komputer zamula

**Posty:** 13 · przez **murek007** 06 Kwi 2008, 11:09

MAm taki problem, ze jak wlanczam komputer to zamula i musze czekać pare min, wczesniej tak niebyło, log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:09:05, on 2008-04-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\Trend Micro\HijackThis\HijackThis.com.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [DNSUpdate] C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe O4 - HKCU\..\Run: [AbyssWebServer] D:\AbyssWebServer\abyssws.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2A105938-3415-4A42-A76E-69EC412A4FD7}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{2A105938-3415-4A42-A76E-69EC412A4FD7}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Apache - Unknown owner - C:\AppServ\Apache\Apache.exe (file missing) O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 7371 bytes

**Posty:** 8001 · przez **Okocza** 06 Kwi 2008, 11:49

daj loga z combofixa

**Posty:** 13 · przez **murek007** 06 Kwi 2008, 12:05

Kod: Zaznacz wszystko: ComboFix 08-04-04.1 - Tornado 2008-04-06 11:59:01.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.285 [GMT 2:00] Running from: E:\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-06 to 2008-04-06 ))))))))))))))))))))))))))))))) . 2008-04-05 18:51 . 2008-04-05 18:52 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-04-05 16:02 . 2008-04-05 16:02 29 --a------ C:\WINDOWS\Memory test.cfg 2008-04-05 13:12 . 2008-04-05 13:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-04-02 13:50 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys 2008-04-02 13:50 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys 2008-04-01 17:01 . 2008-04-01 17:15 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-30 18:21 . 2008-03-30 18:21 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-03-30 18:21 . 2008-04-05 22:09 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-03-30 18:21 . 2008-03-30 18:21 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-03-30 18:21 . 2008-04-05 22:10 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-03-30 15:42 . 2008-03-30 15:42 280 --a------ C:\WINDOWS\game.ini 2008-03-30 15:35 . 2008-03-30 15:35 <DIR> d-------- C:\Program Files\Activision 2008-03-29 09:43 . 2008-03-29 09:43 <DIR> d-------- C:\Program Files\DVRviewer 2008-03-29 09:43 . 2008-04-06 10:37 0 --a------ C:\adv1.err 2008-03-23 14:18 . 2008-03-23 14:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-03-23 14:12 . 2008-03-23 14:44 495 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-03-23 14:10 . 2008-03-23 14:49 <DIR> d-------- C:\SDFix 2008-03-22 23:09 . 2008-03-22 23:18 <DIR> d-------- C:\Program Files\True Sword 4 2008-03-22 23:09 . 2008-03-22 23:09 <DIR> d-------- C:\Documents and Settings\Tornado\Dane aplikacji\True Sword 2008-03-22 22:03 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-03-22 22:03 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-03-22 22:03 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-03-22 22:03 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-03-22 22:03 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-03-22 22:03 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-03-22 22:02 . 2008-03-22 22:02 <DIR> d-------- C:\Program Files\Alwil Software 2008-03-22 22:02 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-03-22 22:02 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-03-21 15:37 . 2008-03-21 15:37 <DIR> d-------- C:\Program Files\Shareaza 2008-03-21 15:37 . 2008-03-21 15:37 <DIR> d-------- C:\Documents and Settings\Tornado\Dane aplikacji\Shareaza 2008-03-20 21:01 . 2008-03-20 21:01 <DIR> d-------- C:\Program Files\Pocket Tanks 2008-03-20 20:22 . 2008-03-20 20:22 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-03-20 16:51 . 2008-03-20 16:51 <DIR> d-------- C:\Program Files\Tasker 2008-03-16 21:30 . 2008-03-16 21:30 <DIR> d-------- C:\Program Files\Real Alternative 2008-03-16 21:30 . 2008-03-16 21:30 <DIR> d-------- C:\Documents and Settings\Tornado\Dane aplikacji\Media Player Classic 2008-03-12 21:57 . 2008-03-12 21:57 <DIR> d-------- C:\Program Files\Kerio 2008-03-11 20:09 . 2008-03-18 17:44 754 --a------ C:\WINDOWS\WORDPAD.INI 2008-03-09 16:23 . 2000-05-26 01:08 1,064,456 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-03-09 16:23 . 2000-08-06 02:51 274,489 --a------ C:\WINDOWS\system32\ntwdblib.dll 2008-03-09 16:23 . 2000-07-07 13:20 81,920 --a------ C:\WINDOWS\system32\mdt2fw95.dll 2008-03-09 16:23 . 2000-08-06 02:50 36,939 --a------ C:\WINDOWS\system32\insrepim.exe 2008-03-09 16:23 . 2000-08-06 02:51 28,734 --a------ C:\WINDOWS\system32\dbmslpcn.dll 2008-03-09 16:19 . 2008-03-09 16:20 <DIR> d-------- C:\WINDOWS\Cluster . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-06 08:23 --------- d-----w C:\Program Files\Neostrada TP 2008-04-05 16:51 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-05 14:30 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\MegauploadToolbar 2008-04-05 06:45 --------- d-----w C:\Program Files\FlashGet 2008-04-05 06:31 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\Winamp 2008-04-02 14:49 --------- d-----w C:\Program Files\MoorHunt 2008-03-30 13:42 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-04 16:56 --------- d-----w C:\Program Files\QuickTime 2008-03-03 15:46 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\Ahead 2008-02-27 19:32 --------- d-----w C:\Program Files\MarBit 2008-02-25 14:34 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\Megaupload 2008-02-25 14:33 --------- d-----w C:\Program Files\MegauploadToolbar 2008-02-19 22:03 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\VoipDiscount 2008-02-17 10:14 --------- d-----w C:\Program Files\VoipDiscount.com 2008-02-11 19:18 --------- d-----w C:\Program Files\Replay Converter 2008-02-11 09:58 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-02-11 09:56 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\GetRightToGo 2008-02-11 08:37 --------- d-----w C:\Program Files\AVI GIF Converter 2008-02-08 13:13 --------- d-----w C:\Program Files\Opera 2008-02-08 11:52 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\InstallShield 2008-02-07 19:14 --------- d-----w C:\Program Files\Winamp 2008-02-07 19:12 --------- d-----w C:\Program Files\Google 2008-02-07 19:12 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\Gadu-Gadu 2008-02-07 19:10 --------- d-----w C:\Program Files\Gadu-Gadu 2008-02-07 19:02 --------- d-----w C:\Documents and Settings\Tornado\Dane aplikacji\Talkback 2008-02-07 18:49 --------- d-----w C:\Program Files\Thomson 2008-02-07 18:48 --------- d-----w C:\Program Files\Java Web Start 2008-02-07 18:48 --------- d-----w C:\Program Files\Java 2008-02-07 18:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-02-07 18:41 --------- d-----w C:\Program Files\CyberLink 2008-02-07 18:41 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2008-02-07 18:34 --------- d-----w C:\Program Files\Ahead 2008-02-07 18:32 --------- d-----w C:\Program Files\Common Files\Ahead 2008-02-07 18:27 --------- d-----w C:\Program Files\VIA 2008-02-07 18:26 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-02-07 18:26 --------- d-----w C:\Program Files\Gigabyte 2008-02-07 18:26 --------- d-----w C:\Program Files\AvRack 2008-02-07 18:18 --------- d-----w C:\Program Files\microsoft frontpage 2008-02-07 18:16 --------- d-----w C:\Program Files\Usługi online 2008-01-22 20:44 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-01-22 20:43 272,384 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-01-22 20:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-01-22 20:36 9,949,184 ----a-w C:\WINDOWS\system32\atioglx2.dll 2008-01-22 20:35 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-01-22 20:35 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-01-22 20:35 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-01-22 20:35 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-01-22 20:35 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-01-22 20:34 512,000 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-01-22 20:33 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-01-22 20:25 3,121,920 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-01-22 20:14 1,664,256 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-01-22 20:04 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-01-22 20:01 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-01-22 19:59 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-01-22 19:58 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-01-22 19:57 163,840 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-01-22 19:53 503,808 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-01-22 13:42 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe . ((((((((((((((((((((((((((((( snapshot_2008-04-01_17.20.51,96 ))))))))))))))))))))))))))))))))))))))))) . - 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2000-08-31 06:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe + 2000-08-31 06:00:00 80,412 ----a-w C:\WINDOWS\grep.exe + 2000-08-31 06:00:00 98,816 ----a-w C:\WINDOWS\sed.exe + 2000-08-31 06:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe + 2000-08-31 06:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe + 2000-08-31 06:00:00 212,480 ----a-w C:\WINDOWS\swxcacls.exe + 2008-04-05 11:53:53 34,308 ----a-w C:\WINDOWS\system32\BASSMOD.dll - 2008-02-09 08:27:26 93,480 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-04-05 11:15:05 1,393,088 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2008-04-01 15:02:25 70,718 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-04-06 08:25:51 70,718 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-04-01 15:02:25 87,562 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-04-06 08:25:52 87,562 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-04-01 15:02:25 421,810 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-04-06 08:25:51 421,810 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-04-01 15:02:25 478,424 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-04-06 08:25:52 478,424 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-05-03 17:37:08 77,312 ----a-w C:\WINDOWS\system32\TWAIN_32.DLL + 2007-05-03 17:37:08 48,560 ----a-w C:\WINDOWS\system32\TWUNK_16.EXE + 2007-05-03 17:37:08 69,632 ----a-w C:\WINDOWS\system32\TWUNK_32.EXE + 2008-04-05 20:04:58 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4fc.dat + 2000-08-31 06:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe + 2000-08-31 06:00:00 68,096 ----a-w C:\WINDOWS\zip.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360] "ares"="C:\Program Files\Ares\Ares.exe" [2008-02-20 16:33 963072] "DNSUpdate"="C:\Program Files\Dyn.pl DNSUpdate\DNSUpdate.exe" [2007-04-08 18:22 290816] "AbyssWebServer"="D:\AbyssWebServer\abyssws.exe" [2008-03-09 15:57 506425] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-01-08 20:54 65536 C:\WINDOWS\SOUNDMAN.EXE] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-02-27 17:02 1269870] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-12-12 12:31 335872] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38 866816] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-03-04 22:37:04 1183744] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2008-03-09 16:23:44 69632] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2008-02-07 20:27:37 561152] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "MSVideo8"= VfWWDM32.dll "vidc.adv1"= ADV601.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2006-03-10 17:15 1249280 C:\Program Files\Steam\Steam.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"= "D:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\Ares\\Ares.exe"= "D:\\MuServer\\DataServer\\DataServer.exe"= "D:\\MuServer\\ConnectServer\\Cs.exe"= "D:\\MuServer\\EventServer\\EventServer.exe"= "D:\\MuServer\\JoinServer\\JoinServer.exe"= "D:\\MuServer\\ExDB\\ExDB.exe"= "D:\\MuServer\\RankingServer\\RankingServer.EXE"= "D:\\MuServer\\GameServer\\GameServer.exe"= "D:\\MuServer\\ChatServer\\ChatServer.exe"= "D:\\MuServer\\GameServerCS\\GameServerCS.exe"= "D:\\AbyssWebServer\\abyssws.exe"= "C:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe"= "C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"= "C:\\Program Files\\Shareaza\\Shareaza.exe"= "E:\\Activision\\Call of Duty 2\\CoD2MP_s.exe"= R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-06-12 12:31] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-09-26 12:05] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-09-26 12:05] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] S2 NATServices;NATServicesware;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] NATServices REG_MULTI_SZ NATServices . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-06 12:02:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-06 12:04:16 ComboFix-quarantined-files.txt 2008-04-06 10:04:10 ComboFix2.txt 2008-04-01 15:21:45 ComboFix3.txt 2008-03-23 13:34:02 ComboFix4.txt 2008-03-23 13:06:31 Pre-Run: 16,947,449,856 bajtów wolnych Post-Run: 16,938,385,408 bajtów wolnych . 2008-03-13 02:01:49 --- E O F ---

**Posty:** 18165 · przez **wojtas** 06 Kwi 2008, 17:42

1.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
2. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

3. wykonaj optymalizację windowsa
4.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED

**Posty:** 13 · przez **murek007** 07 Kwi 2008, 14:34

Nadal muli ;[

**Posty:** 18165 · przez **wojtas** 07 Kwi 2008, 16:01

masz czysty system

komputer zamula

Komputer zamula

Kto jest na forum