Witam.
Od dłuższego czasu internet mój chodzi o wiele wolniej, niż powinien. Usługodawca przełączał mnie na inne łącze, by naprawić problem. To jednak nie pomogło. Dodam, że gdy koleżanka zrobiła format dysku, jej internet wrócił do normalnego stanu. (Nie było to w tym samym czasie)
Log z HiJack:
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:57:36, on 2008-09-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Wirelwss LAN Utility\tiwlnsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TI WLAN] C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O8 - Extra context menu item: Open With JPEGCompress - res://C:\Program Files\JPEGCompress\owjc.dll/CONTEXT_HANDLE.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/cabs/A18X.ocx
O16 - DPF: {987ECFCE-E607-4D52-B2C5-2EA1F6F303C4} (WinlessActiveX Control) - http://www.pangya.com/PangyaLauncher/PangyaLauncher.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS5\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS6\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS7\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS8\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS9\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS10\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS11\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS12\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS13\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS14\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS15\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS16\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS17\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS18\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS19\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS20\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS21\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS22\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS23\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS24\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS25\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS26\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS27\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS28\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS29\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS30\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS31\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O17 - HKLM\System\CS32\Services\Tcpip\..\{3AACE663-041D-4B35-9B29-C4F8D4BF7058}: NameServer = 192.168.0.99,194.204.159.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: TI Wlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\Wirelwss LAN Utility\tiwlnsvc.exe
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
--
End of file - 10299 bytes
Log z Combofix'a:
- Kod: Zaznacz wszystko
ComboFix 08-09-13.03 - Dobre 2008-09-13 22:29:31.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.429 [GMT 2:00]
Uruchomiony z: C:\Documents and Settings\Dobre\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
[color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\rtl60.bpl
C:\WINDOWS\temp\perflib_perfdata_1cc.dat
.
((((((((((((((((((((((((( Pliki utworzone od 2008-08-13 do 2008-09-13 )))))))))))))))))))))))))))))))
.
2008-08-26 23:01 . 2008-08-26 23:02 <DIR> d-------- C:\Program Files\AMP Font Viewer
2008-08-26 06:51 . 2008-08-26 06:51 <DIR> d-------- C:\Program Files\Applications
2008-08-20 16:54 . 2008-08-20 16:54 <DIR> d-------- C:\Program Files\Robster Productions
2008-08-18 16:45 . 2008-08-18 16:45 <DIR> d-------- C:\Program Files\A4Tech
2008-08-18 16:34 . 2008-09-06 19:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-18 16:34 . 2008-08-18 16:34 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-18 01:12 . 2008-05-01 16:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-18 01:12 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-08-18 01:12 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-18 01:12 . 2006-08-16 13:59 100,352 -----c--- C:\WINDOWS\system32\dllcache\6to4svc.dll
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-13 20:31 --------- d-----w C:\Program Files\cFosSpeed
2008-09-13 19:52 --------- d-----w C:\Program Files\Real Alternative
2008-09-13 19:49 --------- d-----w C:\Program Files\mIRC
2008-09-13 10:48 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\foobar2000
2008-09-11 12:54 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Skype
2008-09-10 08:28 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\OpenOffice.org2
2008-09-08 19:32 --------- d-----w C:\Documents and Settings\Dobre\Dane aplikacji\Tlen.pl
2008-09-04 14:26 --------- d-----w C:\Program Files\Steam
2008-08-07 09:29 --------- d-----w C:\Program Files\HP
2008-08-07 09:28 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-08-07 09:19 --------- d-----w C:\Program Files\Common Files\HP
2008-08-03 16:31 --------- d-----w C:\Documents and Settings\domowy\Dane aplikacji\Skype
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2006-07-05 15:07 81,920 ----a-w C:\Documents and Settings\Dobre\index.dat
2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.
[code]<pre>
----a-w 190,976 2005-04-26 11:08:40 C:\Documents and Settings\Dobre\Pulpit\Dawid\ZDJĘCIA\WSZYSTKO\KeyGen Adobe Photoshop CS2 9.0.1 .exe
</pre>[/code]
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 344064]
"TI WLAN"="C:\Program Files\Wirelwss LAN Utility\TIWLANCu.exe" [2004-12-09 1150976]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]
C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 00:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"VIDC.XFR1"= xfcodec.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Bitmeter2.lnk]
backup=C:\WINDOWS\pss\Bitmeter2.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DoubleDesktop.lnk]
backup=C:\WINDOWS\pss\DoubleDesktop.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk]
backup=C:\WINDOWS\pss\OpenOffice.org 2.2.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5 - Hammers of Fate.LNKStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK]
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK
backup=C:\WINDOWS\pss\Registration Heroes of Might & Magic 5.LNKStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Dobre^Menu Start^Programy^Autostart^Xfire.lnk]
backup=C:\WINDOWS\pss\Xfire.lnkStartup
path=C:\Documents and Settings\Dobre\Menu Start\Programy\Autostart\Xfire.lnk
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccdajfun
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JustVoip
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-03-20 18:39 216520 C:\Program Files\Alcohol Soft\Alcohol 52\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
--a------ 2008-07-19 16:38 78008 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoostSpeed]
--a------ 2007-11-22 14:44 2016256 C:\Program Files\AusLogics BoostSpeed\boostspeed.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]
-ra------ 2008-02-12 15:16 863448 C:\Program Files\cFosSpeed\cfosspeed.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-08-04 17:28 49152 C:\Program Files\HP\HP Software Update\hpwuSchd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
--a------ 2007-02-12 12:01 1149440 C:\Program Files\Tlen.pl\tlen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-09-19 21:48 455968 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 15:57 282624 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-07-13 18:55 22234920 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
--a------ 2005-09-05 15:55 339968 C:\WINDOWS\vsnpstd3.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2006-11-24 02:06 487424 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-08-07 20:36 1271032 c:\Program Files\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3.exe"=
"D:\\Program Files\\Id\\Quake3\\quake3e.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Tlen.pl\\tlen.exe"=
"C:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"D:\\Program Files\\Quake3\\quake3.exe"=
"D:\\Program Files\\3DO\\Heroes3\\h3blade.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Icewind Dale II\\IWD2.exe"=
"D:\\Program Files\\OGPlanet\\Albatross18\\update.exe"=
"D:\\Program Files\\Metin2.us\\metin2.bin"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"D:\\Program Files\\Heroes of Might and Magic V\\bina1\\H5_Game.exe"=
"C:\\Program Files\\Steam\\steamapps\\moongrave\\counter-strike\\hl.exe"=
"D:\\Program Files\\Games-Masters.com\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:D:\\Program Files\\StarCraft Brood War by Monikon\\starcraft.exe
"6112:UDP"= 6112:UDP:starcraft.exe
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 ntiowp;ntiowp;C:\WINDOWS\system32\drivers\ntiowp.sys [2006-10-20 12352]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824]
R3 TNET1130;802.11 WLAN;C:\WINDOWS\system32\DRIVERS\TNET1130.sys [2004-12-01 438912]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 58288]
S3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [ ]
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [ ]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\Dobre\Dane aplikacji\Mozilla\Firefox\Profiles\r4f96bk4.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - C:\Documents and Settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 22:31:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2008-09-13 22:33:17
ComboFix-quarantined-files.txt 2008-09-13 20:33:13
ComboFix2.txt 2008-04-11 11:33:36
ComboFix3.txt 2008-04-01 09:31:04
ComboFix4.txt 2008-03-31 19:45:43
ComboFix5.txt 2008-09-13 20:28:38
Przed: 2,005,254,144 bajt˘w wolnych
Po: 2,475,016,192 bajt˘w wolnych
220 --- E O F --- 2008-08-22 19:15:03
Oraz jeszcze jedno pytanie...
Podczas skanowania SDFix'em wykryło mi wirusy, których wcześniej na oczy nie widziałem. Niektóre z nich siedzą w folderze systemowych, innych nie da się usunąć...
Jak temu zaradzić?
- Kod: Zaznacz wszystko
a-squared Command Line Scanner - Version 4.0
Last update: N/A
Scan settings:
Objects: Memory, Traces, Cookies, C:
Scan archives: On
Heuristics: Off
ADS Scan: On
Scan start: 2008-09-13 21:29:02
Value: HKEY_USERS\domowy\Software\Microsoft\Windows\CurrentVersion\Run --> Ultimate Defender detected: Trace.Registry.Ultimate Defender
Value: HKEY_USERS\domowy\software\microsoft\windows\currentversion\run --> quicktime task detected: Trace.Registry.CWS.QTTasks
Value: HKEY_USERS\domowy\Software\DriveCleaner 2006 Free --> AutoScanId detected: Trace.Registry.DriveCleaner 2006
Key: HKEY_USERS\domowy\software\everad detected: Trace.Registry.EverAd
Key: HKEY_CURRENT_USER\software\kazaa detected: Trace.Registry.KaZaA
C:\Documents and Settings\Dobre\Cookies\dobre@spylog[1].txt detected: Trace.TrackingCookie.spylog
C:\Documents and Settings\domowy\Cookies\domowy@tradedoubler[1].txt detected: Trace.TrackingCookie.tradedoubler
C:\Documents and Settings\domowy\Pulpit\WinRAR\WinRAR.exe detected: Worm.Win32.Anilogo.b
C:\Program Files\mIRC\mirc.exe detected: Riskware.Client-IRC.Win32.mIRC.62
C:\Program Files\Real Alternative\realmedia_browser_plugin.exe detected: Worm.Win32.Otwycal.k
C:\Program Files\WinRAR\WinRAR.exe detected: Worm.Win32.Anilogo.b
C:\SDFix\apps\Process.exe detected: Riskware.RiskTool.Win32.Processor.20
C:\WINDOWS\system32\Process.exe detected: Riskware.RiskTool.Win32.Processor.20
Scanned
Files: 63027
Traces: 357645
Cookies: 125
Processes: 38
Found
Files: 6
Traces: 5
Cookies: 2
Processes: 0
Quarantined
Files: 6
Traces: 5
Cookies: 2
Processes: 0
Scan end: 2008-09-13 22:05:16
Scan time: 0:36:14
