04 3313664 e:\Program Files\BearShare\BearShare.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 00:44 15360 D:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\Opera\\Opera.exe"=
"E:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\PPMate\\ppmate.exe"=
"c:\\Program Files\\PPMate\\ppmnet.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"7568:TCP"= 7568:TCP:BitComet 7568 TCP
"7568:UDP"= 7568:UDP:BitComet 7568 UDP
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09dcfeba-0e61-11db-bca4-806d6172696f}]
\Shell\AutoRun\command - I:\autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2e83272-89b4-11da-97d4-000ea6cc49d0}]
\Shell\AutoRun\command - J:\Uruchom.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbb05950-473e-11db-bd73-000ea6cc49d0}]
\Shell\AutoOpen\command - K:\.\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe
\Shell\AutoRun\command - D:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Gadu-Gadu - G:\Program Files\Gadu-Gadu\gg.exe
HKCU-Run-AQQ - D:\PROGRA~1\WapSter\AQQ\AQQ.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-10 08:28:47
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-10 8:42:50
ComboFix-quarantined-files.txt 2008-07-10 06:42:48
Pre-Run: 1,177,788,416 bajtów wolnych
Post-Run: 1,474,101,248 bajt˘w wolnych
159
