bardzo wolny internet i rozłączające się komunikatory

**Posty:** 241 · przez **Paxo202** 27 Maj 2008, 19:46

Witam. Od niedawna mój internet zaczął strasznia wolno chodzić. Rozłączają mi się komunikatory, strasznie wolno startuje pobieranie plików, w czasie pobierania plików pobieranie zatrzymuje się, bardzo wolno ładują mi się stronki. Daję loga z Hijack'a:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:46:02, on 2008-05-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\AvastAntywirus\aswUpdSv.exe C:\Program Files\Alwil Software\AvastAntywirus\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\AvastAntywirus\ashMaiSv.exe C:\Program Files\Alwil Software\AvastAntywirus\ashWebSv.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\ALWILS~1\AVASTA~1\ashDisp.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\COMODO\Firewall\cfp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazetawyborcza.pl/0,0.html?p=4 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {96372AB6-15EB-4316-B497-71C741BC548C} - (no file) O3 - Toolbar: (no name) - {35065594-9169-4A34-B167-FC4865038E53} - (no file) O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\AVASTA~1\ashDisp.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{159105CC-1E64-4219-B98D-98374A5BE3E9}: NameServer = 10.10.2.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\ashWebSv.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 8779 bytes

**Posty:** 8001 · przez **Okocza** 27 Maj 2008, 19:51

Paxo202 napisał(a):O2 - BHO: (no name) - {96372AB6-15EB-4316-B497-71C741BC548C} - (no file)
O3 - Toolbar: (no name) - {35065594-9169-4A34-B167-FC4865038E53} - (no file)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

+ log z combo

**Posty:** 241 · przez **Paxo202** 28 Maj 2008, 14:57

Log z ComboFix'a.

Kod: Zaznacz wszystko: ComboFix 08-05-27.4 - Patryk 2008-05-28 6:28:58.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.606 [GMT 2:00] Running from: C:\Documents and Settings\Patryk\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Patryk\Dane aplikacji\inst.exe C:\WINDOWS\Downloaded Program Files\setup.inf . ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-28 ))))))))))))))))))))))))))))))) . 2008-05-28 03:36 . 2008-05-28 03:36 <DIR> d-------- C:\WINDOWS\LastGood 2008-05-27 20:40 . 2008-05-27 20:40 <DIR> d--h----- C:\WINDOWS\PIF 2008-05-27 07:57 . 2008-05-27 07:57 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\stamina 2008-05-27 07:56 . 2008-05-27 07:56 <DIR> d-------- C:\Program Files\Konnekt 2008-05-25 10:44 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-05-25 10:44 . 2008-05-25 10:45 163,353 --a------ C:\WINDOWS\system32\nvapps.xml 2008-05-25 10:44 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-05-25 10:43 . 2008-05-25 10:43 <DIR> d-------- C:\NVIDIA 2008-05-25 10:43 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-05-25 09:27 . 2008-05-25 10:47 <DIR> d-------- C:\WINDOWS\nview 2008-05-20 17:46 . 2008-05-24 15:34 <DIR> d-------- C:\Program Files\Opera 2008-05-20 15:43 . 2008-05-20 15:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-05-20 15:42 . 2008-05-20 15:42 <DIR> d-------- C:\Program Files\DIFX 2008-05-20 15:42 . 2008-05-20 15:46 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\Nokia 2008-05-20 15:41 . 2008-05-20 15:41 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-05-20 15:41 . 2008-05-20 15:41 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-05-20 15:41 . 2008-05-20 15:43 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\PC Suite 2008-05-20 15:40 . 2008-05-20 15:42 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-05-20 15:40 . 2008-05-20 15:40 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-05-20 15:40 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-05-20 15:40 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-05-20 15:40 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-05-20 15:40 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-05-20 15:40 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-05-20 15:39 . 2008-05-20 15:41 <DIR> d-------- C:\Program Files\Nokia 2008-05-20 15:39 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-05-20 15:38 . 2008-05-20 15:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-05-20 12:08 . 2008-05-20 12:08 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-20 12:08 . 2008-05-20 12:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-05-20 11:34 . 2008-05-20 11:34 <DIR> d-------- C:\Program Files\Lavalys 2008-05-20 09:14 . 2008-05-20 09:14 <DIR> d-------- C:\Program Files\MarBit 2008-05-20 08:32 . 2008-05-20 08:32 <DIR> d-------- C:\Program Files\CCleaner 2008-05-19 19:26 . 2008-05-19 19:27 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-05-18 19:29 . 2008-05-18 19:30 <DIR> d-------- C:\Program Files\McDonaldsFairies 2008-05-17 15:38 . 2008-05-17 15:38 <DIR> d-------- C:\Program Files\COMODO 2008-05-17 15:38 . 2008-05-17 15:38 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\Comodo 2008-05-17 15:38 . 2008-05-17 15:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo 2008-05-17 15:38 . 2008-05-23 10:20 143,104 --a------ C:\WINDOWS\system32\guard32.dll 2008-05-17 15:38 . 2008-05-23 10:21 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys 2008-05-17 15:38 . 2008-05-23 10:21 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-05-17 09:24 . 2008-05-17 15:34 <DIR> d-------- C:\Program Files\Odkurzacz 2008-05-08 20:41 . 2008-05-17 09:42 <DIR> d-------- C:\WINDOWS\NV11203040.TMP 2008-05-07 20:56 . 2008-05-07 20:56 <DIR> d-------- C:\Program Files\ToniArts 2008-05-07 18:44 . 2005-02-26 07:34 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll 2008-05-03 16:44 . 2008-05-03 16:44 <DIR> d-------- C:\Program Files\MegauploadToolbar 2008-05-03 16:44 . 2008-05-03 16:44 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\MegauploadToolbar 2008-05-02 14:12 . 2008-05-02 14:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle VideoSpin 2008-05-02 14:10 . 2008-05-02 14:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\VideoSpin 2008-05-02 14:08 . 2008-05-02 14:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle 2008-05-01 15:58 . 2008-05-01 15:58 <DIR> d-------- C:\Deckard . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-27 17:02 --------- d-----w C:\Program Files\eMule 2008-05-26 16:54 --------- d-----w C:\Program Files\Tlen.pl 2008-05-25 17:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-25 17:04 --------- d-----w C:\Program Files\Elfin 2008-05-23 09:21 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\gtk-2.0 2008-05-23 07:45 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\TransRender 2008-05-23 07:45 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Temporary 2008-05-18 08:41 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-17 16:01 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\uTorrent 2008-05-17 07:42 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-05-17 07:42 --------- d-----w C:\Program Files\IrfanView 2008-05-17 07:42 --------- d-----w C:\Program Files\FlashGet 2008-05-17 07:42 --------- d-----w C:\Program Files\BitComet 2008-05-17 07:42 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\skypePM 2008-05-17 07:42 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\BitTorrent 2008-05-17 07:42 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Azureus 2008-05-15 01:02 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-05-01 17:14 --------- d-----w C:\Program Files\Google 2008-05-01 07:50 --------- d-----w C:\Program Files\Belt Generator 2008-04-29 12:13 --------- d-----w C:\Program Files\GIMP-2.0 2008-04-26 05:49 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Tibia 2008-04-23 17:56 --------- d-----w C:\Program Files\JetAudio 2008-04-23 17:55 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\COWON 2008-04-23 05:38 --------- d-----w C:\Program Files\Java 2008-04-19 16:57 --------- d-----w C:\Program Files\BearShare 2008-04-19 10:25 --------- d-----w C:\Program Files\YouTube Video Downloader 2008-04-19 07:34 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Winamp 2008-04-19 07:31 --------- d-----w C:\Program Files\Winamp Toolbar 2008-04-19 07:31 --------- d-----w C:\Program Files\Winamp Remote 2008-04-19 07:31 --------- d-----w C:\Program Files\Winamp 2008-04-19 07:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-04-19 07:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2008-04-15 13:09 --------- d-----w C:\Program Files\SystemRequirementsLab 2008-04-15 13:04 2,560 ----a-w C:\WINDOWS\system32\bitcometres.dll 2008-04-12 10:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier 2008-04-11 08:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-04-09 11:31 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-09 10:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-04-09 10:35 --------- d-----w C:\Program Files\Adobe Flash CS3 2008-04-09 07:59 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-04-09 07:42 --------- d-----w C:\Program Files\Total Commander 7.02a 2008-04-09 07:19 --------- d-----w C:\Program Files\Alcohol Soft 2008-04-09 07:16 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-04-08 17:24 --------- d-----w C:\Program Files\Dance6 2008-04-08 17:19 --------- d-----w C:\Program Files\Windows Media Components 2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-08 16:19 10,856 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-05 14:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll 2008-03-05 14:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll 2008-03-05 14:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll 2008-03-05 13:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll 2008-03-05 13:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll 2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-19 19:35 47,360 ----a-w C:\Documents and Settings\Patryk\Dane aplikacji\pcouffin.sys 2007-11-20 10:36 56 --sh--r C:\WINDOWS\system32\DF4995B7A9.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-03-03 14:44 266240] "Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 23:41 503808] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 11:21 16270848 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe] "JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-31 06:44 36864] "36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-11-17 03:05 1953792] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "avast!"="C:\PROGRA~1\ALWILS~1\AVASTA~1\ashDisp.exe" [2008-05-16 01:19 79224] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 12:20 200704] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-23 10:04 1575680] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336] C:\Documents and Settings\Patryk\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 21:24:54 98632] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ D-Link AirPlus.lnk - C:\Program Files\D-Link AirPlus\AirPlus.exe [2007-05-26 16:48:26 262144] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax [HKLM\~\startupfolder\C:^Documents and Settings^Patryk^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\Patryk\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] C:\Program Files\BitTorrent\bittorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-03-12 22:43 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 12:04 2127296 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Konnekt\\konnekt.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "24920:TCP"= 24920:TCP:BitComet 24920 TCP "24920:UDP"= 24920:UDP:BitComet 24920 UDP R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 23:41] R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 23:41] R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 14:46] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-05-23 10:21] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-05-23 10:21] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 Bcfilter;Jetico Personal Firewall Network Monitor;C:\WINDOWS\system32\DRIVERS\bcfilter.sys [] S3 BcfilterMP;BcfilterMP;C:\WINDOWS\system32\DRIVERS\bcfilter.sys [] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-05-24 17:11] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-28 06:30:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\guard32.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\guard32.dll . Completion time: 2008-05-28 6:31:20 ComboFix-quarantined-files.txt 2008-05-28 04:31:14 Pre-Run: 26,155,163,648 bajtów wolnych Post-Run: 26,154,778,624 bajtów wolnych 238 --- E O F --- 2008-05-17 03:45:40

**Posty:** 7956 · przez **Magik** 28 Maj 2008, 15:00

No i jest spoko

zrob jeszcze te operacje by wojtas

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 241 · przez **Paxo202** 28 Maj 2008, 17:01

Nie wiem czemu, ale internet nadal wolno chodzi po wykonaniu tych wszystkich operacji. Co robić?

**Posty:** 8001 · przez **Okocza** 28 Maj 2008, 17:05

przeskanuj system programem Ewido +

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 241 · przez **Paxo202** 28 Maj 2008, 21:27

Mam pytanie dotyczące blokowania portów w Windows Worm Doors Cleaner. Powinno być tylko na żółto NetBios, a jest dodatkowo RPC Locator. Jak to zmienić?

Oto screen:

Przy okazji daje raport ze skanów Ewido:

Jeszcze tylko muszę dobrze zablokować porty i zastosować SDFix.

**Posty:** 8001 · przez **Okocza** 28 Maj 2008, 21:29

klikasz na Enable LOCATOR

oczywiście wszystkie wpisy z Ewido kasujesz.

**Posty:** 241 · przez **Paxo202** 29 Maj 2008, 14:56

No, internet śmiga jak należy. Wpisy z Ewido skasowałem, porty robaków zablokowałem. Aha, i czy mogę WWDC skasować po zablokowaniu portów, czy zostawić go na dysku? Daję logi...

SDFix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.186 [/b] Run by Patryk on 2008-05-29 at 14:33 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-29 14:39:04 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:4f6e1fef "s2"=dword:5f9e9141 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:9d,9c,cd,84,bf,33,e7,dd,5d,3e,17,3d,19,d4,68,46,f0,b4,0b,af,99,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:9d,9c,cd,84,bf,33,e7,dd,5d,3e,17,3d,19,d4,68,46,f0,b4,0b,af,99,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{56CA5D3B-3002-4E7B-90FE-071D8FDF3814}] "DisplayName"="DAEMON Tools" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}] "DisplayName"="Alcohol 120% (Trial Version)" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Konnekt\\konnekt.exe"="C:\\Program Files\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Tue 20 Nov 2007 56 ..SHR --- "C:\WINDOWS\system32\DF4995B7A9.sys" Sat 8 Mar 2008 10,856 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" [b]Finished![/b]

ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-05-28.4 - Patryk 2008-05-29 14:49:32.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.646 [GMT 2:00] Running from: C:\Documents and Settings\Patryk\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-29 ))))))))))))))))))))))))))))))) . 2008-05-29 14:27 . 2008-05-29 14:41 <DIR> d-------- C:\SDFix 2008-05-28 20:33 . 2008-05-28 20:33 <DIR> d-------- C:\Program Files\ewido anti-spyware 4.0 2008-05-27 20:40 . 2008-05-27 20:40 <DIR> d--h----- C:\WINDOWS\PIF 2008-05-27 07:57 . 2008-05-27 07:57 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\stamina 2008-05-27 07:56 . 2008-05-27 07:56 <DIR> d-------- C:\Program Files\Konnekt 2008-05-25 10:44 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-05-25 10:44 . 2008-05-25 10:45 163,353 --a------ C:\WINDOWS\system32\nvapps.xml 2008-05-25 10:44 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-05-25 10:43 . 2008-05-25 10:43 <DIR> d-------- C:\NVIDIA 2008-05-25 10:43 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-05-25 09:27 . 2008-05-25 10:47 <DIR> d-------- C:\WINDOWS\nview 2008-05-20 17:46 . 2008-05-24 15:34 <DIR> d-------- C:\Program Files\Opera 2008-05-20 15:43 . 2008-05-20 15:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-05-20 15:42 . 2008-05-20 15:42 <DIR> d-------- C:\Program Files\DIFX 2008-05-20 15:42 . 2008-05-20 15:46 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\Nokia 2008-05-20 15:41 . 2008-05-20 15:41 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-05-20 15:41 . 2008-05-20 15:41 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-05-20 15:41 . 2008-05-20 15:43 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\PC Suite 2008-05-20 15:40 . 2008-05-20 15:42 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-05-20 15:40 . 2008-05-20 15:40 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-05-20 15:40 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-05-20 15:40 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-05-20 15:40 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-05-20 15:40 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-05-20 15:40 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-05-20 15:39 . 2008-05-20 15:41 <DIR> d-------- C:\Program Files\Nokia 2008-05-20 15:39 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-05-20 15:38 . 2008-05-20 15:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-05-20 12:08 . 2008-05-20 12:08 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-20 12:08 . 2008-05-20 12:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-05-20 11:34 . 2008-05-20 11:34 <DIR> d-------- C:\Program Files\Lavalys 2008-05-20 09:14 . 2008-05-20 09:14 <DIR> d-------- C:\Program Files\MarBit 2008-05-20 08:32 . 2008-05-20 08:32 <DIR> d-------- C:\Program Files\CCleaner 2008-05-19 19:26 . 2008-05-19 19:27 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-05-18 19:29 . 2008-05-18 19:30 <DIR> d-------- C:\Program Files\McDonaldsFairies 2008-05-17 15:38 . 2008-05-17 15:38 <DIR> d-------- C:\Program Files\COMODO 2008-05-17 15:38 . 2008-05-17 15:38 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\Comodo 2008-05-17 15:38 . 2008-05-17 15:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo 2008-05-17 15:38 . 2008-05-23 10:20 143,104 --a------ C:\WINDOWS\system32\guard32.dll 2008-05-17 15:38 . 2008-05-23 10:21 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys 2008-05-17 15:38 . 2008-05-23 10:21 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-05-17 09:24 . 2008-05-17 15:34 <DIR> d-------- C:\Program Files\Odkurzacz 2008-05-08 20:41 . 2008-05-17 09:42 <DIR> d-------- C:\WINDOWS\NV11203040.TMP 2008-05-07 20:56 . 2008-05-07 20:56 <DIR> d-------- C:\Program Files\ToniArts 2008-05-07 18:44 . 2005-02-26 07:34 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll 2008-05-03 16:44 . 2008-05-03 16:44 <DIR> d-------- C:\Program Files\MegauploadToolbar 2008-05-03 16:44 . 2008-05-03 16:44 <DIR> d-------- C:\Documents and Settings\Patryk\Dane aplikacji\MegauploadToolbar 2008-05-02 14:12 . 2008-05-02 14:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle VideoSpin 2008-05-02 14:10 . 2008-05-02 14:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\VideoSpin 2008-05-02 14:08 . 2008-05-02 14:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-28 11:31 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\gtk-2.0 2008-05-27 17:02 --------- d-----w C:\Program Files\eMule 2008-05-26 16:54 --------- d-----w C:\Program Files\Tlen.pl 2008-05-25 17:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-25 17:04 --------- d-----w C:\Program Files\Elfin 2008-05-23 07:45 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\TransRender 2008-05-23 07:45 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Temporary 2008-05-18 08:41 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-17 16:01 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\uTorrent 2008-05-17 07:42 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-05-17 07:42 --------- d-----w C:\Program Files\IrfanView 2008-05-17 07:42 --------- d-----w C:\Program Files\FlashGet 2008-05-17 07:42 --------- d-----w C:\Program Files\BitComet 2008-05-17 07:42 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\skypePM 2008-05-17 07:42 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\BitTorrent 2008-05-17 07:42 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Azureus 2008-05-15 01:02 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-05-01 17:14 --------- d-----w C:\Program Files\Google 2008-05-01 07:50 --------- d-----w C:\Program Files\Belt Generator 2008-04-29 12:13 --------- d-----w C:\Program Files\GIMP-2.0 2008-04-26 05:49 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Tibia 2008-04-23 17:56 --------- d-----w C:\Program Files\JetAudio 2008-04-23 17:55 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\COWON 2008-04-23 05:38 --------- d-----w C:\Program Files\Java 2008-04-19 16:57 --------- d-----w C:\Program Files\BearShare 2008-04-19 10:25 --------- d-----w C:\Program Files\YouTube Video Downloader 2008-04-19 07:34 --------- d-----w C:\Documents and Settings\Patryk\Dane aplikacji\Winamp 2008-04-19 07:31 --------- d-----w C:\Program Files\Winamp Toolbar 2008-04-19 07:31 --------- d-----w C:\Program Files\Winamp Remote 2008-04-19 07:31 --------- d-----w C:\Program Files\Winamp 2008-04-19 07:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-04-19 07:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2008-04-15 13:09 --------- d-----w C:\Program Files\SystemRequirementsLab 2008-04-15 13:04 2,560 ----a-w C:\WINDOWS\system32\bitcometres.dll 2008-04-12 10:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier 2008-04-11 08:21 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-04-09 11:31 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-09 10:58 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-04-09 10:35 --------- d-----w C:\Program Files\Adobe Flash CS3 2008-04-09 07:59 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-04-09 07:42 --------- d-----w C:\Program Files\Total Commander 7.02a 2008-04-09 07:19 --------- d-----w C:\Program Files\Alcohol Soft 2008-04-09 07:16 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-04-08 17:24 --------- d-----w C:\Program Files\Dance6 2008-04-08 17:19 --------- d-----w C:\Program Files\Windows Media Components 2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-08 16:19 10,856 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-05 14:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll 2008-03-05 14:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll 2008-03-05 14:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll 2008-03-05 13:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll 2008-03-05 13:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll 2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-19 19:35 47,360 ----a-w C:\Documents and Settings\Patryk\Dane aplikacji\pcouffin.sys 2007-11-20 10:36 56 --sh--r C:\WINDOWS\system32\DF4995B7A9.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-03-03 14:44 266240] "Konnekt"="C:\Program Files\Konnekt\konnekt.exe" [2005-05-24 23:41 503808] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 11:21 16270848 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe] "JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-31 06:44 36864] "36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-11-17 03:05 1953792] "avast!"="C:\PROGRA~1\ALWILS~1\AVASTA~1\ashDisp.exe" [2008-05-16 01:19 79224] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-20 12:20 200704] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-05-23 10:04 1575680] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336] C:\Documents and Settings\Patryk\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 21:24:54 98632] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ D-Link AirPlus.lnk - C:\Program Files\D-Link AirPlus\AirPlus.exe [2007-05-26 16:48:26 262144] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax [HKLM\~\startupfolder\C:^Documents and Settings^Patryk^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\Patryk\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] C:\Program Files\BitTorrent\bittorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-03-12 22:43 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 12:04 2127296 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Konnekt\\konnekt.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "24920:TCP"= 24920:TCP:BitComet 24920 TCP "24920:UDP"= 24920:UDP:BitComet 24920 UDP R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 23:41] R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 23:41] R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 14:46] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-05-23 10:21] R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-05-23 10:21] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [] S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05] S3 Bcfilter;Jetico Personal Firewall Network Monitor;C:\WINDOWS\system32\DRIVERS\bcfilter.sys [] S3 BcfilterMP;BcfilterMP;C:\WINDOWS\system32\DRIVERS\bcfilter.sys [] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-05-24 17:11] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-29 14:50:55 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\guard32.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\guard32.dll . Completion time: 2008-05-29 14:51:52 ComboFix-quarantined-files.txt 2008-05-29 12:51:39 Pre-Run: 28,490,760,192 bajtów wolnych Post-Run: 28,478,513,152 bajtów wolnych 233 --- E O F --- 2008-05-29 01:01:04

I ostatni Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:55:34, on 2008-05-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\AvastAntywirus\aswUpdSv.exe C:\Program Files\Alwil Software\AvastAntywirus\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\AvastAntywirus\ashMaiSv.exe C:\Program Files\Alwil Software\AvastAntywirus\ashWebSv.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\ALWILS~1\AVASTA~1\ashDisp.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\COMODO\Firewall\cfp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazetawyborcza.pl/0,0.html?p=4 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\AVASTA~1\ashDisp.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{159105CC-1E64-4219-B98D-98374A5BE3E9}: NameServer = 10.10.2.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\AvastAntywirus\ashWebSv.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 8278 bytes

**Posty:** 8001 · przez **Okocza** 29 Maj 2008, 15:41

wykonaj to aby zoptymalizowac windowsa

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

to bedzie na tyle

mozesz zostawic - zawsze sie moze kiedys przydac

nie bedziesz musial pobierac

Autor postu otrzymał pochwałę

bardzo wolny internet i rozłączające się komunikatory

bardzo wolny internet i rozłączające się komunikatory

Kto jest na forum