Logi - komputer długo mysli

**Posty:** 570 · przez **anded** 23 Gru 2008, 21:11

Witam. Od paru dni komputer dziwnie zwolnił. Przypuszczam że to wina jakiegoś syfu. Np. wchodząc w mój komputer dość długą chwile (~5 min) myśli żeby cokolwiek wyświetlić. Jak próbuje archiwum otworzyć winrarem to okno programu pokazuje się dopiero po ok 5 min.. Często programy wywalą brak odpowiedzi itp.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:12:41, on 2008-12-23 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Creative\Shared Files\CTDevSrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\NetMeter\NetMeter.exe C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Uzytki\do usuwania syfu\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm O8 - Extra context menu item: Pobierz plik wideo we Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Pobierz w Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{13A28F0C-131A-43D8-B7E9-FC72A5EC8E9C}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip\..\{13A28F0C-131A-43D8-B7E9-FC72A5EC8E9C}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip\..\{13A28F0C-131A-43D8-B7E9-FC72A5EC8E9C}: NameServer = 194.204.159.1,194.204.152.34 O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe -- End of file - 6490 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 59, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "C:\Program Files\NetMeter\NetMeter.exe" = "C:\Program Files\NetMeter\NetMeter.exe" [null data] "CTZDetec.exe" = "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" ["Creative Technology Ltd."] "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "DAEMON Tools Lite" = ""C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun" ["DT Soft Ltd"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NVMixerTray" = ""C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"" ["NVIDIA Corporation"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "avgnt" = ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] {CC59E0F9-7E43-44FA-9FAA-8377850BF205}\(Default) = (no title provided) -> {HKLM...CLSID} = "FDMIECookiesBHO Class" \InProcServer32\(Default) = "C:\Program Files\Free Download Manager\iefdm2.dll" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"OODBS" ["O&O Software GmbH"] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["Gabest"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["Gabest"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ a-squared Free Service, a2free, ""C:\Program Files\a-squared Free\a2service.exe"" ["Emsi Software GmbH"] Avira AntiVir Personal - Free Antivirus Guard, AntiVirService, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"] Avira AntiVir Personal - Free Antivirus Scheduler, AntiVirScheduler, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] CT Device Query service, CTDevice_Srv, "C:\Program Files\Creative\Shared Files\CTDevSrv.exe" ["Creative Technology Ltd"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] O&O Defrag, O&O Defrag, "C:\WINDOWS\system32\oodag.exe" ["O&O Software GmbH"] SbPF.Launcher, SbPF.Launcher, ""C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe"" ["Sunbelt Software, Inc."] Sunbelt Personal Firewall 4, SPF4, ""C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe"" ["Sunbelt Software, Inc."] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- (launch time: 2008-12-23 20:06:44) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 94 seconds. ---------- (total run time: 182 seconds)

**Posty:** 8001 · przez **Okocza** 23 Gru 2008, 21:28

anded, daj log z combofixa

**Posty:** 570 · przez **anded** 23 Gru 2008, 22:45

Okocza, proszę

Kod: Zaznacz wszystko: ComboFix 08-12-23.01 - Michał 2008-12-23 21:37:21.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.511.213 [GMT 1:00] Uruchomiony z: c:\documents and settings\Michał\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-23 do 2008-12-23 ))))))))))))))))))))))))))))))) . 2008-12-19 12:21 . 2008-12-22 15:05 <DIR> d-------- c:\program files\JAM2 2008-12-18 23:12 . 2008-12-18 23:16 <DIR> d-------- c:\program files\Total Video Converter 2008-12-18 22:35 . 2008-12-18 22:36 <DIR> d-------- c:\program files\AudioCommander 2008-12-16 23:02 . 2001-09-05 08:55 14,940 -ra------ c:\windows\system32\drivers\Epiusb.sys 2008-12-15 22:44 . 2008-12-15 22:44 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-12-15 22:40 . 2008-12-15 22:40 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-12-15 22:40 . 2008-12-15 22:40 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf 2008-12-15 22:40 . 2008-12-15 22:40 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf 2008-12-15 11:28 . 2008-04-14 00:15 26,112 --a------ c:\windows\system32\drivers\usbser.sys 2008-12-15 11:28 . 2008-04-14 00:15 26,112 --a--c--- c:\windows\system32\dllcache\usbser.sys 2008-12-15 11:27 . 2006-11-13 14:45 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll 2008-12-15 11:27 . 2007-06-18 14:18 23,680 --a------ c:\windows\system32\drivers\motmodem.sys 2008-12-15 11:27 . 2007-11-02 14:36 18,176 --a------ c:\windows\system32\drivers\motccgp.sys 2008-12-15 11:27 . 2007-01-22 18:33 7,680 --a------ c:\windows\system32\drivers\motccgpfl.sys 2008-12-15 11:27 . 2007-11-02 14:51 6,400 --a------ c:\windows\system32\drivers\motswch.sys 2008-12-15 11:08 . 2008-12-15 11:11 <DIR> d-------- c:\program files\Avanquest update 2008-12-15 11:06 . 2008-12-15 11:28 <DIR> d-------- c:\program files\Motorola Phone Tools 2008-12-15 11:06 . 2008-12-15 11:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\BVRP Software 2008-12-15 11:05 . 2008-12-15 11:05 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\InstallShield 2008-12-13 19:59 . 2008-12-15 11:27 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-12-13 19:58 . 2008-12-13 19:58 <DIR> d-------- c:\program files\Common Files\Motorola Shared 2008-12-03 17:15 . 2008-12-03 17:15 <DIR> d-------- c:\program files\uTorrent 2008-12-03 17:15 . 2008-12-05 12:12 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\uTorrent 2008-11-27 21:30 . 2008-11-27 21:36 93 --a------ c:\windows\WatchTVProEx.ini 2008-11-27 21:30 . 2008-11-27 21:36 82 --a------ c:\windows\WatchTVProEx-BDA.ini 2008-11-27 21:30 . 2008-11-27 21:36 80 --a------ c:\windows\MSBDA.INI 2008-11-27 19:02 . 2008-11-27 19:02 <DIR> d-------- c:\program files\FDRLab 2008-11-27 18:44 . 2008-11-27 18:44 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\FDRLab 2008-11-26 16:01 . 2008-11-26 16:01 4,096 --a------ c:\windows\d3dx.dat 2008-11-24 18:00 . 2008-11-24 19:19 <DIR> d-------- c:\program files\ABBYY FineReader 4.0 Sprint 2008-11-24 18:00 . 2008-11-24 18:00 492 --a------ c:\windows\MAXLINK.INI 2008-11-24 17:58 . 2002-04-15 15:08 196,608 -ra------ c:\windows\system32\SBMiniDrv.dll 2008-11-24 17:58 . 2003-05-13 17:02 118,784 -ra------ c:\windows\system32\MKCoInstaller.dll 2008-11-24 17:58 . 2003-02-18 09:08 17,504 -ra------ c:\windows\system32\drivers\gt680x.sys 2008-11-24 17:58 . 2001-11-29 14:17 8,192 -ra------ c:\windows\system32\drivers\SBfw.usb . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-23 20:42 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\Free Download Manager 2008-12-23 13:41 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-18 21:51 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2008-12-16 08:03 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\OpenOffice.org2 2008-12-15 10:27 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-07 11:50 --------- d-----w c:\program files\MoorHunt 2008-11-21 08:39 --------- d-----w c:\program files\Mathcad 2008-11-20 21:54 --------- d-----w c:\program files\Mathsoft 2008-11-20 21:52 --------- d-----w c:\program files\MSXML 4.0 2008-11-20 21:39 --------- d-----w c:\program files\Winamp 2008-11-20 21:39 --------- d-----w c:\program files\MP3 Remix 2008-11-20 21:37 --------- d-----w c:\program files\Hewlett-Packard 2008-11-19 21:27 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\Mathsoft 2008-11-17 09:06 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-01 18:45 --------- d-----w c:\program files\a-squared Free 2008-10-29 15:08 2,829 ----a-w c:\windows\War3Unin.pif 2008-10-29 15:08 139,264 ----a-w c:\windows\War3Unin.exe 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2007-08-11 331264] "CTZDetec.exe"="c:\program files\Creative\Creative Media Lite\CTZDetec.exe" [2007-12-18 401408] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-07-12 4112384] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-07-12 81920] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "nwiz"="nwiz.exe" [2004-07-12 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-09-02 269736] R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600] R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-07-30 95528] R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-07-30 1361192] R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-09-02 65576] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2008-12-15 18176] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2008-12-15 7680] . . ------- Skan uzupełniający ------- . IE: &Download All by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm IE: &Download by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm IE: Pobierz plik wideo we Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm IE: Pobierz w Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz wszystkie pliki w Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Pobierz zaznaczone w Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm TCP: {13A28F0C-131A-43D8-B7E9-FC72A5EC8E9C} = 194.204.159.1,194.204.152.34 FF - ProfilePath - c:\documents and settings\Michał\Dane aplikacji\Mozilla\Firefox\Profiles\2g8ghr8h.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official | www.wp.pl FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q= FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [color=red]ATTENTION: FIREFOX POLICES IS IN FORCE [/color] c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-23 21:42:03 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run CTZDetec.exe = c:\program files\Creative\Creative Media Lite\CTZDetec.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(2956) c:\program files\Gadu-Gadu\ggwhook.dll . Czas ukończenia: 2008-12-23 21:44:29 ComboFix-quarantined-files.txt 2008-12-23 20:44:23 Przed: 731 742 208 bajtów wolnych Po: 1,181,405,184 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 158 --- E O F --- 2008-12-18 10:01:15

**Posty:** 8001 · przez **Okocza** 23 Gru 2008, 22:58

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 570 · przez **anded** 24 Gru 2008, 16:28

Okocza, wszystko wykonane i są tez logi.

Wesołych Świąt

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Micha on 2008-12-24 at 15:09 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-24 15:13:28 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... IPC error: 2 Nie można odnaleźć określonego pliku. scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:4d,a7,f0,3c,b9,ed,97,fb,d3,fc,9a,91,81,0d,40,32,d9,b4,8b,43,b4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,99,bb,bb,f0,77,40,be,81,b1,e4,fa,73,e7,1a,d3,e3,af,.. "khjeh"=hex:1f,e3,c3,78,5d,2c,c4,de,e1,9f,4f,63,cd,c4,01,63,09,ee,68,71,c8,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:17,37,4b,c1,1d,08,05,77,e6,14,f3,22,53,18,c4,49,79,57,39,ae,05,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:4d,a7,f0,3c,b9,ed,97,fb,d3,fc,9a,91,81,0d,40,32,d9,b4,8b,43,b4,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,99,bb,bb,f0,77,40,be,81,b1,e4,fa,73,e7,1a,d3,e3,af,.. "khjeh"=hex:1f,e3,c3,78,5d,2c,c4,de,e1,9f,4f,63,cd,c4,01,63,09,ee,68,71,c8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:17,37,4b,c1,1d,08,05,77,e6,14,f3,22,53,18,c4,49,79,57,39,ae,05,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] "OODEFRAG10.00.00.01WORKSTATION"="CAC4CD11198AECEC5D50A6515750A215DF377D335C0A34D5B136FD8EAB935A98C861264A69F90CA5464D361238D36F442615B55BB36C642679A877B8EAB79321AC6D417D799F9FBC67ADF4B7239A5490F05DD16C0C12EDF1B2243F33F91E72693A423216248D9507D942FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E6679DB7CE019D40AA5CC038D530D6EB34520E780907CF7485B22D0F2D9345594F7AA37B4F6F6FFBE526A75C4ED8960A9C160227D1C0353119C6EE8D1C54DA6E6B0609B2ED5A24233B72C72E77D54189FACB12615D030D6DBA93581DC69C32B7FD7D45130776634CA7AE7C9CC7641FB7F34F664FD2738929046D12E15F7551C2F72923DC75D124B095364EA565B63A9A0C31694C428AE55CB33909B37BBA419470E23107F9CDE104187B8EFBD6521C316C974DE69B915D6FAC706F21951D1124A31ABFBBB5A09A66DF014F070993D5EBE2B984E3B4AAAFC07222B8E88C21D1DA70D2E557B2D351F246DFE7604D29F9AEDD66C83947C8A322AFF01F7FA2211819D724FDEAD9C50C34464473D6571621D4F4FE9415EFB201DA33929F0EFDC77FB18339A6BC7CA7D5A9016D516DBEB066A95E78A9D3B00593A3ED517B71A997A3EABB51C0C5CC7FBD49BAB1A4D902A2E96EF95C8B8B6E302D2BF68C373913E4A7807140F3B4E2A65679D87754077FECCFD8C6C602027477A19386351DAA0D583122B6EB2A6B3ACAB5966A3C8B14FB603E11696A1AB3EC714AF17CD13ABE4F6D677042D010FCB1EEF5711C8FB951A02562B4AB0C2350EA8C8251D8FB5E2172F6FB056E7D98B40DE7B74D459692C8F9346A54FA05B13B6506ACAF4364A033F4199DE9BB16F98F73DE9BE15A088BB1775F0B75E6431D0BB2722D7E84CAD708BA4C839ECBD1AF40EF53C95CF932E07C6E467C112547828C92BAEBA3890823E889DDE515E57A752AF2956C5C6373914B966178158E2542BE2618D47A660462D20AED833575704F69CECB3174794161748C7B3FE01F0800D4F09D5ACF50BDBB764D719DD888A702C8BB704C2F45A25682D1B295C9F82DA2375EAC70E5A0C698B7C431F95153A6194CD450F206F1363DB448FA4398E1E45980BBFD10F1D547A4AE46C9E25FAA88E2A71A8DE16B4FA923FC3A19120CBF141180391D342011F7D1290B2D253B8A7C6FC4ED9DD44152C25C8054295353A136013A6DE8DF8C982855A6B41F911013471642984B916191D9011C251ADA94B8561FE6D017164BD739A8DB43B77FFB05BD72F044B3DB96C9DA6ADDA3AE7E68D7962770412EE0DED92208311E644892494DDF5502C801A05A46B707A57D1BDB7AAC1B77000A4BC4526C75C310E7495B68F2832B44D0CD35C8AFCE0F69EF10EF3B60BECEB25BE56A" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000101 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Tue 2 Sep 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Mon 13 Nov 2006 319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-12-23.01 - Michał 2008-12-24 15:17:55.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.511.215 [GMT 1:00] Uruchomiony z: d:\uzytki\do usuwania syfu\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-24 do 2008-12-24 ))))))))))))))))))))))))))))))) . 2008-12-24 15:15 . 2008-12-24 15:16 <DIR> d-------- C:\32788R22FWJFW 2008-12-24 14:59 . 2008-12-24 15:14 <DIR> d-------- C:\SDFix 2008-12-19 12:21 . 2008-12-22 15:05 <DIR> d-------- c:\program files\JAM2 2008-12-18 23:12 . 2008-12-18 23:16 <DIR> d-------- c:\program files\Total Video Converter 2008-12-18 22:35 . 2008-12-18 22:36 <DIR> d-------- c:\program files\AudioCommander 2008-12-16 23:02 . 2001-09-05 08:55 14,940 -ra------ c:\windows\system32\drivers\Epiusb.sys 2008-12-15 22:44 . 2008-12-15 22:44 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-12-15 22:40 . 2008-12-15 22:40 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-12-15 22:40 . 2008-12-15 22:40 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf 2008-12-15 22:40 . 2008-12-15 22:40 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf 2008-12-15 11:28 . 2008-04-14 00:15 26,112 --a------ c:\windows\system32\drivers\usbser.sys 2008-12-15 11:28 . 2008-04-14 00:15 26,112 --a--c--- c:\windows\system32\dllcache\usbser.sys 2008-12-15 11:27 . 2006-11-13 14:45 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll 2008-12-15 11:27 . 2007-06-18 14:18 23,680 --a------ c:\windows\system32\drivers\motmodem.sys 2008-12-15 11:27 . 2007-11-02 14:36 18,176 --a------ c:\windows\system32\drivers\motccgp.sys 2008-12-15 11:27 . 2007-01-22 18:33 7,680 --a------ c:\windows\system32\drivers\motccgpfl.sys 2008-12-15 11:27 . 2007-11-02 14:51 6,400 --a------ c:\windows\system32\drivers\motswch.sys 2008-12-15 11:08 . 2008-12-15 11:11 <DIR> d-------- c:\program files\Avanquest update 2008-12-15 11:06 . 2008-12-15 11:28 <DIR> d-------- c:\program files\Motorola Phone Tools 2008-12-15 11:06 . 2008-12-15 11:08 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\BVRP Software 2008-12-15 11:05 . 2008-12-15 11:05 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\InstallShield 2008-12-13 19:59 . 2008-12-15 11:27 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-12-13 19:58 . 2008-12-13 19:58 <DIR> d-------- c:\program files\Common Files\Motorola Shared 2008-12-03 17:15 . 2008-12-03 17:15 <DIR> d-------- c:\program files\uTorrent 2008-12-03 17:15 . 2008-12-05 12:12 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\uTorrent 2008-11-27 21:30 . 2008-11-27 21:36 93 --a------ c:\windows\WatchTVProEx.ini 2008-11-27 21:30 . 2008-11-27 21:36 82 --a------ c:\windows\WatchTVProEx-BDA.ini 2008-11-27 21:30 . 2008-11-27 21:36 80 --a------ c:\windows\MSBDA.INI 2008-11-27 19:02 . 2008-11-27 19:02 <DIR> d-------- c:\program files\FDRLab 2008-11-27 18:44 . 2008-11-27 18:44 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\FDRLab 2008-11-26 16:01 . 2008-11-26 16:01 4,096 --a------ c:\windows\d3dx.dat 2008-11-24 18:00 . 2008-11-24 19:19 <DIR> d-------- c:\program files\ABBYY FineReader 4.0 Sprint 2008-11-24 18:00 . 2008-11-24 18:00 492 --a------ c:\windows\MAXLINK.INI 2008-11-24 17:58 . 2002-04-15 15:08 196,608 -ra------ c:\windows\system32\SBMiniDrv.dll 2008-11-24 17:58 . 2003-05-13 17:02 118,784 -ra------ c:\windows\system32\MKCoInstaller.dll 2008-11-24 17:58 . 2003-02-18 09:08 17,504 -ra------ c:\windows\system32\drivers\gt680x.sys 2008-11-24 17:58 . 2001-11-29 14:17 8,192 -ra------ c:\windows\system32\drivers\SBfw.usb . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-24 14:01 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\Free Download Manager 2008-12-24 13:47 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-18 21:51 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2008-12-16 08:03 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\OpenOffice.org2 2008-12-15 10:27 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-07 11:50 --------- d-----w c:\program files\MoorHunt 2008-11-21 08:39 --------- d-----w c:\program files\Mathcad 2008-11-20 21:54 --------- d-----w c:\program files\Mathsoft 2008-11-20 21:52 --------- d-----w c:\program files\MSXML 4.0 2008-11-20 21:39 --------- d-----w c:\program files\Winamp 2008-11-20 21:39 --------- d-----w c:\program files\MP3 Remix 2008-11-20 21:37 --------- d-----w c:\program files\Hewlett-Packard 2008-11-19 21:27 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\Mathsoft 2008-11-17 09:06 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-01 18:45 --------- d-----w c:\program files\a-squared Free 2008-10-29 15:08 2,829 ----a-w c:\windows\War3Unin.pif 2008-10-29 15:08 139,264 ----a-w c:\windows\War3Unin.exe 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-23_21.42.53,56 ))))))))))))))))))))))))))))))))))))))))) . - 2008-09-24 07:54:34 3,874,816 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-24 14:07:07 4,829,184 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-09-24 07:54:34 167,936 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-12-24 14:07:07 172,032 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2007-08-11 331264] "CTZDetec.exe"="c:\program files\Creative\Creative Media Lite\CTZDetec.exe" [2007-12-18 401408] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-07-12 4112384] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-07-12 81920] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "nwiz"="nwiz.exe" [2004-07-12 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2008-09-02 269736] R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600] R2 SbPF.Launcher;SbPF.Launcher;"c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe" [2008-07-30 95528] R2 SPF4;Sunbelt Personal Firewall 4;"c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe" [2008-07-30 1361192] R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\sbfwim.sys [2008-09-02 65576] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2008-12-15 18176] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2008-12-15 7680] . . ------- Skan uzupełniający ------- . IE: &Download All by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm IE: &Download by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm IE: Pobierz plik wideo we Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm IE: Pobierz w Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz wszystkie pliki w Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Pobierz zaznaczone w Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm TCP: {13A28F0C-131A-43D8-B7E9-FC72A5EC8E9C} = 194.204.159.1,194.204.152.34 FF - ProfilePath - c:\documents and settings\Michał\Dane aplikacji\Mozilla\Firefox\Profiles\2g8ghr8h.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://pl.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official | www.wp.pl FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q= FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [color=red]ATTENTION: FIREFOX POLICES IS IN FORCE [/color] c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-24 15:23:18 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run CTZDetec.exe = c:\program files\Creative\Creative Media Lite\CTZDetec.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-24 15:26:04 ComboFix-quarantined-files.txt 2008-12-24 14:25:58 ComboFix2.txt 2008-12-23 20:44:32 Przed: 1 173 626 880 bajtów wolnych Po: 1,216,548,864 bajtów wolnych 156 --- E O F --- 2008-12-18 10:01:15

**Posty:** 18165 · przez **wojtas** 24 Gru 2008, 19:22

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 570 · przez **anded** 25 Gru 2008, 15:51

1,3,4,5 wykonane logi poniżej.

Przy 2 jest problem system nie może znaleźć pliku msconfig

Komputer nadal dziwnie zwalnia. Programu uruchamiają się po dłuższym czasie np. odkurzacz odpalił się ok 10 min po uruchomieniu

Log z fixiedef <przez przypadek 2 razy dałem scan no i w ost5ateczności mam tylko log tego drugiego scanu>

Kaspersky nic nie wykrył.

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6162 * * * ******************************************************************************** Created at 12:51:59 on Thursday, December 25, 2008 Time Zone : Logged On User : Michał Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) XP 2000+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System System Drive Size : 10 GB System Drive Free : 1.66 GB Total Physical Memory: 511 MB Free Physical Memory : 215 MB Total Page File : 511 MB Free Page File : 997 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1969 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 25 Gru 2008, 16:01

Klikasz prawym przyciskiem myszy na Mój komputer => Właściwości => Sprzęt => Menadżer urządzeń => Kontrolery IDE ATA/ATAPI => Podstawowy kanał IDE => Ustawienia zaawansowane i sprawdź czy dysk pracuje w trybie PIO czy DMA. Sprawdz tez w pomocniczym kanale IDE. Jeśli w którymś kanale jest tryb PIO to klikasz na niego PPM i Odinstaluj. Po restarcie sprawdz czy jest lepiej

**Posty:** 570 · przez **anded** 25 Gru 2008, 16:30

Ma włączone DMA na wszystkich.

Czasem jest ok jak uruchomię komputer, Mój komputer się normalnie uruchamia i inne programy, a czasem jest tak jak napisałem w pierwszym poście

Kto jest na forum