mój komputer zaczął ostatnio wolniej chodzić. Nie wiem czym to jest spowodowane, niczego nie ściągałem, nic nie instalowałem. Jedynie przez okres 2 tygodni nie miałem, żadnego antyvirka.
A o to logi:
OTL
- Kod: Zaznacz wszystko
http://www.wklej.org/id/348184/
extras
- Kod: Zaznacz wszystko
http://www.wklej.org/id/348185/
dds
- Kod: Zaznacz wszystko
http://www.wklej.org/id/348189/
attach
- Kod: Zaznacz wszystko
http://www.wklej.org/id/348190/
raz ss z procesów
- Kod: Zaznacz wszystko
http://img156.imageshack.us/img156/8886/procesy.jpg
Dodano 09.06.2010 19:39:22:
- Kod: Zaznacz wszystko
ComboFix 10-06-09.01 - edo 2010-06-09 20:20:33.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2046.1611 [GMT 2:00]
Uruchomiony z: c:\documents and settings\edo\Pulpit\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\icon.ico
.
((((((((((((((((((((((((( Pliki utworzone od 2010-05-09 do 2010-06-09 )))))))))))))))))))))))))))))))
.
2010-06-06 17:06 . 2010-06-09 17:26 -------- d-----w- C:\Beverly.Hills.Chihuahua.2008.PLDUB.DVDRip.XviD-WPRF_excel223_www.darkwarez.pl
2010-05-25 08:34 . 2010-05-25 08:34 -------- d-----w- c:\program files\MathSoft
2010-05-19 10:04 . 2010-05-19 10:04 -------- d-----w- c:\program files\Matematyka
2010-05-17 15:43 . 2010-01-29 15:01 691a712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-05-11 08:46 . 2010-05-11 08:46 -------- d-----w- c:\documents and settings\edo\Ustawienia lokalne\Dane aplikacji\Mathsoft
2010-05-11 08:44 . 2010-05-11 08:44 -------- d-----w- c:\documents and settings\edo\Dane aplikacji\Mathsoft
2010-05-11 08:42 . 2010-05-11 08:42 -------- d-----w- c:\program files\Mathcad
2010-05-11 08:41 . 2010-05-11 08:41 -------- d-----w- c:\program files\MSXML 4.0
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-09 18:14 . 2008-12-26 12:18 786464 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-06-09 18:14 . 2008-12-26 12:18 4816 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-06-09 18:14 . 2008-12-26 12:18 4325920 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-06-09 18:14 . 2008-12-26 12:18 39068 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-06-09 17:23 . 2008-12-26 12:18 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2010-06-09 17:23 . 2008-12-13 12:48 -------- d-----w- c:\program files\AutoConnect
2010-06-09 14:19 . 2008-12-14 16:17 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-09 14:02 . 2009-03-31 07:56 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft
2010-06-06 14:56 . 2010-03-30 07:59 -------- d-----w- c:\documents and settings\edo\Dane aplikacji\Tlen.pl
2010-06-06 10:42 . 2009-08-23 09:28 -------- d-----w- c:\program files\RegCure
2010-06-04 14:35 . 2009-11-17 12:41 -------- d-----w- c:\program files\jv16 PowerTools 2009
2010-06-04 14:32 . 2009-11-17 12:41 228 ----a-w- c:\windows\system32\edacded0.dat
2010-05-26 21:08 . 2004-08-04 12:00 84916 ----a-w- c:\windows\system32\perfc015.dat
2010-05-26 21:08 . 2004-08-04 12:00 493500 ----a-w- c:\windows\system32\perfh015.dat
2010-05-25 08:46 . 2008-12-13 14:53 68848 ----a-w- c:\documents and settings\edo\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-05-25 08:35 . 2010-03-17 20:52 189 ----a-w- c:\windows\PowerReg.dat
2010-05-17 21:44 . 2008-12-14 17:03 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2010-05-17 17:49 . 2008-12-16 19:20 -------- d-----w- c:\program files\Soulseek
2010-05-17 15:43 . 2008-12-13 13:46 -------- d-----w- c:\program files\FlashGet
2010-05-11 08:38 . 2008-12-13 12:41 -------- d-----w- c:\program files\JM
2010-05-10 09:45 . 2010-05-10 09:45 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-07 08:19 . 2010-01-30 14:11 -------- d-----w- c:\program files\Common Files\Apple
2010-05-05 06:53 . 2008-12-26 12:19 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-05-05 06:53 . 2008-12-26 12:19 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-04-28 21:35 . 2009-10-03 16:10 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-28 11:22 . 2009-10-03 14:50 -------- d-----w- c:\documents and settings\edo\Dane aplikacji\ipla
2009-05-15 07:37 . 2009-05-15 07:37 8 --sh--w- c:\program files\.ex010705.dat
2009-05-15 07:37 . 2009-05-15 07:37 8 --sh--w- c:\program files\.ex010507.dat
2009-05-15 07:37 . 2009-05-15 07:37 8 --sh--w- c:\program files\.bx050107.dat
2009-05-15 07:37 . 2009-03-17 12:34 8 --sh--w- c:\program files\.data211204.dat
2009-05-15 07:37 . 2009-03-17 12:34 8 --sh--w- c:\program files\.data211004.dat
2009-05-15 07:37 . 2009-03-17 12:34 8 --sh--w- c:\program files\.data110704.dat
2009-03-17 12:34 . 2009-03-17 12:34 8 --sh--w- c:\program files\.drv120405.dat
2009-03-17 12:34 . 2009-03-17 12:34 8 --sh--w- c:\program files\.dat000001.dat
2009-03-17 12:34 . 2009-03-17 12:34 8 --sh--w- c:\program files\.dat000002.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2009-01-17 5853672]
"AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2006-12-02 310784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-31 36864]
"Habu"="c:\program files\Razer\Habu\razerhid.exe" [2007-05-11 176128]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-10 201992]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 16270848]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\edo\Menu Start\Programy\Autostart\
PowerReg SchedulerV2.exe [2010-5-25 256000]
[HKLM\~\startupfolder\C:^Documents and Settings^edo^Menu Start^Programy^Autostart^FreeRapid 0.82.lnk]
path=c:\documents and settings\edo\Menu Start\Programy\Autostart\FreeRapid 0.82.lnk
backup=c:\windows\pss\FreeRapid 0.82.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^edo^Menu Start^Programy^Autostart^PowerReg SchedulerV2.exe]
path=c:\documents and settings\edo\Menu Start\Programy\Autostart\PowerReg SchedulerV2.exe
backup=c:\windows\pss\PowerReg SchedulerV2.exeStartup
[HKLM\~\startupfolder\C:^Documents and Settings^edo^Menu Start^Programy^Autostart^reminder-ScanSoft Produkt Registrierung.lnk]
path=c:\documents and settings\edo\Menu Start\Programy\Autostart\reminder-ScanSoft Produkt Registrierung.lnk
backup=c:\windows\pss\reminder-ScanSoft Produkt Registrierung.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HEXelon MAX
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prec
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tlen.pl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]
2006-11-17 01:05 1953792 ------r- c:\windows\system32\JMRaidSetup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate]
2009-06-04 20:56 869888 ----a-w- c:\program files\ALLPlayer\ALLUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-02-13 23:09 486856 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
2007-09-25 08:10 2007088 ----a-w- c:\program files\FlashGet\flashget.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 22:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPLA!]
2009-12-21 16:50 14100376 ----a-w- c:\program files\ipla\ipla.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-10-07 12:33 13574144 ----a-w- c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-10-07 12:33 86016 ----a-w- c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-10-07 12:33 1630208 ----a-w- c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
2004-12-14 17:28 98304 ----a-r- c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2008-11-18 15:31 21633320 ----a-r- c:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 10:04 2879488 ------r- c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-05-07 12:58 1238352 ----a-w- c:\program files\Valve\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-02-16 17:17 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
2007-06-20 13:22 1859864 ----a-w- c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-07-01 16:37 37888 ----a-w- c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
2003-10-16 18:07 24576 ----a-w- c:\progra~1\NEOSTR~1\CnxMon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
2003-10-16 18:07 53248 ------w- c:\progra~1\NEOSTR~1\TaskBarIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
2003-10-16 18:07 20480 ------w- c:\progra~1\NEOSTR~1\Watch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Tlen.pl\\tlen.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\PROGRAMY DO INSTALACJI\\slskPLbyFoxconn.exe"=
"c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\edek666\\counter-strike\\hl.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2010-05-10 93360]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Zawartość folderu 'Zaplanowane zadania'
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: &Ściągnij przy pomocy FlashGet'a - c:\program files\FlashGet\jc_link.htm
IE: &Ściągnij wszystko przy pomocy FlashGet'a - c:\program files\FlashGet\jc_all.htm
IE: E&ksportuj do programu Microsoft Excel
IE: { - c:\program files\Messenger\msmsgs.exe
IE: {{B46B0919-62BA-4D99-A5C4-916B57A6805C} - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - c:\program files\Techland\Common\InternetTranslator\InternetTranslator.dll
Trusted Zone: com.pl\mks
FF - ProfilePath - c:\documents and settings\edo\Dane aplikacji\Mozilla\Firefox\Profiles\8shrgu7e.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-09 20:26
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(1076)
c:\windows\system32\klogon.dll
.
Czas ukończenia: 2010-06-09 20:28:42
ComboFix-quarantined-files.txt 2010-06-09 18:28
Przed: 7 492 812 800 bajtów wolnych
Po: 7 779 983 360 bajtów wolnych
- - End Of File - - D26FE1FCA5D938F98C1866FF12A9CE5A
