bardzo powolny komputer, dlaczego? proszę o diagnozę

[neeven]

Cześć!

Mam problem z komputerem.A mianowicie:Komputer nawet po uruchomieniu paska zadań i wszystkich programów myśli jeszcze chyba z minute.Firewall Outpost włącza się również z minute i to ostatni... Aha i podczas tego wszystkiego wydajność procka wzrasta od 50 do 60%.Na dodatek komputer ogólnie pracuje bardzo wolno.Gdy już się wszystko ustatkuje wydajność procka spada od 3 do 6% czy to normalne?Nie powinno być 1 lub 2 % ?
Dodam jeszcze,że gdy podłączam się do neta wydajność procka wzrasta nawet do 90%... ale później maleje na szczęście(z włączonym netem).Mam jeszcze zapytanie na koniec,czy tego spowolnienia kompa może być wina to ,że jest dysk 18 Gb,którego wolne miejsce to 8gb?

[wojtas]

że jest dysk 18 Gb,którego wolne miejsce to 8gb?

nie sadze


sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED


daj loga z hijacka :

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html
oraz combofixa zrob defragmentacje dysku.

[neeven]

@ wojtas19162

Użyłem ATF_Cleaner'a.Defragmentacji nie zrobiłem bo fragmentacji było tylko 1,2%.Ale logi mam,a oto one:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:06, on 2007-10-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\instalki\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{66C5B617-3278-4798-8B13-D1EB3A091E46}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Spy Emergency Shield Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergencySrv.exe

--
End of file - 3623 bytes

ComboFix 07-10-12.4 - Administrator 2007-10-12 11:24:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.95 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-12 to 2007-10-12 )))))))))))))))))))))))))))))))
.

2007-10-11 19:53 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-10 20:46 <DIR> d-------- C:\Program Files\Lavalys
2007-10-10 19:35 233,472 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.exe
2007-10-10 19:35 110,592 --a------ C:\WINDOWS\system32\JkDefragScreenSaver.scr
2007-10-10 19:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Comodo
2007-10-10 19:15 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Comodo
2007-10-10 19:13 <DIR> d-------- C:\Program Files\Comodo
2007-10-09 19:55 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-10-09 19:53 <DIR> d-------- C:\Program Files\Microsoft Bootvis
2007-10-09 17:15 177,152 --a------ C:\WINDOWS\system32\LXSYSUI.DLL
2007-10-09 15:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations
2007-10-09 15:08 <DIR> d-------- C:\Program Files\Avira
2007-10-09 14:47 <DIR> d-------- C:\Program Files\Alwil Software
2007-10-08 21:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avira
2007-10-08 14:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-08 10:53 <DIR> d-------- C:\Program Files\jv16 PowerTools 2007
2007-10-06 19:28 <DIR> d-------- C:\WINDOWS\system32\oodag
2007-10-06 18:48 <DIR> d-------- C:\Program Files\NETGATE
2007-10-06 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NETGATE
2007-10-06 18:48 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Spy Emergency
2007-10-06 18:48 96,824 --a------ C:\WINDOWS\system32\webspam.dll
2007-10-06 18:48 14,528 --a------ C:\WINDOWS\system32\drivers\spyemrg_guard.sys
2007-10-06 18:48 14,016 --a------ C:\WINDOWS\system32\drivers\spyemrg.sys
2007-10-06 17:19 <DIR> d-------- C:\Program Files\Intercube
2007-10-05 20:50 <DIR> d-------- C:\Program Files\EA GAMES
2007-10-05 20:50 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2007-10-04 16:21 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2007-10-04 16:19 <DIR> d-------- C:\Program Files\Macromedia
2007-10-04 16:19 <DIR> d-------- C:\Program Files\Common Files\Macromedia
2007-10-04 16:15 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-10-03 17:54 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-10-03 17:51 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-09-23 20:39 <DIR> d-------- C:\eMule0.48a
2007-09-23 10:29 <DIR> d-------- C:\Program Files\Defraggler
2007-09-23 08:46 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2007-09-23 08:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2007-09-23 08:46 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\TuneUp Software
2007-09-23 08:46 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-09-23 08:45 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-22 20:09 <DIR> d-------- C:\Program Files\ID-Blaster Plus
2007-09-22 19:25 <DIR> d-------- C:\instalki
2007-09-22 17:36 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\SiteAdvisor
2007-09-17 07:33 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Gadu-Gadu
2007-09-16 18:45 <DIR> d-------- C:\Program Files\Gadu-Gadu
2007-09-16 18:45 <DIR> d-------- C:\Documents and Settings\Administrator\Gadu-Gadu
2007-09-15 10:31 <DIR> d-------- C:\WINDOWS\Sun
2007-09-15 10:26 <DIR> d-------- C:\Program Files\Java
2007-09-15 10:24 <DIR> d-------- C:\Program Files\Common Files\Java
2007-09-15 09:34 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-09-15 09:33 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2007-09-13 21:06 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-09-13 21:06 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-09-13 20:01 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-09-13 20:01 <DIR> d-------- C:\Program Files\Thomson
2007-09-13 20:01 70,624 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2007-09-13 20:01 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2007-09-13 20:01 5,607 --a------ C:\WINDOWS\system32\stci.dll
2007-09-13 20:01 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
2007-09-13 20:01 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-08 12:46 --------- d-----w C:\Program Files\DivX
2007-10-04 14:16 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-10-04 13:42 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-04 13:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-04 11:27 359,040 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2006-12-12 12:08 418 ----a-w C:\Program Files\INSTALL.LOG
1998-04-30 13:56 129,024 ----a-w C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2002-09-27 16:38]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 06:59]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-10-10 19:13]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"=1 (0x1)
"NoResolveTrack"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"=1 (0x1)
"NoResolveTrack"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
"C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergency.exe"

R1 SpyEmrg;Spy Emergency Driver;C:\WINDOWS\system32\Drivers\spyemrg.sys
S3 S3SAVAGE4M;S3SAVAGE4M;C:\WINDOWS\system32\DRIVERS\s3sav4m.sys
S3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;C:\WINDOWS\system32\Drivers\spyemrg_guard.sys
S4 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command - E:\autostart.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53a58190-7503-11dc-9d09-000e50875d7f}]
AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command - Recycled\ctfmon.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-09-28 15:20:12 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-12 11:54:34
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-12 11:55:45
.
--- E O F ---

[kahoona]

Odinstaluj to czeskie "progrmisticke hovno":

NETGATE Spy Emergency 2007

oraz:
TuneUp Utilities 2007
- w którym masz ustawioną optymalizację systemu (najprawdopodobniej przy starcie) - i który muli niepotrzebnie.

Zrestartuj i daj jeszcze raz logi.

[neeven]

@ kahoona

Za Twoją wskazówką odinstalowałem te programy i komputer jakby troszkę przyspieszył ale nadal podczas startu systemu gdy wszystkie programy się załadują to komp myśli chyba jeszcze przynajmniej z 40s i to jest tak ze : Dioda świeci się nieprzerwanie.Później miga jakiś czas.Później znowu się świeci nie przerwanie i później znowu miga tylko tak trochę ale komp już wtedy działa jako tako.Tylko denerwuje mnie to czekanie 40 s....

Edit: Zapomniałem o logach...

Oto i one :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:52:43, on 2007-10-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\instalki\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{66C5B617-3278-4798-8B13-D1EB3A091E46}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3692 bytes

ComboFix 07-10-12.4 - Administrator 2007-10-13 16:45:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.58 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-13 to 2007-10-13 )))))))))))))))))))))))))))))))
.

2007-10-13 11:36 <DIR> d-------- C:\Program Files\CCleaner
2007-10-12 21:46 549,376 --------- C:\WINDOWS\system32\DllCache\oleaut32.dll
2007-10-12 21:44 851,968 --------- C:\WINDOWS\system32\DllCache\vgx.dll
2007-10-12 21:43 <DIR> d-------- C:\Program Files\Malicious Software Removal Tool
2007-10-12 21:39 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-10-12 21:39 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-10-12 21:39 1,104,896 --------- C:\WINDOWS\system32\DllCache\msxml3.dll
2007-10-12 21:36 144,896 --------- C:\WINDOWS\system32\DllCache\schannel.dll
2007-10-12 21:34 364,160 --------- C:\WINDOWS\system32\DllCache\update.sys
2007-10-12 21:33 1,314,816 --------- C:\WINDOWS\system32\DllCache\msoe.dll
2007-10-12 21:33 510,976 --------- C:\WINDOWS\system32\DllCache\wab32.dll
2007-10-12 21:33 86,528 --------- C:\WINDOWS\system32\DllCache\directdb.dll
2007-10-12 21:33 85,504 --------- C:\WINDOWS\system32\DllCache\wabimp.dll
2007-10-12 21:32 683,520 --------- C:\WINDOWS\system32\DllCache\inetcomm.dll
2007-10-12 21:30 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-10-12 21:29 574,464 --------- C:\WINDOWS\system32\DllCache\ntfs.sys
2007-10-12 21:27 293,376 --------- C:\WINDOWS\system32\DllCache\winsrv.dll
2007-10-12 21:26 185,856 --------- C:\WINDOWS\system32\DllCache\upnphost.dll
2007-10-12 21:23 1,843,840 --------- C:\WINDOWS\system32\DllCache\win32k.sys
2007-10-12 21:23 579,072 --------- C:\WINDOWS\system32\DllCache\user32.dll
2007-10-12 21:23 282,112 --------- C:\WINDOWS\system32\DllCache\gdi32.dll
2007-10-12 21:23 40,960 --------- C:\WINDOWS\system32\DllCache\mf3216.dll
2007-10-12 21:22 343,040 --------- C:\WINDOWS\system32\DllCache\msvcrt.dll
2007-10-12 21:20 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2007-10-12 21:19 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2007-10-12 21:19 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2007-10-12 21:19 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2007-10-12 21:18 123,392 --------- C:\WINDOWS\system32\DllCache\oledlg.dll
2007-10-12 21:17 981,760 --------- C:\WINDOWS\system32\DllCache\mfc42u.dll
2007-10-12 21:17 927,504 --------- C:\WINDOWS\system32\DllCache\mfc40u.dll
2007-10-12 21:16 536,576 --------- C:\WINDOWS\system32\DllCache\msado15.dll
2007-10-12 21:16 200,704 --------- C:\WINDOWS\system32\DllCache\msadox.dll
2007-10-12 21:16 180,224 --------- C:\WINDOWS\system32\DllCache\msadomd.dll
2007-10-12 21:16 102,400 --------- C:\WINDOWS\system32\DllCache\msjro.dll
2007-10-12 21:15 539,136 --------- C:\WINDOWS\system32\DllCache\msftedit.dll
2007-10-12 21:15 433,152 --------- C:\WINDOWS\system32\DllCache\riched20.dll
2007-10-12 21:13 8,482,304 --------- C:\WINDOWS\system32\DllCache\shell32.dll
2007-10-12 21:13 135,168 --------- C:\WINDOWS\system32\DllCache\shsvcs.dll
2007-10-12 21:12 334,336 --------- C:\WINDOWS\system32\DllCache\wiaservc.dll
2007-10-12 21:10 36,864 --------- C:\WINDOWS\system32\DllCache\hidclass.sys
2007-10-12 21:09 2,181,632 --------- C:\WINDOWS\system32\DllCache\ntoskrnl.exe
2007-10-12 21:09 2,137,600 --------- C:\WINDOWS\system32\DllCache\ntkrnlmp.exe
2007-10-12 21:09 2,058,880 --------- C:\WINDOWS\system32\DllCache\ntkrnlpa.exe
2007-10-12 21:09 2,017,280 --------- C:\WINDOWS\system32\DllCache\ntkrpamp.exe
2007-10-12 21:07 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-10-12 21:04 <DIR> d-------- C:\WINDOWS\system32\DRM
2007-10-12 21:04 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-10-12 21:03 143,488 --------- C:\WINDOWS\system32\DllCache\usbport.sys
2007-10-12 21:03 59,264 --------- C:\WINDOWS\system32\DllCache\usbhub.sys
2007-10-12 21:03 30,208 --------- C:\WINDOWS\system32\drivers\usbehci.sys
2007-10-12 21:03 30,208 --------- C:\WINDOWS\system32\DllCache\usbehci.sys
2007-10-12 21:03 20,608 --------- C:\WINDOWS\system32\DllCache\usbuhci.sys
2007-10-12 21:03 17,152 --------- C:\WINDOWS\system32\DllCache\usbohci.sys
2007-10-12 21:02 <DIR> d-------- C:\WINDOWS\l2schemas
2007-10-12 21:02 62,336 --------- C:\WINDOWS\system32\drivers\rspndr.sys
2007-10-12 21:02 10,752 --------- C:\WINDOWS\system32\rspndr.exe
2007-10-12 21:01 256,512 --------- C:\WINDOWS\system32\DllCache\agentsvr.exe
2007-10-12 21:01 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2007-10-12 21:01 57,344 --a------ C:\WINDOWS\system32\DllCache\agentdpv.dll
2007-10-12 21:01 42,496 --------- C:\WINDOWS\system32\DllCache\agentdp2.dll
2007-10-12 21:00 728,576 --------- C:\WINDOWS\system32\DllCache\lsasrv.dll
2007-10-12 21:00 337,408 --------- C:\WINDOWS\system32\DllCache\netapi32.dll
2007-10-12 21:00 132,096 --------- C:\WINDOWS\system32\DllCache\wkssvc.dll
2007-10-12 20:59 163,584 --------- C:\WINDOWS\system32\DllCache\nwrdr.sys
2007-10-12 20:59 143,872 --------- C:\WINDOWS\system32\DllCache\nwprovau.dll
2007-10-12 20:59 65,536 --------- C:\WINDOWS\system32\DllCache\nwwks.dll
2007-10-12 20:59 64,000 --------- C:\WINDOWS\system32\DllCache\nwapi32.dll
2007-10-12 20:58 313,344 --------- C:\WINDOWS\system32\DllCache\p2pgraph.dll
2007-10-12 20:58 153,088 --------- C:\WINDOWS\system32\DllCache\p2p.dll
2007-10-12 20:58 116,224 --------- C:\WINDOWS\system32\DllCache\p2pnetsh.dll
2007-10-12 20:58 104,960 --------- C:\WINDOWS\system32\DllCache\p2pgasvc.dll
2007-10-12 20:58 58,880 --------- C:\WINDOWS\system32\DllCache\pnrpnsp.dll
2007-10-12 20:58 33,792 --------- C:\WINDOWS\system32\DllCache\custsat.dll
2007-10-12 20:57 1,712,128 --------- C:\WINDOWS\system32\DllCache\netshell.dll
2007-10-12 20:57 476,160 --------- C:\WINDOWS\system32\DllCache\wzcsvc.dll
2007-10-12 20:57 384,000 --------- C:\WINDOWS\system32\DllCache\wzcdlg.dll
2007-10-12 20:57 52,736 --------- C:\WINDOWS\system32\DllCache\wzcsapi.dll
2007-10-12 20:57 14,592 --------- C:\WINDOWS\system32\DllCache\ndisuio.sys
2007-10-12 20:55 617,472 --------- C:\WINDOWS\system32\DllCache\comctl32.dll
2007-10-12 20:54 225,664 --------- C:\WINDOWS\system32\DllCache\tcpip6.sys
2007-10-12 20:54 128,896 --------- C:\WINDOWS\system32\DllCache\fltmgr.sys
2007-10-12 20:54 100,352 --------- C:\WINDOWS\system32\DllCache\6to4svc.dll
2007-10-12 20:54 23,040 --------- C:\WINDOWS\system32\DllCache\fltmc.exe
2007-10-12 20:54 16,896 --------- C:\WINDOWS\system32\DllCache\fltlib.dll
2007-10-12 20:53 1,439,744 --------- C:\WINDOWS\system32\DllCache\query.dll
2007-10-12 20:53 69,120 --------- C:\WINDOWS\system32\DllCache\ciodm.dll
2007-10-12 20:52 202,240 --------- C:\WINDOWS\system32\DllCache\rmcast.sys
2007-10-12 20:51 172,416 --------- C:\WINDOWS\system32\DllCache\kmixer.sys
2007-10-12 20:51 82,944 --------- C:\WINDOWS\system32\DllCache\wdmaud.sys
2007-10-12 20:51 6,400 --------- C:\WINDOWS\system32\DllCache\splitter.sys
2007-10-12 20:50 332,928 --------- C:\WINDOWS\system32\DllCache\srv.sys
2007-10-12 20:48 8,192 --------- C:\WINDOWS\system32\DllCache\rasadhlp.dll
2007-10-12 20:47 72,704 --------- C:\WINDOWS\system32\DllCache\hlink.dll
2007-10-12 20:46 111,104 --------- C:\WINDOWS\system32\DllCache\dhcpcsvc.dll
2007-10-12 20:46 95,744 --------- C:\WINDOWS\system32\DllCache\iphlpapi.dll
2007-10-12 20:45 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-10-12 20:45 181,248 --------- C:\WINDOWS\system32\DllCache\rasmans.dll
2007-10-12 20:45 148,480 --------- C:\WINDOWS\system32\DllCache\dnsapi.dll
2007-10-12 20:44 1,014,784 --------- C:\WINDOWS\system32\DllCache\kernel32.dll
2007-10-12 20:44 714,240 --------- C:\WINDOWS\system32\DllCache\sxs.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-04 14:16 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-10-04 13:42 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-04 13:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-31 18:45 69,632 ----a-w C:\WINDOWS\system32\wshext.dll
2007-07-31 18:45 69,632 ------w C:\WINDOWS\system32\DllCache\wshext.dll
2007-07-31 18:45 491,520 ------w C:\WINDOWS\system32\DllCache\jscript.dll
2007-07-31 18:45 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll
2007-07-31 18:45 413,696 ------w C:\WINDOWS\system32\DllCache\vbscript.dll
2007-07-31 18:45 36,864 ----a-w C:\WINDOWS\system32\wshcon.dll
2007-07-31 18:45 32,768 ----a-w C:\WINDOWS\system32\dispex.dll
2007-07-31 18:45 32,768 ------w C:\WINDOWS\system32\DllCache\dispex.dll
2007-07-31 18:45 163,840 ----a-w C:\WINDOWS\system32\scrobj.dll
2007-07-31 18:45 163,840 ------w C:\WINDOWS\system32\DllCache\scrobj.dll
2007-07-31 18:45 155,648 ----a-w C:\WINDOWS\system32\scrrun.dll
2007-07-31 18:45 155,648 ------w C:\WINDOWS\system32\DllCache\scrrun.dll
2007-07-31 18:45 135,168 ----a-w C:\WINDOWS\system32\wscript.exe
2007-07-31 18:45 135,168 ------w C:\WINDOWS\system32\DllCache\wscript.exe
2007-07-31 18:45 114,688 ----a-w C:\WINDOWS\system32\cscript.exe
2007-07-31 18:45 114,688 ------w C:\WINDOWS\system32\DllCache\cscript.exe
2006-12-12 12:08 418 ----a-w C:\Program Files\INSTALL.LOG
1998-04-30 13:56 129,024 ----a-w C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2002-09-27 16:38]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 06:59]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-12 15:34]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-10-10 19:13]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"=1 (0x1)
"NoResolveTrack"=1 (0x1)
"ForceClassicControlPanel"=1 (0x1)
"NoChangeKeyboardNavigationIndicators"=0 (0x0)
"NoSharedDocuments"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"=1 (0x1)
"NoResolveTrack"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
"C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\NETGATE\Spy Emergency 2007\SpyEmergency.exe"

S3 S3SAVAGE4M;S3SAVAGE4M;C:\WINDOWS\system32\DRIVERS\s3sav4m.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command - E:\autostart.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53a58190-7503-11dc-9d09-000e50875d7f}]
AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
Open(&0)\command - Recycled\ctfmon.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-09-28 15:20:12 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-13 16:47:37
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-13 16:49:06
C:\ComboFix2.txt ... 2007-10-12 11:55
.
--- E O F ---

[kahoona]

Ale nadal masz po nich pozostałości. Przeczyść rejestr (Jv16, RegHealer - co wolisz i lubisz), a wcześniej skasuj ręcznie foldery

C:\Program Files\TuneUp Utilities 2007
C:\Program Files\NETGATE


Wyłącz z z autostartu:

Adobe Gamma Loader,

oraz alkohol - który dodatkowo coś Ci usiłuje zamontować do wirtualnego napędu.

BTW: znany Ci jest plik c:\instalki\Administrator.exe?

Po czyszczeniu rejestru - odłącz modem z USB i zrestartuj system.


Defragmentację zrób - jakimś O@O Defrag 2000 (darmowy) - może i 1.2% pofragmntowane - ale jak ułożone na dysku?
Poza tym - użyj bootvis tool (microsoftu) - przeanalizuj system przy restarcie . Zgodnie z instrukcją - po restarcie CZEKAJ cierpliwie, aż skończy i wyświetli log.