głośna praca dysku, zwolniona praca laptopa

[Kufir]

Witam.
Od jakiegoś czasu zaobserwowałem znaczny spadek wydajności mojego laptopa, oraz dysk zaczął ewidentnie głośniej pracować. Defragmentowałem już dysk, sprawdzałem najnowszym Avastem, Adware i Spybootem ale nic nie pomogło.

Zamieszczam loga z Hijack'a:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:30:42, on 2008-07-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\VMSnap3.EXE
C:\WINDOWS\Domino.EXE
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Instalki\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [INPROCOMMWireless] C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{DEC8DD6B-EF9C-4963-8875-E96853FBA474}: NameServer = 213.199.204.3 213.199.204.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: winmfu32 - winmfu32.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5338 bytes

Log z programu Combofix:

ComboFix 08-07-23.4 - Ku 2008-07-24 10:41:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.578 [GMT 2:00]
Running from: C:\Documents and Settings\Ku\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\winhelp.ini

.
((((((((((((((((((((((((( Files Created from 2008-06-24 to 2008-07-24 )))))))))))))))))))))))))))))))
.

2008-07-23 11:24 . 2006-12-27 17:21 1,176 --a------ C:\WINDOWS\kaillera.ini
2008-07-22 14:41 . 2008-07-22 14:41 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\fltk.org
2008-07-21 23:14 . 2008-07-21 23:24 <DIR> d-------- C:\Program Files\Free_Video_Downloader
2008-07-21 20:46 . 2008-07-21 20:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-18 10:13 . 2008-07-18 10:40 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-15 08:28 . 2008-07-15 08:28 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\Leadertech
2008-07-12 08:50 . 2008-07-12 08:50 <DIR> d-------- C:\Program Files\VS Revo Group
2008-07-07 23:52 . 2008-07-07 23:52 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\GanymedeNet
2008-07-07 23:52 . 2008-07-07 23:52 4 --a------ C:\WINDOWS\system32\proc-1963933865.bin
2008-07-06 00:02 . 2008-07-06 00:02 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\Talkback
2008-07-05 16:33 . 2008-07-05 16:38 101 --a------ C:\WINDOWS\dukaacr.acr
2008-07-04 20:01 . 2008-07-23 11:33 <DIR> d-------- C:\Program Files\WFlip050
2008-07-01 17:49 . 1992-10-15 02:00 241,853 --a------ C:\WINDOWS\system\Pxengwin.dll
2008-07-01 17:49 . 1994-12-07 00:00 92,576 --a------ C:\WINDOWS\system\Odbcinst.dll
2008-07-01 17:49 . 1994-12-07 00:00 56,240 --a------ C:\WINDOWS\system\Odbc.dll
2008-07-01 17:49 . 1993-12-14 00:00 21,648 --a------ C:\WINDOWS\system\Ctl3dv2.dll
2008-07-01 17:48 . 2008-07-01 17:56 <DIR> d-------- C:\Program Files\stat
2008-06-30 13:04 . 1999-04-23 22:22 151,552 --a------ C:\WINDOWS\system32\MSOSS.DLL
2008-06-29 18:53 . 2008-06-29 18:53 <DIR> d-------- C:\Program Files\Codemasters

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 14:14 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-07-21 18:47 --------- d-----w C:\Program Files\Lavasoft
2008-07-21 18:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-07-21 08:09 --------- d-----w C:\Documents and Settings\Ku\Dane aplikacji\Skype
2008-07-21 07:47 --------- d-----w C:\Documents and Settings\Ku\Dane aplikacji\skypePM
2008-07-18 08:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-07-15 15:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 11:09 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2008-06-30 11:09 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2008-06-30 11:09 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2008-06-29 08:20 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 14:47 --------- d-----w C:\Program Files\MSXML 4.0
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 15:29 --------- d-----w C:\Documents and Settings\Ku\Dane aplikacji\Autodesk
2008-06-19 15:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Autodesk
2008-06-19 14:55 --------- d-----w C:\Program Files\AutoCAD 2007
2008-06-19 14:54 --------- d-----w C:\Program Files\AnswerWorks 4.0
2008-06-17 21:44 2,829 ----a-w C:\WINDOWS\DIIUnin.pif
2008-06-17 21:44 106,496 ----a-w C:\WINDOWS\DIIUnin.exe
2008-06-17 21:12 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-29 13:04 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-29 13:04 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-01-25 12:20 22,328 ----a-w C:\Documents and Settings\Ku\Dane aplikacji\PnkBstrK.sys
2007-12-26 08:56 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKHOTKEY"="C:\Program Files\ATK Hotkey\Hcontrol.exe" [2007-04-24 17:00 225280]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-16 23:08 861744]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-01-13 10:47 131072]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-01-13 10:47 163840]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-01-13 10:46 135168]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2005-09-29 03:49 176128]
"VMSnap3"="C:\WINDOWS\VMSnap3.EXE" [2006-08-30 04:58 49152]
"Domino"="C:\WINDOWS\Domino.EXE" [2006-06-28 11:54 49152]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Kerio\\Personal Firewall\\PERSFW.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Gry\\Dungeon Siege\\DungeonSiege.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Gry\\Dungeon Siege\\DSLOA.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Gry\\Quake III Arena\\quake3.exe"=
"C:\\Gry\\Quake III Arena\\The All-Seeing Eye\\eye.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23844:TCP"= 23844:TCP:BitComet 23844 TCP
"23844:UDP"= 23844:UDP:BitComet 23844 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys [2002-04-15 13:28]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-03 01:09]
S3 vmfilter303;vmfilter303;C:\WINDOWS\system32\drivers\vmfilter303.sys [2006-04-25 04:57]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-WinampAgent - C:\Program Files\Winamp\winampa.exe
HKLM-Run-INPROCOMMWireless - C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe
HKLM-Run-BigDog303 - C:\WINDOWS\VM303_STI.EXE


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://google.bearshare.com/pl/
O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{DEC8DD6B-EF9C-4963-8875-E96853FBA474}: NameServer = 213.199.204.3 213.199.204.5


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-24 10:43:16
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog303 = C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)????????????????0?????????@??????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-24 10:44:25
ComboFix-quarantined-files.txt 2008-07-24 08:44:11

Pre-Run: 3,691,892,736 bajtów wolnych
Post-Run: 4,408,516,608 bajtów wolnych

143 --- E O F --- 2008-07-10 20:28:39

Proszę o pomoc.Dziękuje

[Okocza]

Logi są czyste.

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[Kufir]

Log z SDfix'a:

SDFix: Version 1.208
Run by Ku on 2008-07-24 at 11:36

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\Documents and Settings\Ku\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com\settings.sol - Deleted



Folder C:\Documents and Settings\Ku\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-24 11:44:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000004a

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\Kerio\\Personal Firewall\\PERSFW.exe"="C:\\Program Files\\Kerio\\Personal Firewall\\PERSFW.exe:*:Enabled:Kerio Personal Firewall Engine"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Gry\\Dungeon Siege\\DungeonSiege.exe"="C:\\Gry\\Dungeon Siege\\DungeonSiege.exe:*:Enabled:Dungeon Siege Game Executable"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\\Gry\\Dungeon Siege\\DSLOA.exe"="C:\\Gry\\Dungeon Siege\\DSLOA.exe:*:Enabled:Dungeon Siege: Legends of Aranna Game Executable"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Gry\\Quake III Arena\\quake3.exe"="C:\\Gry\\Quake III Arena\\quake3.exe:*:Enabled:quake3"
"C:\\Gry\\Quake III Arena\\The All-Seeing Eye\\eye.exe"="C:\\Gry\\Quake III Arena\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :


File Backups: - C:\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 20 Jul 2001 4,939,776 A..H. --- "C:\Gry\Max Payne\mp.exe"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\05030212059e1b9876d47b8cf2fa5e95\BIT1.tmp"
Fri 20 Jun 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT4.tmp"

Finished!

Log z Hijack'a:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:23, on 2008-07-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\VMSnap3.EXE
C:\WINDOWS\Domino.EXE
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Instalki\Ochrona\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{DEC8DD6B-EF9C-4963-8875-E96853FBA474}: NameServer = 213.199.204.3 213.199.204.5
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5440 bytes

Logi z ComboFix'a:

ComboFix 08-07-23.4 - Ku 2008-07-24 11:50:11.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.600 [GMT 2:00]
Running from: C:\Instalki\Ochrona\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-24 to 2008-07-24 )))))))))))))))))))))))))))))))
.

2008-07-24 11:33 . 2008-07-24 11:33 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-24 11:32 . 2008-07-24 11:32 <DIR> d-------- C:\SDFix
2008-07-24 11:31 . 2008-07-24 11:31 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-23 11:24 . 2006-12-27 17:21 1,176 --a------ C:\WINDOWS\kaillera.ini
2008-07-22 14:41 . 2008-07-22 14:41 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\fltk.org
2008-07-21 23:14 . 2008-07-21 23:24 <DIR> d-------- C:\Program Files\Free_Video_Downloader
2008-07-21 20:46 . 2008-07-21 20:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-18 10:13 . 2008-07-18 10:40 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-15 08:28 . 2008-07-15 08:28 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\Leadertech
2008-07-12 08:50 . 2008-07-12 08:50 <DIR> d-------- C:\Program Files\VS Revo Group
2008-07-07 23:52 . 2008-07-07 23:52 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\GanymedeNet
2008-07-07 23:52 . 2008-07-07 23:52 4 --a------ C:\WINDOWS\system32\proc-1963933865.bin
2008-07-06 00:02 . 2008-07-06 00:02 <DIR> d-------- C:\Documents and Settings\Ku\Dane aplikacji\Talkback
2008-07-05 16:33 . 2008-07-05 16:38 101 --a------ C:\WINDOWS\dukaacr.acr
2008-07-04 20:01 . 2008-07-23 11:33 <DIR> d-------- C:\Program Files\WFlip050
2008-07-01 17:49 . 1992-10-15 02:00 241,853 --a------ C:\WINDOWS\system\Pxengwin.dll
2008-07-01 17:49 . 1994-12-07 00:00 92,576 --a------ C:\WINDOWS\system\Odbcinst.dll
2008-07-01 17:49 . 1994-12-07 00:00 56,240 --a------ C:\WINDOWS\system\Odbc.dll
2008-07-01 17:49 . 1993-12-14 00:00 21,648 --a------ C:\WINDOWS\system\Ctl3dv2.dll
2008-07-01 17:48 . 2008-07-01 17:56 <DIR> d-------- C:\Program Files\stat
2008-06-30 13:04 . 1999-04-23 22:22 151,552 --a------ C:\WINDOWS\system32\MSOSS.DLL
2008-06-29 18:53 . 2008-06-29 18:53 <DIR> d-------- C:\Program Files\Codemasters

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 14:14 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-07-21 18:47 --------- d-----w C:\Program Files\Lavasoft
2008-07-21 18:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-07-21 08:09 --------- d-----w C:\Documents and Settings\Ku\Dane aplikacji\Skype
2008-07-21 07:47 --------- d-----w C:\Documents and Settings\Ku\Dane aplikacji\skypePM
2008-07-18 08:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-07-15 15:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-30 11:09 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2008-06-30 11:09 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2008-06-30 11:09 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2008-06-29 08:20 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 14:47 --------- d-----w C:\Program Files\MSXML 4.0
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 15:29 --------- d-----w C:\Documents and Settings\Ku\Dane aplikacji\Autodesk
2008-06-19 15:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Autodesk
2008-06-19 14:55 --------- d-----w C:\Program Files\AutoCAD 2007
2008-06-19 14:54 --------- d-----w C:\Program Files\AnswerWorks 4.0
2008-06-17 21:44 2,829 ----a-w C:\WINDOWS\DIIUnin.pif
2008-06-17 21:44 106,496 ----a-w C:\WINDOWS\DIIUnin.exe
2008-06-17 21:12 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-06-14 18:01 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-29 13:04 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-29 13:04 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-01-25 12:20 22,328 ----a-w C:\Documents and Settings\Ku\Dane aplikacji\PnkBstrK.sys
2007-12-26 08:56 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2008-07-24_10.44.01.98 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-23 23:25:41 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-07-24 09:34:05 8,511,488 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2008-07-24 09:34:06 249,856 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-07-23 23:25:41 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-07-24 09:33:46 8,511,488 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2008-07-24 09:33:47 249,856 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2008-07-24 09:43:17 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_590.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKHOTKEY"="C:\Program Files\ATK Hotkey\Hcontrol.exe" [2007-04-24 17:00 225280]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-16 23:08 861744]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-01-13 10:47 131072]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-01-13 10:47 163840]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-01-13 10:46 135168]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2005-09-29 03:49 176128]
"VMSnap3"="C:\WINDOWS\VMSnap3.EXE" [2006-08-30 04:58 49152]
"Domino"="C:\WINDOWS\Domino.EXE" [2006-06-28 11:54 49152]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Kerio\\Personal Firewall\\PERSFW.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Gry\\Dungeon Siege\\DungeonSiege.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Gry\\Dungeon Siege\\DSLOA.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Gry\\Quake III Arena\\quake3.exe"=
"C:\\Gry\\Quake III Arena\\The All-Seeing Eye\\eye.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23844:TCP"= 23844:TCP:BitComet 23844 TCP
"23844:UDP"= 23844:UDP:BitComet 23844 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys [2002-04-15 13:28]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-03 01:09]
S3 vmfilter303;vmfilter303;C:\WINDOWS\system32\drivers\vmfilter303.sys [2006-04-25 04:57]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://google.bearshare.com/pl/
O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{DEC8DD6B-EF9C-4963-8875-E96853FBA474}: NameServer = 213.199.204.3 213.199.204.5


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-24 11:50:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-24 11:51:56
ComboFix-quarantined-files.txt 2008-07-24 09:51:51
ComboFix2.txt 2008-07-24 08:44:26

Pre-Run: 4,213,157,888 bajtów wolnych
Post-Run: 4,203,872,256 bajtów wolnych

143 --- E O F --- 2008-07-10 20:28:39

[Okocza]

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

[Kufir]

Screen:




Log z FixIEDef:

********************************************************************************
* *
* FixIEDef Log *
* Version 1.5.2.6023 *
* *
********************************************************************************

Created at 12:11:33 on Thursday, July 24, 2008

Time Zone :

Logged On User : Ku

Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2
OS Version : 5.1.2600
System Langauge : Polish
Keyboard Layout : Polish
Processor : X86 Procesor Intel Pentium II

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

Total Physical Memory : 1039664 KB
Free Physical Memory : 638612 KB
Total Virtual Memory : 2097024 KB
Free Virtual Memory : 2020576 KB

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

No malicious files found

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

No malicious directories to be removed

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

No malicious Registry entries found

================================================================================

All Done

ShadowPuterDude

Safe Surfing!!!

[Okocza]

wyłącz nero

to będzie na tyle jesli nie pomoglo - przyczyny szukaj raczej w hardware niz w wirusach itp

Autor postu otrzymał pochwałę

[Kufir]

Wielkie dzięki, laptop wyraźnie dostał wiatru w żagle Co prawda dysk ciągle jeszcze jest słyszalny ale to pewnie dlatego iż ze 160 GB jest wolne tylko około 20GB.

Czy będę mógł niebawem z tego samego konta prosić o sprawdzenie komputera dziewczyny? Jej laptop niestety bardziej niż mój "muli" ...


Raz jeszcze dziękuje!