Dziwne procesy [logi]

**Posty:** 332 · przez **Pytoo** 05 Paź 2008, 10:30

Witam od kilku dni mam problem gdyż widzę procesy których sam nie znam a obciążają mi one kompa... do tego mam podejrzenia co do lsass.exe. wiem że ten proces może być zły i dobry.... proszę o sprawdzenie czy wszystko gra.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 10:27, on 2008-10-05 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\svchost.exe C:\WINDOWS\system32\ctfmon.exe D:\program files\valve\steam\steam.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\sciaganie z neo\hijackthis.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [svchost] C:\WINDOWS\svchost.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} - http://67.15.101.3/g_bin/pl/darts_2_0_0_35.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) - O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} - http://67.15.101.3/g_bin/pl/soccer_2_0_0_14.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxbtcoms.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

**Posty:** 684 · przez **djarta** 05 Paź 2008, 11:31

C:\WINDOWS\svchost.exe

Daj log z ComboFixa.

===========================
K.

**Posty:** 332 · przez **Pytoo** 05 Paź 2008, 12:08

Proszę bardzo

Kod: Zaznacz wszystko: ComboFix 08-10-04.07 - Bartek 2008-10-05 11:55:16.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.241 [GMT 2:00] Uruchomiony z: D:\sciaganie z neo\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\History\search C:\WINDOWS\svchost.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WIN32SR ((((((((((((((((((((((((( Pliki utworzone od 2008-09-05 do 2008-10-05 ))))))))))))))))))))))))))))))) . 2008-10-02 22:49 . 2008-10-02 22:49 <DIR> d-------- C:\Documents and Settings\Bartek\Dane aplikacji\Apple Computer 2008-10-02 22:48 . 2008-10-02 22:48 <DIR> d-------- C:\Program Files\iTunes 2008-10-02 22:48 . 2008-10-02 22:48 <DIR> d-------- C:\Program Files\iPod 2008-10-02 22:48 . 2008-10-02 22:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-02 22:48 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll 2008-10-02 22:48 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys 2008-10-02 22:47 . 2008-10-02 22:47 <DIR> d-------- C:\Program Files\Bonjour 2008-10-02 22:46 . 2008-10-02 22:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-10-02 22:45 . 2008-10-02 22:45 <DIR> d-------- C:\Program Files\Apple Software Update 2008-10-02 22:44 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-10-02 22:44 . 2008-10-02 22:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-09-28 20:30 . 2008-09-28 20:30 1,042,610 --a------ C:\mucha.wmv 2008-09-28 20:13 . 2008-09-28 20:27 <DIR> d-------- C:\3gp 2008-09-28 20:12 . 2008-09-28 20:12 <DIR> d-------- C:\Program Files\Xilisoft 2008-09-28 20:12 . 2008-10-02 22:46 <DIR> d-------- C:\Program Files\QuickTime 2008-09-21 19:48 . 1997-06-14 11:26 621,144 --a------ C:\WINDOWS\system32\Winu.tlb 2008-09-21 19:48 . 1998-06-09 00:00 137,216 --a------ C:\WINDOWS\system32\MSDERUN.DLL 2008-09-21 19:48 . 1998-06-24 00:00 108,336 --a------ C:\WINDOWS\system32\Mvdata.mdv 2008-09-21 19:48 . 1998-06-24 00:00 108,336 --a------ C:\WINDOWS\MSWINSCK.OCX 2008-09-21 19:48 . 2008-04-13 22:56 61,440 --a------ C:\WINDOWS\system32\msado20.tlb 2008-09-21 19:48 . 2008-08-22 17:12 28,672 --a------ C:\WINDOWS\system32\Svdata.mdv 2008-09-15 17:09 . 2008-09-15 17:09 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-09-15 17:08 . 2008-09-15 17:08 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-09-15 17:08 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-09-15 16:40 . 2008-09-15 16:40 <DIR> d-------- C:\Program Files\TibiaTek Bot Development Team 2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx 2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts 2008-09-05 19:40 . 2007-11-02 10:15 117 --a------ C:\main.cpp 2008-09-05 19:39 . 2008-09-05 20:04 <DIR> d-------- C:\Documents and Settings\Bartek\Dane aplikacji\codeblocks 2008-09-05 19:18 . 2008-09-05 19:18 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-09-05 19:16 . 2008-09-05 19:25 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-09-05 19:00 . 2008-09-05 19:20 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-09-05 19:00 . 2008-09-05 19:03 <DIR> d-------- C:\Program Files\Common Files\Merge Modules . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-04 22:50 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\Skype 2008-10-04 22:04 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\skypePM 2008-10-04 14:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic 2008-10-03 13:41 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-09-28 12:57 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\Tibia 2008-09-15 18:22 --------- d-----w C:\Program Files\Kliper 2008-09-14 16:20 --------- d-----w C:\Program Files\SopCast 2008-09-13 18:09 --------- d-----w C:\Program Files\Tibia Player by TORG 2008-09-10 17:05 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\teamspeak2 2008-09-05 17:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-04 14:28 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-29 15:54 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-27 11:17 --------- d-----w C:\Program Files\Gpotato 2008-08-25 18:46 --------- d-----w C:\Program Files\Applications 2008-08-16 18:03 --------- d-----w C:\Program Files\Java 2008-08-15 11:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads 2008-08-09 22:46 --------- d-----w C:\Documents and Settings\Bartek\Dane aplikacji\Hamachi 2008-08-08 20:37 --------- d-----w C:\Program Files\Microsoft Games 2008-08-08 07:53 --------- d-----w C:\Program Files\TibiaTek Bot DevTeam 2008-08-06 10:31 --------- d-----w C:\Program Files\ivo 2007-12-05 15:58 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2006-07-21 17:30 90,396 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\firstlsp.reg.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "Steam"="d:\program files\valve\steam\steam.exe" [2008-06-26 1271032] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 2111176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-07-12 4112384] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-07-12 81920] "LXBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2004-02-23 61440] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-08-04 266497] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 171520] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360] C:\Documents and Settings\Bartek\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-07-31 839680] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.X264"= x264vfw.dll "msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm "vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll "vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm "msacm.iac2"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iac25_32.ax [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2007-04-04 00:29 165784 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer] --a------ 2004-02-04 16:33 294912 C:\Program Files\Lexmark Fax Solutions\fm3032.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-09-10 17:40 289576 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 5200 series] --a------ 2004-02-24 19:15 57344 C:\Program Files\Lexmark 5200 Series\lxbtbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2008-04-14 22:51 1695232 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-09-06 15:09 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-11-16 13:39 21760296 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\pytoo\\counter-strike\\hl.exe"= "D:\\Counter-Strike 1.6 Patch Version 26\\hlds.exe"= "D:\\Counter-Strike 1.6 Patch Version 26\\hl.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "D:\\Program Files\\FlashGet\\FLASHGET.EXE"= "D:\\Program Files\\Valve\\Steam\\SteamApps\\PYTOO\\dedicated server\\hlds.exe"= "D:\\Program Files\\BitComet\\BitComet.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Documents and Settings\\Bartek\\Pulpit\\TibiaTek Bot Development Team\\TibiaTek Bot\\TibiaTekBot.exe"= "C:\\Program Files\\TibiaTek Bot Development Team\\TibiaTek Bot\\TibiaTekBot.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= S1 NetPT;NetBIOS Protection;C:\WINDOWS\system32\DRIVERS\netpt.sys [ ] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 64000] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 116992] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368] . Zawartość folderu 'Zaplanowane zadania' 2008-10-02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\ag5bj8dy.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - wp.pl FF -: plugin - C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nppl3260.dll FF -: plugin - C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nprpjplug.dll FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPBILLARD8.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npmozax.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPSNOOKER.dll FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-05 12:00:23 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-10-05 12:04:57 - komputer został uruchomiony ponownie [Bartek] ComboFix-quarantined-files.txt 2008-10-05 10:04:50 Przed: 4,435,537,920 bajtów wolnych Po: 4,552,806,400 bajtów wolnych 204

**Posty:** 8001 · przez **Okocza** 05 Paź 2008, 12:10

Pytoo, popraw nazwę tematu

**Posty:** 18165 · przez **wojtas** 05 Paź 2008, 17:47

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 332 · przez **Pytoo** 07 Paź 2008, 19:41

Kod: Zaznacz wszystko: Proszę czekać na zakończenie aktualizacji definicji wirusów... Wystąpił nieznany błąd podczas sprawdzania licencji dla produktu Kaspersky Online Scanner.

zrobiłem wszystko ale kasperski odmawia posługi:(

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6194 * * * ******************************************************************************** Created at 19:42:57 on Tuesday, October 07, 2008 Time Zone : Logged On User : Bartek Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Celeron(R) CPU 2.66GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 5.47 GB Total Physical Memory: 511 MB Free Physical Memory : 282 MB Total Page File : 511 MB Free Page File : 1685 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1969 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\actskn45.ocx -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!