Log-dziwne zachowywanie się systemu

**Posty:** 7 · przez **sebastiano999** 12 Lut 2009, 13:40

Witam!

Komputer "bardzo" sie tnie, po dłuższym czasie użytkowania zmieniają sie kolory np.na różowy.
Ma problemy nawet z NFS Most Wanted tzn.sie zacina (ale to bardzo). A z tymi grami niepowinno być problemu [2.2 Ghz 7300gt], a wcześniej tego problemu nie miałem.
Druga sprawa to dziś odziwo niemogłem właczyć komputera(po pasku ładującym Windows'a system sie ponownie uruchamiał),a jak właczyłem tryb awaryjny to była zła rozdzielczość itp. Zaś teraz narazie jest wszystko w porządku(klasyczny Windows XP)
Trzecim "objawem" są różne Error'y podczas wyłaczania komputera.

Dodam ,że ów 3 tyg.temu miałem wymienianą karte graficzną oraz płyte główną(nowe).

Uważam,że powodują to Wirusy,robaki itp. więc proszę o sprawdzenie loga z Combo Fix.

Kod: Zaznacz wszystko: ComboFix 09-02-11.02 - 007 2009-02-12 11:21:24.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1023.641 [GMT 1:00] Uruchomiony z: c:\documents and settings\[u]0[/u]07\Pulpit\ComboFix.exe AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) FW: Kaspersky Anti-Virus *disabled* UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((( Pliki utworzone od 2009-01-12 do 2009-02-12 ))))))))))))))))))))))))))))))) . 2009-02-12 10:12 . 2009-02-12 11:22 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-02-12 10:12 . 2008-12-01 16:42 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-02-12 10:12 . 2008-12-01 15:52 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-02-12 10:12 . 2008-12-01 16:42 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-02-12 10:12 . 2008-12-01 16:42 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-02-12 10:12 . 2008-12-01 16:42 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-02-12 10:12 . 2009-02-12 10:15 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-02-12 10:12 . 2009-02-12 10:12 <DIR> d-------- c:\documents and settings\Administrator 2009-02-11 20:34 . 2009-02-11 20:34 54,156 --ah----- c:\windows\QTFont.qfn 2009-02-11 20:34 . 2009-02-11 20:34 1,409 --a------ c:\windows\QTFont.for 2009-02-10 16:42 . 2009-02-10 16:42 <DIR> d-------- c:\documents and settings\[u]0[/u]07\.gstreamer-0.10 2009-02-10 16:39 . 2009-02-10 22:41 <DIR> d-------- c:\documents and settings\[u]0[/u]07\Dane aplikacji\Nowe Gadu-Gadu 2009-02-09 22:58 . 2009-02-09 22:58 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\hps 2009-02-09 20:29 . 1994-12-06 00:00 12,800 --a------ c:\windows\system32\WING32.DLL 2009-02-06 23:16 . 2009-02-06 23:16 <DIR> d-------- c:\documents and settings\Monika\Dane aplikacji\Apple Computer 2009-01-28 16:59 . 2009-01-28 16:59 <DIR> d-------- c:\windows\AM 2009-01-26 18:22 . 2009-01-26 18:22 <DIR> dr-h----- c:\documents and settings\[u]0[/u]07\Dane aplikacji\SecuROM 2009-01-26 18:10 . 2009-01-26 18:10 <DIR> d-------- c:\windows\system32\drivers\umdf 2009-01-26 18:09 . 2009-01-26 18:09 <DIR> d-------- c:\windows\system32\xlive 2009-01-26 18:09 . 2009-01-26 18:09 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE 2009-01-24 21:37 . 2009-01-24 21:37 <DIR> d-------- c:\documents and settings\Natalia\Dane aplikacji\ScanSoft 2009-01-22 18:41 . 2008-04-14 18:20 54,784 --a------ c:\windows\system32\vfwwdm32.dll 2009-01-22 18:41 . 2008-04-14 18:20 54,784 --a--c--- c:\windows\system32\dllcache\vfwwdm32.dll 2009-01-22 18:33 . 2005-01-31 09:30 16,176 --------- c:\windows\system32\drivers\NVXBAR.SYS 2009-01-22 18:32 . 2005-01-31 09:30 141,246 --------- c:\windows\system32\drivers\NVCAP.SYS 2009-01-22 18:32 . 2005-01-31 09:30 29,696 --------- c:\windows\system32\FILTER.AX 2009-01-22 18:30 . 2009-01-22 18:38 <DIR> d-------- c:\windows\NV30203024.TMP 2009-01-22 18:10 . 2006-04-14 14:00 208,896 --------- c:\windows\system32\nvuide.exe 2009-01-22 18:08 . 2009-01-22 18:13 4,501 --a------ c:\windows\gdrv.sys 2009-01-22 18:00 . 2009-01-22 18:00 <DIR> d-------- c:\windows\NV32403244.TMP . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-12 10:11 753,696 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-02-12 10:11 5,752 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-02-12 10:11 --------- d-----w c:\program files\lg_fwupdate 2009-02-12 10:11 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-02-12 10:09 4,204,064 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-02-12 10:09 36,020 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-02-09 19:12 --------- d-----w c:\program files\Common Files\InstallShield 2009-02-04 17:21 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-04 14:10 33,808 ----a-w c:\windows\system32\drivers\klbg.sys 2009-02-03 16:59 89,601 ----a-w c:\windows\system32\drivers\klick.dat 2009-02-03 16:59 101,287 ----a-w c:\windows\system32\drivers\klin.dat 2009-01-25 11:22 --------- d-----w c:\program files\Brother 2009-01-08 18:05 --------- d-----w c:\documents and settings\[u]0[/u]07\Dane aplikacji\Thinstall 2009-01-08 16:47 --------- d-----w c:\documents and settings\[u]0[/u]07\Dane aplikacji\ScanSoft 2009-01-08 16:34 --------- d-----w c:\program files\Nuance 2009-01-08 16:33 --------- d-----w c:\program files\Common Files\ScanSoft Shared 2009-01-08 16:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ScanSoft 2009-01-08 16:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\InstallShield 2009-01-08 16:31 --------- d-----w c:\program files\ScanSoft 2009-01-08 16:29 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Brother 2009-01-05 09:47 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\AdobeUM 2009-01-05 09:47 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\AdobeAUM 2009-01-05 09:46 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Leadertech 2008-12-31 15:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\.Beniamin 2008-12-30 11:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\FLEXnet 2008-12-29 22:20 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\CyberLink 2008-12-29 22:20 --------- d-----w c:\documents and settings\[u]0[/u]07\Dane aplikacji\CyberLink 2008-12-28 13:33 --------- d-----w c:\program files\Common Files\Adobe 2008-12-28 13:33 --------- d-----w c:\program files\Bonjour 2008-12-28 13:26 --------- d-----w c:\program files\Common Files\Macrovision Shared 2008-12-27 21:37 --------- d-----w c:\documents and settings\[u]0[/u]07\Dane aplikacji\ZoomBrowser EX 2008-12-27 21:03 --------- d-----w c:\program files\Canon 2008-12-27 21:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ZoomBrowser 2008-12-27 20:59 --------- d-----w c:\program files\Common Files\Canon 2008-12-26 19:30 --------- d-----w c:\program files\NOS 2008-12-26 19:30 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NOS 2008-12-22 09:25 --------- d-----w c:\documents and settings\[u]0[/u]07\Dane aplikacji\PCF-VLC 2008-12-22 09:24 --------- d-----w c:\documents and settings\[u]0[/u]07\Dane aplikacji\cenzura! Culture Foundation 2008-12-22 09:22 --------- d-----w c:\program files\cenzura! Culture Foundation 2008-12-22 09:09 --------- d-----w c:\program files\Common Files\xing shared 2008-12-22 09:09 --------- d-----w c:\program files\Common Files\Real 2008-12-22 09:08 499,712 ----a-w c:\windows\system32\msvcp71.dll 2008-12-22 08:39 --------- d-----w c:\documents and settings\[u]0[/u]07\Dane aplikacji\JLC's Software 2008-12-21 15:49 --------- d-----w c:\program files\Common Files\DirectX 2008-12-20 16:11 --------- d-----w c:\program files\NAPI-PROJEKT 2008-12-17 16:12 --------- d-----w c:\program files\Google 2008-12-16 12:33 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\winamp 2008-12-14 18:20 --------- d-----w c:\program files\MSBuild 2008-12-14 18:17 --------- d-----w c:\program files\Reference Assemblies 2008-12-10 16:37 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-12-04 18:12 249,592 ----a-w c:\windows\system32\cssdll32.dll 2004-10-01 14:00 40,960 ----a-w c:\program files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor1.dll" [2008-12-06 1784856] "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-12-04 66912] [HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}] [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-12-04 19:12 66912 --a------ c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}] 2008-12-06 13:30 1784856 --a------ c:\program files\TorrentMan\tbTor1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{7c5c0f58-e061-457d-9033-77307f5ed00c}"= "c:\program files\TorrentMan\tbTor1.dll" [2008-12-06 1784856] [HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{7C5C0F58-E061-457D-9033-77307F5ED00C}"= "c:\program files\TorrentMan\tbTor1.dll" [2008-12-06 1784856] [HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mxClock"="e:\programy\?wi1teczne\maydesign mxClock\mxClock.exe" [?] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2005-07-08 1397760] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2008-12-01 548864] "Adobe Photo Downloader"="e:\adobe photoshop\3.0\Apps\apdproxy.exe" [2005-06-06 57344] "COMODO SafeSurf"="c:\program files\COMODO\SafeSurf\cssurf.exe" [2008-12-04 278264] "GrooveMonitor"="e:\microsof office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "WinampAgent"="e:\deemon\winamp\winampa.exe" [2008-08-04 36352] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-04 206088] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560] "QuickTime Task"="e:\nowy folder\Nowy folder\qttask.exe" [2008-12-03 155648] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-22 185872] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "RTHDCPL"="RTHDCPL.EXE" [2006-05-27 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe] "NvMediaCenter"="NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll] c:\documents and settings\Natalia\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - e:\microsof office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\documents and settings\[u]0[/u]07\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - e:\microsof office\Office12\ONENOTEM.EXE [2006-10-26 98632] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 e:\adobe photoshop\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate] --a------ 2008-11-24 20:44 869888 e:\allplayer\ALLUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 16:02 490952 e:\deemon\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu] --a------ 2009-02-06 15:51 9302632 e:\nowe gadu\Nowe Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-12-03 21:22 155648 e:\nowy folder\Nowy folder\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 20:24 32768 c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-11-07 14:31 21633320 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 e:\sony ericsson\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "d:\\Twierdza\\Stronghold.exe"= "e:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "e:\\Programy\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Opera\\opera.exe"= "e:\\Bitlord\\BitLord.exe"= "e:\\Microsof Office\\Office12\\OUTLOOK.EXE"= "e:\\Microsof Office\\Office12\\GROOVE.EXE"= "e:\\Microsof Office\\Office12\\ONENOTE.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\E\\BearShare\\BearShare.exe"= "d:\\NFS MW\\speed.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "d:\\Igrzyska Zimowe 2007\\WinterApp.exe"= "d:\\Rockstar\\Rockstar Games Social Club\\RGSCLauncher.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-26 33752] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Settings,ProxyOverride = *.local IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksportuj do programu Microsoft Excel - e:\micros~1\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\[u]0[/u]07\Dane aplikacji\Mozilla\Firefox\Profiles\hae44xdx.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1640187&SearchSource=3&q= FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: network.proxy.type - 2 FF - component: c:\documents and settings\[u]0[/u]07\Dane aplikacji\Mozilla\Firefox\Profiles\hae44xdx.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll FF - component: c:\documents and settings\[u]0[/u]07\Dane aplikacji\Mozilla\Firefox\Profiles\hae44xdx.default\extensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll FF - plugin: c:\program files\Opera\program\plugins\np_gp.dll FF - plugin: c:\program files\Opera\program\plugins\nppdf32.dll FF - plugin: e:\mozilla\plugins\NPAskSBr.dll FF - plugin: e:\mozilla\plugins\NPMyGlSh.dll FF - plugin: e:\nowy folder\Nowy folder\Plugins\npqtplugin.dll FF - plugin: e:\nowy folder\Nowy folder\Plugins\npqtplugin2.dll FF - plugin: e:\nowy folder\Nowy folder\Plugins\npqtplugin3.dll FF - plugin: e:\nowy folder\Nowy folder\Plugins\npqtplugin4.dll FF - plugin: e:\nowy folder\Nowy folder\Plugins\npqtplugin5.dll FF - plugin: e:\nowy folder\Nowy folder\Plugins\npqtplugin6.dll FF - plugin: e:\nowy folder\Nowy folder\Plugins\npqtplugin7.dll FF - plugin: e:\tv 2\Netscape6\nppl3260.dll FF - plugin: e:\tv 2\Netscape6\nprjplug.dll FF - plugin: e:\tv 2\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-12 11:22:24 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-839522115-1078081533-2147040963-1004\Software\SecuROM\License information*] "datasecu"=hex:54,ef,d9,a4,d1,71,6f,86,de,99,eb,29,a3,f6,fa,fd,0b,5b,3b,34,2d, d1,f0,bd,b6,8f,85,ef,e1,2b,e5,df,12,63,ee,d0,e3,d7,48,8c,77,b9,2c,3c,79,34,\ "rkeysecu"=hex:1b,5f,ab,71,4f,98,c1,26,8b,10,12,4b,15,c8,28,90 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="42EA939524579B9DAB784DF62E2D457D548CBB33CB29EAE7ECF0E6035E0E94E293B94665BD471B8CEDF62BD69DC2213951B6C1567D9816DDFDD39FB5AB86554D6C17604356B2C0C4252456BBB14B80C82A42470FA769C5D2F4633EF39A4AA0C7FE8C634E385A69CDDA80F0E0DC0E34E1634231D6060558C66E698612500A88409F3993D412D2F6A23F9DE132F7238CAA236123D5B7ABB22F2AC081175648A0994AD07C5CF6854EB1252552D13D79624036D90CEC43F0BAF58EDDFB3F1ADE82289A17E71E5B2D5A5F825031954CD28F330D7C98AC90B85DF724C304786DF74A37D466E8851B5D0980F16F3186A8C47286BB2DBBDBEAC00B84178CEFE7FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC79338EDD5E5BE2F6E667BA7FD869164D67948AF14C3834AF30D5A489E76A00DF496657E32E19E555E7B664AEB0C175DC28698D2F8946561601960269EA60FA40591FE619AEDBF35CA1D4E3F800A1441F05684BDD91164FAC26B3471A6145502EEDCB213C145E69B0EBE79094D7833AD443901E0CDAE089CE282B99CED49E05BAF14715C5199785B6B348815C40EBEF597159471AE05A98EE5930FE0D4F6BC10B162033FE78712B682A04300148D11F1BE06CE73FA2A3AC8ECAA9E531619CD4D7CD1CD08AF3495DD4445AFB87029EA81E27A6090521569FC753B19E691E162CEE52AFA7DACFF0471E3BBF264A01338CF920199449E4FD6CC68F165D381EB2DF321F0AD4B7D530377A0C5C567360E2F4D96909DBBDF69A33CA5E5B3975FBBD261674875ABCD0BF9EB3788E16853DF1297CE370906867A039A9E136B0C9D7F8DDA4D63D9CD9134D14A905E45455B99E9BB5B7FD4BA148F664C9029123B6561A87790EF2E6D3EFFB504CFA25E28B7B965DEB4E13079830FA42A8E90DD30D1DC846C7A6A2E340C061B2A3E8C77923AA7BA51BD44323CEB8FB80D688F8ECF3592365D3EFFDA60EE1073B489D78B0EE77E6CDD2BD59E29A833EF5F791DEFAE53AB8D077FEE625F9B4EB126BAF19089391E1D7B5BFD26D24AF7997447B76EC337311999FAA7537199D81004CF7BB6289AFEC647B5562CEEAE6DA04880130187C3D23F34E11759B53842D71C393AB851D8AF93BEE3C6AF5BF518079A4222DB43AD1DCB917916673E3564AFA3A63E39A706170476F7608B6C81F005C0DA2C45FB6711F67A44F7AC2DB042651AE0D16B2F5732B96F0C906487F82E034C808811990DFBE9DB3B29BF41D82824E327AA53EF78879DD7A41E74532311EAD761FA1443BE584A216E96356E0CA956F6DD62B1493E99EF1272BE1AF81E82A97C47598AAFB4D2E5D30E1221932570A57981574ED3964504EA5985D67646466E678DF0BF86E676C5B7C525A51F0ABFC" . Czas ukończenia: 2009-02-12 11:23:20 ComboFix-quarantined-files.txt 2009-02-12 10:23:15 ComboFix2.txt 2009-02-12 10:14:55 ComboFix3.txt 2009-01-09 20:14:02 ComboFix4.txt 2009-01-09 17:39:40 Przed: 11 405 918 208 bajtów wolnych Po: 11,382,333,440 bajtów wolnych Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4 242 --- E O F --- 2009-02-11 10:00:49

ps. Posiadam Kav2009 oraz zapore XP.

Pozdrawiam.

**Posty:** 18165 · przez **wojtas** 12 Lut 2009, 17:07

daj loga z hijacka oraz

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 7 · przez **sebastiano999** 12 Lut 2009, 18:04

Pozdrawiam.

Dodano Dzisiaj, 17:05:
Log HT:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:04:37, on 2009-02-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Linksys\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe C:\Program Files\Linksys\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\WINDOWS\RTHDCPL.EXE E:\Adobe Photoshop\3.0\Apps\apdproxy.exe C:\Program Files\COMODO\SafeSurf\cssurf.exe E:\Microsof Office\Office12\GrooveMonitor.exe E:\deemon\winamp\winampa.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\RUNDLL32.EXE E:\Nowy folder\Nowy folder\qttask.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\system32\ctfmon.exe E:\Microsof Office\Office12\ONENOTEM.EXE E:\Programy\Gadu-Gadu\gg.exe E:\deemon\winamp\winamp.exe E:\EVEREST Home Edition\everest.bin C:\WINDOWS\system32\mmc.exe C:\Program Files\Opera\opera.exe E:\winrar\WinRAR.exe C:\DOCUME~1\007\USTAWI~1\Temp\Rar$EX00.891\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor1.dll R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor1.dll O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor1.dll O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Adobe Photo Downloader] "E:\Adobe Photoshop\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s O4 - HKLM\..\Run: [GrooveMonitor] "E:\Microsof Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [WinampAgent] E:\deemon\winamp\winampa.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "E:\Nowy folder\Nowy folder\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = E:\Microsof Office\Office12\ONENOTEM.EXE O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Linksys\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe -- End of file - 8620 bytes

**Posty:** 18165 · przez **wojtas** 12 Lut 2009, 23:40

odinstaluj w dodaj usun programy AskSBar