Komputer zbyt dlugo myśli i sie zawiesza.

**Posty:** 271 · przez **Sythev** 05 Lis 2008, 18:15

Witam !

Pisze tutaj ponieważ zaniepokoilo mnie w moim komputerze to,że zaczął zbyt długo myślec przy zbyt prostych poleceniach a także czesto sie zawiesza i komputer sie restartuje i wyskakuje bluescreen zeby biosa zaktualizowac a ja nie wiem oco kaman.

daj log z HiJack bo moze mam jakiegos wirusa chociaz codziennie skanuje komputer.

a także chcialbym się zapytac co zrobic,zeby poprawic wydajnosc komputera.. zmienilem wygląd Windows na wydajnosc ale to nic nie dalo..pousuwalem wszystko co mozliwe,żeby szybciej chodzil ale nic ;/
może coś mam jeszcze nie potrzebnego
a także prosze mi powiedziec co zrobic,zeby komputer po wlaczeniu uruchamial tylko podstawowe rzeczy Windows.. tylko sterowniki itd. a nie zadne programy.

ss z menadzera zadan :

Kod: Zaznacz wszystko: http://www.speedyshare.com/202456564.html

Kod: Zaznacz wszystko: http://www5.speedyshare.com/data/202456564/13485742/64302696/menadzer.JPG

log z hijack :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:15:29, on 2008-11-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ThomsonNetia\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\MultiRes\MultiRes.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\Dom\Moje dokumenty\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.livescore.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\ThomsonNetia\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe O4 - HKLM\..\Run: [AtiPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139655056968 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://82.146.224.245:85/activex/AxisCamControl.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_31.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38E37073-CBDA-4949-819D-F15C95424FB3}: NameServer = 213.241.79.37 83.238.255.76 O17 - HKLM\System\CS1\Services\Tcpip\..\{38E37073-CBDA-4949-819D-F15C95424FB3}: NameServer = 213.241.79.37 83.238.255.76 O17 - HKLM\System\CS2\Services\Tcpip\..\{38E37073-CBDA-4949-819D-F15C95424FB3}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe -- End of file - 4857 bytes

log z FixIEDef :

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6759 * * * ******************************************************************************** Created at 17:17:47 on Wednesday, November 05, 2008 Time Zone : Logged On User : Dom Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) XP 2800+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 60 GB System Drive Free : 50 GB Total Physical Memory: 511 MB Free Physical Memory : 271 MB Total Page File : 511 MB Free Page File : 1781 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1973 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\autorun.inf -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "KernelFaultCheck" ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 05 Lis 2008, 18:18

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 271 · przez **Sythev** 05 Lis 2008, 18:53

combofix :

Kod: Zaznacz wszystko: ComboFix 08-11-04.02 - Dom 2008-11-05 17:42:48.18 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.207 [GMT 1:00] Uruchomiony z: c:\documents and settings\Dom\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\b3b9u.com C:\c9hehpa.bat C:\nfdmg.com c:\recycled\Recycled c:\windows\system32\ckvo.exe c:\windows\system32\ckvo0.dll c:\windows\system32\ckvo1.dll D:\Autorun.inf D:\b3b9u.com D:\c9hehpa.bat D:\nfdmg.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-05 do 2008-11-05 ))))))))))))))))))))))))))))))) . 2008-11-05 17:26 . 2008-11-05 17:26 <DIR> d-------- C:\aaa 2008-11-05 17:26 . 2008-11-05 17:26 1,528,982 --a------ C:\SDFix.exe 2008-11-02 00:56 . 2008-05-08 02:03 453,632 --a------ c:\windows\system32\SetACL.ocx . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-05 16:29 18,837 ----a-w c:\windows\system32\drivers\fwdrv.err 2008-11-05 14:48 --------- d-----w c:\program files\ArcaMicroScan 2008-11-05 13:49 --------- d-----w c:\program files\Steam 2008-11-05 09:13 --------- d-----w c:\program files\Gadu-Gadu 2008-10-23 22:50 9,216 --sha-w c:\program files\Common Files\Thumbs.db 2008-10-23 22:47 --------- d-----w c:\program files\Skype 2008-10-23 22:47 --------- d-----w c:\program files\HLSW 2008-10-23 22:47 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-10-04 16:21 --------- d-----w c:\documents and settings\Dom\Dane aplikacji\skypePM 2008-09-21 18:16 --------- d-----w c:\program files\Java 2008-09-21 18:14 --------- d-----w c:\program files\Common Files\Java 2008-08-19 23:55 24,576 ----a-w c:\windows\system32\VundoFixSVC.exe 2008-04-15 20:11 766 ----a-w c:\program files\Common Files\sms.ico 2008-04-15 20:11 70 ----a-w c:\program files\Common Files\moje.js 2008-02-10 18:35 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2007-09-05 17:36 1,159,168 ----a-w c:\windows\system32\config\systemprofile\NTUSER(2).DAT 2006-02-10 15:10 7,799,000 ----a-w c:\program files\kerio.exe 2008-03-22 08:51 88 --sh--r c:\windows\system32\A7D1A58E4C.sys 2008-03-22 08:51 3,350 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="c:\program files\ThomsonNetia\SpeedTouch USB\Dragdiag.exe" [2004-08-06 877568] "MultiRes"="c:\program files\MultiRes\MultiRes.exe" [2004-07-20 61952] "AtiPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 344064] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 28672] "HydraVisionDesktopManager"="c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 270336] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE] "SoundMan"="SOUNDMAN.EXE" [2004-01-08 c:\windows\SOUNDMAN.EXE] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2004-09-29 28672] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 1 (0x1) "SynchronousUserGroupPolicy"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) "MemCheckBoxInRunDlg"= 0 (0x0) "NoAutoTrayNotify"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoResolveSearch"= 0 (0x0) "NoWelcomeScreen"= 0 (0x0) "NoRecentDocsNetHood"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{35B2861B-2B26-4691-9FF0-09083722C736}"= "c:\windows\system32\RadExe.dll" [2004-10-01 204800] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 c:\program files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-10-07 23:26 1410296 c:\program files\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 19:49 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\DRIVERS\tffsport.sys [2004-08-03 149376] R0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2003-06-12 75904] R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2007-04-26 302000] R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2007-04-26 72624] R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 1234480] S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [ ] S3 SysInteg;SysInteg;c:\windows\system32\drivers\SysInteg010.sys [2008-03-22 9856] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a403c0d0-3553-11dd-adf6-000e50e65f12}] \Shell\AutoRun\command - ph.com \Shell\explore\Command - ph.com \Shell\open\Command - ph.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ddbcbb68-2877-11dc-a9f0-000e50e65f12}] \Shell\AutoRun\command - F:\nfdmg.com \Shell\explore\Command - F:\nfdmg.com \Shell\open\Command - F:\nfdmg.com . Zawartość folderu 'Zaplanowane zadania' 2008-10-31 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [] . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-AdVantage - c:\program files\AdVantage\AdVantage.exe MSConfigStartUp-ares - c:\program files\Ares\Ares.exe MSConfigStartUp-ccleaner - c:\program files\CCleaner\CCleaner.exe MSConfigStartUp-EdHTML - c:\program files\Binboy\EdHTMLv5.0\EdHTML.exe MSConfigStartUp-MMTray - c:\program files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\MMTray.exe MSConfigStartUp-mmtray2k - c:\program files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtray2k.exe MSConfigStartUp-mmtraylsi - c:\program files\ACE Mega CoDecS Pack\SystemS\Morgan Multimedia\mmtraylsi.exe MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe MSConfigStartUp-Tweak UI - TWEAKUI.CPL . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Dom\Dane aplikacji\Mozilla\Firefox\Profiles\ux0854ou.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.livescore.com/ FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-05 17:47:29 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-05 17:49:53 ComboFix-quarantined-files.txt 2008-11-05 16:49:47 Przed: 53 126 434 816 bajtów wolnych Po: 53,115,142,144 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 157

sdfix :

Kod: Zaznacz wszystko: [b]SDFix: Version 1.239 [/b] Run by Dom on 2008-11-05 at 17:30 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\aaa\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-05 17:33:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... IPC error: 2 Nie można odnaleźć określonego pliku. scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 13 Aug 2008 89,917 ..SHR --- "C:\b3b9u.com" Mon 29 Sep 2008 100,108 ..SHR --- "C:\nfdmg.com" Wed 4 Aug 2004 1,667,584 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Wed 4 Aug 2004 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Sat 22 Mar 2008 88 ..SHR --- "C:\WINDOWS\system32\A7D1A58E4C.sys" Mon 29 Sep 2008 100,108 ..SHR --- "C:\WINDOWS\system32\ckvo.exe" Wed 5 Nov 2008 85,504 ..SHR --- "C:\WINDOWS\system32\ckvo0.dll" Fri 24 Oct 2008 85,504 ..SHR --- "C:\WINDOWS\system32\ckvo1.dll" Sat 22 Mar 2008 3,350 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Tue 17 Jul 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sun 18 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4eeb59f084e20038b23f012bb616a593\BIT5.tmp" Tue 17 Jul 2007 4,348 ...H. --- "C:\Documents and Settings\Dom\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Fri 18 Jul 2008 20 A..H. --- "C:\Documents and Settings\Dom\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Tue 17 Jul 2007 9,656 A.SH. --- "C:\Documents and Settings\Dom\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" [b]Finished![/b]

hijack :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:54:09, on 2008-11-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ThomsonNetia\SpeedTouch USB\Dragdiag.exe C:\Program Files\MultiRes\MultiRes.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Dom\Moje dokumenty\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.livescore.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\ThomsonNetia\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe O4 - HKLM\..\Run: [AtiPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139655056968 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://82.146.224.245:85/activex/AxisCamControl.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_31.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38E37073-CBDA-4949-819D-F15C95424FB3}: NameServer = 213.241.79.37 83.238.255.76 O17 - HKLM\System\CS1\Services\Tcpip\..\{38E37073-CBDA-4949-819D-F15C95424FB3}: NameServer = 213.241.79.37 83.238.255.76 O17 - HKLM\System\CS2\Services\Tcpip\..\{38E37073-CBDA-4949-819D-F15C95424FB3}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe -- End of file - 4699 bytes

**Posty:** 18165 · przez **wojtas** 05 Lis 2008, 19:55

te plik/i :

c:\windows\system32\SetACL.ocx

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

i zobaczymy czy nic nie siedzi:

Otworz notatnik i wklej w nim to:

File::
E:\Autorun.inf
E:\b3b9u.com
E:\c9hehpa.bat
E:\nfdmg.com
F:\Autorun.inf
F:\b3b9u.com
F:\c9hehpa.bat
F:\nfdmg.com

Folder::
D:\recycled
E:\recycled
F:\recycled

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a403c0d0-3553-11dd-adf6-000e50e65f12}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ddbcbb68-2877-11dc-a9f0-000e50e65f12}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 271 · przez **Sythev** 05 Lis 2008, 21:18

http://virusscan.jotti.org/ - nie wykryłonic

http://www.virustotal.com/ - tu tez nic nie wykrylo

Kod: Zaznacz wszystko: ComboFix 08-11-04.02 - Dom 2008-11-05 20:11:11.19 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.149 [GMT 1:00] Uruchomiony z: c:\documents and settings\Dom\Moje dokumenty\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Dom\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania FILE :: E:\Autorun.inf E:\b3b9u.com E:\c9hehpa.bat E:\nfdmg.com F:\Autorun.inf F:\b3b9u.com F:\c9hehpa.bat F:\nfdmg.com . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\recycled d:\recycled\ctfmon.exe d:\recycled\desktop.ini d:\recycled\INFO2 . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-05 do 2008-11-05 ))))))))))))))))))))))))))))))) . 2008-11-05 17:26 . 2008-11-05 17:26 <DIR> d-------- C:\aaa 2008-11-05 17:26 . 2008-11-05 17:26 1,528,982 --a------ C:\SDFix.exe 2008-11-02 00:56 . 2008-05-08 02:03 453,632 --a------ c:\windows\system32\SetACL.ocx . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-05 17:06 --------- d-----w c:\program files\Steam 2008-11-05 16:29 18,837 ----a-w c:\windows\system32\drivers\fwdrv.err 2008-11-05 14:48 --------- d-----w c:\program files\ArcaMicroScan 2008-11-05 09:13 --------- d-----w c:\program files\Gadu-Gadu 2008-10-23 22:50 9,216 --sha-w c:\program files\Common Files\Thumbs.db 2008-10-23 22:47 --------- d-----w c:\program files\Skype 2008-10-23 22:47 --------- d-----w c:\program files\HLSW 2008-10-23 22:47 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Skype 2008-10-04 16:21 --------- d-----w c:\documents and settings\Dom\Dane aplikacji\skypePM 2008-09-21 18:16 --------- d-----w c:\program files\Java 2008-09-21 18:14 --------- d-----w c:\program files\Common Files\Java 2008-08-19 23:55 24,576 ----a-w c:\windows\system32\VundoFixSVC.exe 2008-04-15 20:11 766 ----a-w c:\program files\Common Files\sms.ico 2008-04-15 20:11 70 ----a-w c:\program files\Common Files\moje.js 2008-02-10 18:35 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2007-09-05 17:36 1,159,168 ----a-w c:\windows\system32\config\systemprofile\NTUSER(2).DAT 2006-02-10 15:10 7,799,000 ----a-w c:\program files\kerio.exe 2008-03-22 08:51 88 --sh--r c:\windows\system32\A7D1A58E4C.sys 2008-03-22 08:51 3,350 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="c:\program files\ThomsonNetia\SpeedTouch USB\Dragdiag.exe" [2004-08-06 877568] "MultiRes"="c:\program files\MultiRes\MultiRes.exe" [2004-07-20 61952] "AtiPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 344064] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2004-09-29 28672] "HydraVisionDesktopManager"="c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 270336] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE] "SoundMan"="SOUNDMAN.EXE" [2004-01-08 c:\windows\SOUNDMAN.EXE] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2004-09-29 28672] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 1 (0x1) "SynchronousUserGroupPolicy"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) "MemCheckBoxInRunDlg"= 0 (0x0) "NoAutoTrayNotify"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoResolveSearch"= 0 (0x0) "NoWelcomeScreen"= 0 (0x0) "NoRecentDocsNetHood"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{35B2861B-2B26-4691-9FF0-09083722C736}"= "c:\windows\system32\RadExe.dll" [2004-10-01 204800] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 c:\program files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-10-07 23:26 1410296 c:\program files\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 19:49 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\DRIVERS\tffsport.sys [2004-08-03 149376] R0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2003-06-12 75904] R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2007-04-26 302000] R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2007-04-26 72624] R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 1234480] S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [ ] S3 SysInteg;SysInteg;c:\windows\system32\drivers\SysInteg010.sys [2008-03-22 9856] . Zawartość folderu 'Zaplanowane zadania' 2008-10-31 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-05 20:15:39 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-05 20:17:47 ComboFix-quarantined-files.txt 2008-11-05 19:17:41 ComboFix2.txt 2008-11-05 16:49:57 Przed: 54 899 060 736 bajtów wolnych Po: 54,889,627,648 bajtów wolnych 129

**Posty:** 684 · przez **djarta** 06 Lis 2008, 17:04

C:\aaa

Znasz to? Poza tym czysto.

====================
K.

**Posty:** 271 · przez **Sythev** 07 Lis 2008, 01:03

aaa to SDFix hehe

a jeszcze jeden problem.

czasami gdy uruchamiam komputer to on po 3-4minutach zwiecha i BLUESCREEN a dokladnie takie cos :

Kod: Zaznacz wszystko: STOP: c000021a {B d krytyczny systemu} Proces systemowy Windows Logon Procces zakonczył się niespodziewanie ze stanem 0xc0000005 (0x00000000 0x00000000) system zostanie zamkniety.

a także przy każdym zamykaniu komputera (gdy koncze prace na nim : start,wylacz komputer,wylacz..) komputer pisze ze sie wyłacza a nagle wyskakuje kolejny BLUESCREEN w którym mowa,że jakiś BIOS jest nieaktualny i wogóle cała strona zapisana..
a na koncu zrzut pamieci podrecznej i tam leci do 100% i wtedy pisze,ze mozna wylaczayc komputer..

nie wiem oco kamana.