Log do sprawdzenia, straszne mulenie kompa

**Posty:** 2116 · przez **cinek383** 01 Mar 2009, 13:09

Witam prosze o sprawdzenie loga ponieważ strasznie mi komputer muli, nie chodzi tak jak kiedys

A dosyć daaawno tego nie robiłem, pewnie z jakieś pół roku, należałoby to sprawdzić

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:07:50, on 2009-03-01 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe f:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE f:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe F:\Program Files\Eset\nod32kui.exe C:\WINDOWS\ZSSnp211.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE E:\Program Files\A4Tech\Mouse\Amoumain.exe F:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe F:\Program Files\Kalendarz XP\Kalendarz.exe F:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe F:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe F:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe C:\WINDOWS\system32\wuauclt.exe e:\Program Files\Rockstar Games\Rockstar Games Social Club\1_1_3_0\RGSC.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe F:\Program Files\Winamp\winamp.exe F:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM\..\Run: [nod32kui] "f:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [VolPanel] "f:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [WheelMouse] e:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [WinampAgent] "f:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [BearShare] "F:\Program Files\BearShare\BearShare.exe" /pause O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Odkurzacz-MCD] f:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe O4 - HKCU\..\Run: [RGSC] E:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-21-2052111302-1979792683-839522115-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Mama') O4 - HKUS\S-1-5-21-2052111302-1979792683-839522115-1005\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" (User 'Mama') O4 - HKUS\S-1-5-21-2052111302-1979792683-839522115-1005\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe (User 'Mama') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: RocketDock.lnk = F:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = F:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O4 - Startup: UberIcon.lnk = F:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe O4 - Startup: Y'z Shadow.lnk = F:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Kalendarz XP.lnk = F:\Program Files\Kalendarz XP\Kalendarz.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{30D7F450-1DED-4BBA-BBF6-BD30CEC80D33}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - f:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - f:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 8422 bytes

**Posty:** 8001 · przez **Okocza** 01 Mar 2009, 14:04

cinek383, daj log z combofixa

**Posty:** 2116 · przez **cinek383** 01 Mar 2009, 14:18

proszę;)

Kod: Zaznacz wszystko: ComboFix 09-02-28.01 - komp 2009-03-01 13:13:00.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.3327.2610 [GMT 1:00] Uruchomiony z: f:\program files\Muzyka\nowe\ComboFix.exe AV: System antywirusowy NOD32 2.70 *On-access scanning enabled* (Updated) * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\a3kebook.ini c:\windows\akebook.ini c:\windows\ANS2000.INI . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-01 do 2009-03-01 ))))))))))))))))))))))))))))))) . 2009-02-26 19:22 . 2009-02-26 19:22 <DIR> d-------- c:\documents and settings\komp\Dane aplikacji\PCToolsFirewallPlus 2009-02-26 18:33 . 2009-02-26 18:37 <DIR> d-------- c:\program files\Picasa2 2009-02-26 18:26 . 2009-02-26 19:53 <DIR> d-------- c:\program files\Common Files\PC Tools 2009-02-26 18:26 . 2009-02-26 19:49 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-02-26 15:23 . 2009-02-26 15:23 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\152CE 2009-02-18 15:14 . 2009-02-18 15:16 <DIR> d-------- c:\documents and settings\komp\Dane aplikacji\Winamp 2009-02-04 13:37 . 2009-02-04 13:37 <DIR> d-------- c:\documents and settings\komp\.gstreamer-0.10 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-01 12:05 --------- d-----w c:\documents and settings\komp\Dane aplikacji\DNA 2009-03-01 07:05 --------- d-----w c:\program files\DNA 2009-03-01 07:04 --------- d-----w c:\documents and settings\Mama\Dane aplikacji\skypePM 2009-03-01 06:23 --------- d-----w c:\documents and settings\Mama\Dane aplikacji\Skype 2009-02-26 14:23 --------- d-----w c:\documents and settings\komp\Dane aplikacji\BearShare 2009-02-26 09:11 --------- d-----w c:\documents and settings\komp\Dane aplikacji\BitTorrent 2009-02-23 11:41 --------- d-----w c:\documents and settings\Mama\Dane aplikacji\Nokia Multimedia Player 2009-02-18 13:57 --------- d-----w c:\documents and settings\komp\Dane aplikacji\foobar2000 2009-02-17 17:37 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-17 16:57 --------- d-----w c:\documents and settings\komp\Dane aplikacji\Nowe Gadu-Gadu 2009-02-13 17:07 --------- d-----w c:\documents and settings\Mama\Dane aplikacji\PC Suite 2009-02-09 12:02 --------- d-----w c:\program files\Nowe Gadu-Gadu 2009-01-14 12:41 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys 2009-01-14 08:10 --------- d-----w c:\documents and settings\Mama\Dane aplikacji\Vso 2009-01-13 15:30 --------- d-----w c:\documents and settings\komp\Dane aplikacji\VSO 2009-01-13 07:07 --------- d-----w c:\program files\Photo! 2009-01-01 12:28 --------- d-----w c:\documents and settings\Mama\Dane aplikacji\Nokia 2008-12-12 11:26 183,112 ----a-w c:\windows\system32\PnkBstrB.exe 2008-12-07 17:37 66,562 ----a-w c:\windows\BricoPackUninst.cmd 2008-12-07 17:37 5,798 ----a-w c:\windows\BricoPackFoldersDelete.cmd 2008-12-07 17:37 219,648 ----a-w c:\windows\system32\uxtheme.dll 2008-10-28 16:21 22,328 ----a-w c:\documents and settings\komp\Dane aplikacji\PnkBstrK.sys 2007-12-14 06:40 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ------- Sigcheck ------- 2008-04-14 22:51 977408 f042e3426d45d86d9bb55f6a79ab441a c:\windows\explorer.exe 2007-06-13 14:12 1034752 8db0650b211425b9cdb7d1c4a8f6b482 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe 2007-06-13 14:23 1034752 029a562e81bbee088c61d418bf408f44 c:\windows\$NtServicePackUninstall$\explorer.exe 2004-08-03 23:44 1033728 379098a96e6c165b659de7e4328010ea c:\windows\$NtUninstallKB938828$\explorer.exe 2008-04-14 22:51 977408 f042e3426d45d86d9bb55f6a79ab441a c:\windows\ServicePackFiles\i386\explorer.exe 2008-04-14 18:21 1035264 c791ed9eac5e76d9525e157b1d7a599a c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\explorer.exe 2004-08-03 23:44 1033728 379098a96e6c165b659de7e4328010ea c:\windows\system_backup\explorer.exe 2008-10-16 14:09 66584 2275f45e257d46e6500558b2930cb9a4 c:\windows\ServicePackFiles\i386\wuauclt.exe 2008-04-14 18:21 112128 9a19ba6d99b8ec3db5b3eff71b0a0bb5 c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\wuauclt.exe 2008-10-16 14:09 66584 2275f45e257d46e6500558b2930cb9a4 c:\windows\system32\wuauclt.exe 2008-10-16 14:09 51224 e654b78d2f1d791b30d0ed9a8195ec22 c:\windows\system32\dllcache\wuauclt.exe 2004-08-03 23:44 112128 ebf4ac22004504c422fc8b5ee5b6ffd1 c:\windows\system_backup\wuauclt.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Odkurzacz-MCD"="f:\program files\Odkurzacz\odk_mcd.exe" [2008-03-03 266240] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-09-08 342848] "NETIANET"="c:\program files\Netia\Net\netianet.exe" [2007-03-31 474112] "RGSC"="e:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-13 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-11 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-11 81920] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "iKeyWorks"="c:\progra~1\A4Tech\Keyboard\Ikeymain.exe" [2006-04-09 61440] "nod32kui"="f:\program files\Eset\nod32kui.exe" [2008-02-09 949376] "ZSSnp211"="c:\windows\ZSSnp211.exe" [2006-08-19 49152] "VolPanel"="f:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 122880] "AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "WheelMouse"="e:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800] "WinampAgent"="f:\program files\Winamp\winampa.exe" [2008-03-27 36352] "BearShare"="f:\program files\BearShare\BearShare.exe" [2006-08-01 3313664] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "nwiz"="nwiz.exe" [2007-05-11 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-10-30 c:\windows\RTHDCPL.exe] "CTHelper"="CTHELPER.EXE" [2006-05-24 c:\windows\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-05-24 c:\windows\system32\CTXFIHLP.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "Nokia.PCSync"="f:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896] c:\documents and settings\komp\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] RocketDock.lnk - f:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784] TransBar.lnk - f:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536] UberIcon.lnk - f:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224] Y'z Shadow.lnk - f:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-12-13 962667] Kalendarz XP.lnk - f:\program files\Kalendarz XP\Kalendarz.exe [2007-12-16 882176] [HKLM\~\startupfolder\C:^Documents and Settings^komp^Menu Start^Programy^Autostart^Registration Heroes of Might & Magic 5.LNK] path=c:\documents and settings\komp\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK backup=c:\windows\pss\Registration Heroes of Might & Magic 5.LNKStartup [HKLM\~\startupfolder\C:^Documents and Settings^komp^Menu Start^Programy^Autostart^Registration The Settlers - Dziedzictwo Królów.LNK] path=c:\documents and settings\komp\Menu Start\Programy\Autostart\Registration The Settlers - Dziedzictwo Królów.LNK backup=c:\windows\pss\Registration The Settlers - Dziedzictwo Królów.LNKStartup [HKLM\~\startupfolder\C:^Documents and Settings^komp^Menu Start^Programy^Autostart^Rejestracja Need for Speed™ Undercover.lnk] path=c:\documents and settings\komp\Menu Start\Programy\Autostart\Rejestracja Need for Speed™ Undercover.lnk backup=c:\windows\pss\Rejestracja Need for Speed™ Undercover.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] --a------ 2006-08-01 17:04 3313664 f:\program files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-01-03 14:54 486856 f:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 13:20 227328 f:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC] --a------ 2008-12-13 09:00 306088 e:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --------- 2008-10-12 20:30 1410296 e:\program files\Valve\Steam\Steam.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "f:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "e:\\Program Files\\Valve\\Steam\\SteamApps\\cinek383\\condition zero\\hl.exe"= "f:\\Program Files\\BearShare\\BearShare.exe"= "e:\\Program Files\\Valve\\Steam\\SteamApps\\cinek383\\counter-strike\\hl.exe"= "f:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "f:\\Program Files\\BitTorrent\\bittorrent.exe"= "e:\\Program Files\\Warcraft III\\Warcraft III.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "e:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "e:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "e:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "f:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"= "e:\\Program Files\\GSC Game World\\Kozacy II\\Data\\ENGINE.EXE"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-02-09 15424] S3 NRKCTL32;NRKCTL32;\??\e:\pobrane pliki firefox\NRKCTL32.SYS --> e:\pobrane pliki firefox\NRKCTL32.SYS [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4fb6b29-a976-11dc-9ce4-806d6172696f}] \Shell\AutoRun\command - D:\autorun.exe . Zawartość folderu 'Zaplanowane zadania' 2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.bearshare.com/pl uInternet Connection Wizard,ShellNext = iexplore IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: c:\windows\system32\imon.dll TCP: {30D7F450-1DED-4BBA-BBF6-BD30CEC80D33} = 213.241.79.37 83.238.255.76 FF - ProfilePath - c:\documents and settings\komp\Dane aplikacji\Mozilla\Firefox\Profiles\shwpr37n.default\ FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava11.dll FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava12.dll FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava131_03.dll FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPJava32.dll FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_03\bin\NPOJI600.dll FF - plugin: f:\program files\Mozilla Firefox\plugins\npbittorrent.dll FF - plugin: f:\program files\Mozilla Firefox\plugins\NPDOMINO.dll FF - plugin: f:\program files\Mozilla Firefox\plugins\npganymedenet.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-01 13:14:09 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-2052111302-1979792683-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID] @Denied: (Full) (LocalSystem) [HKEY_USERS\S-1-5-21-2052111302-1979792683-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:ce,13,12,28,ba,14,42,4a,03,45,4e,9d,07,c4,d5,5a,47,54,58,da,65, aa,08,f9,8d,9b,f6,fb,fc,f2,08,df,92,76,63,57,59,f0,58,16,f5,a3,73,3c,47,db,\ "rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(752) c:\windows\system32\imon.dll f:\program files\Eset\pr_imon.dll . Czas ukończenia: 2009-03-01 13:16:26 ComboFix-quarantined-files.txt 2009-03-01 12:15:22 ComboFix2.txt 2008-09-08 14:29:03 Przed: 34 033 664 bajtów wolnych Po: 4,061,884,416 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 212 --- E O F --- 2009-02-25 17:43:41

**Posty:** 8001 · przez **Okocza** 01 Mar 2009, 14:19

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 2116 · przez **cinek383** 01 Mar 2009, 21:54

Z tym programem HDCleaner to nie wiem jak co zrobić wszystko jest po niemiecku, i nie widze zmiany języka

chyba formacik będzie bo wszystko sie powoli sypie, zamula itp.... ;/ już mam dosc a duzo danych mam...

**Posty:** 299 · przez **neeven** 01 Mar 2009, 23:00

optymalizacja-windowsa-xp-vt89133.html

Zjedz na dół do :

Oto lista zbędników, jeśli któryś zobaczymy u siebie możemy je spokojnie odznaczyć bez żadnych konsekwencji.

I usuń niepotrzebne.