mulenie pc (uzycie procesora 100 %)

**Posty:** 319 · przez **hugo91** 31 Maj 2008, 19:45

tak samo ja w temacie

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:45:40, on 2008-05-31 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE D:\PROGRAMY Z NETA\avast! 4.7\aswUpdSv.exe D:\PROGRAMY Z NETA\avast! 4.7\ashServ.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\FlashGet.exe D:\PROGRA~1\AVAST!~1.7\ashDisp.exe D:\Programy\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe C:\Program Files\Messenger\msmsgs.exe D:\PROGRAMY Z NETA\Ares\Ares.exe D:\Mariusz\Zegarynka\Zegarynka.exe C:\Program Files\VIA\RAID\raid_tool.exe D:\Piotrek\Program do cyfrówki\NkbMonitor.exe D:\Programy\Kalendarz\Kalendarz XP\Kalendarz.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe D:\PROGRAMY Z NETA\avast! 4.7\ashWebSv.exe D:\PROGRAMY Z NETA\avast! 4.7\ashMaiSv.exe C:\Program Files\DC++\DCPlusPlus.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jawnet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\getflash.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Flashget] "D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\FlashGet.exe" /min O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\AVAST!~1.7\ashDisp.exe O4 - HKLM\..\Run: [WinampAgent] D:\Programy\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\PROGRAMY Z NETA\Adobe Reader 8\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [CafeNews] D:\PROGRAMY Z NETA\Cafe News\CafeNews\CN.exe /autostart O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [WITaj!] rem -- Anulowane uruchamianie programu WITaj! 2000 O4 - HKCU\..\Run: [Gadu-Gadu] "D:\GG\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ares] "D:\PROGRAMY Z NETA\Ares\Ares.exe" -h O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe O4 - HKCU\..\Run: [Zegarynka] D:\Mariusz\Zegarynka\Zegarynka.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O4 - Global Startup: Kalendarz XP.lnk = D:\Programy\Kalendarz\Kalendarz XP\Start.exe O4 - Global Startup: NkbMonitor.exe.lnk = ? O8 - Extra context menu item: &Download All with FlashGet - D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\jc_link.htm O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000 O8 - Extra context menu item: Subskrybuj w Cafe News - D:\PROGRAMY Z NETA\Cafe News\CafeNews\addFeed.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRAMY Z NETA\FlashGet 1.9.6.1073\FlashGet.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\PROGRAMY Z NETA\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- End of file - 6449 bytes

**Posty:** 7956 · przez **Magik** 31 Maj 2008, 20:03

hugo91 napisał(a):tak samo ja w temacie

No comment--->jest regulamin tego działu?? jest :!:

Należy przestrzegąc więc sie zastosuj i stosuj

oprocz tegoc o wyzej standardowa litania do odmowienia
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Jakbys czytal regulamin tego dzialu to wstawilbys rowniez log z combofix'a

Kod: Zaznacz wszystko: R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

brudu sporo//usuwasz w trybie awaryjnym

Autor postu otrzymał pochwałę

**Posty:** 319 · przez **hugo91** 31 Maj 2008, 20:22

combo

Kod: Zaznacz wszystko: ComboFix 08-05-29.1 - piotrek 2008-05-31 20:18:24.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.0.1250.1.1045.18.545 [GMT 2:00] Running from: C:\Documents and Settings\piotrek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\FunWebProducts C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html C:\Program Files\internet explorer\msimg32.dll C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG C:\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]00135FF C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]02010DC C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0264964.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0264D2D.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0264F4F.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0265124.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0547537.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]054AA7F.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]054AD00.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]054AF33.bin C:\Program Files\MyWebSearch\bar\Cache\files.ini C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S C:\Program Files\MyWebSearch\bar\History\search2 C:\Program Files\MyWebSearch\bar\icons\CM.ICO C:\Program Files\MyWebSearch\bar\icons\MFC.ICO C:\Program Files\MyWebSearch\bar\icons\PSS.ICO C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO C:\Program Files\MyWebSearch\bar\icons\WB.ICO C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL C:\WINDOWS\system32\f3PSSavr.scr . ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-31 ))))))))))))))))))))))))))))))) . 2008-05-31 20:05 . 2008-02-26 04:41 3,107,788 -ra------ C:\WINDOWS\system32\ativvaxx.dat 2008-05-31 20:05 . 2008-02-26 04:41 3,107,788 -ra------ C:\WINDOWS\system32\ativva5x.dat 2008-05-31 20:05 . 2008-02-14 19:35 166,450 -ra------ C:\WINDOWS\system32\atiicdxx.dat 2008-05-31 20:04 . 2008-05-31 20:04 557,056 --a------ C:\WINDOWS\system32\drivers\SET12.tmp 2008-05-31 20:04 . 2008-05-31 20:05 524,288 --a------ C:\WINDOWS\system32\SET1B.tmp 2008-05-30 18:32 . 2001-08-17 22:03 123,264 --a------ C:\WINDOWS\system32\dllcache\usbport.sys 2008-05-30 18:32 . 2001-10-26 17:29 70,144 --a------ C:\WINDOWS\system32\dllcache\usbui.dll 2008-05-30 18:32 . 2001-08-17 22:03 50,688 --a------ C:\WINDOWS\system32\dllcache\usbhub.sys 2008-05-30 18:28 . 2008-05-30 18:28 <DIR> d--hs---- C:\FOUND.002 2008-05-30 18:23 . 2008-05-30 18:23 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-05-30 18:05 . 2008-05-30 18:05 557,056 --a------ C:\WINDOWS\system32\drivers\SET43.tmp 2008-05-30 18:04 . 2008-05-30 18:04 557,056 --a------ C:\WINDOWS\system32\drivers\SET42.tmp 2008-05-30 18:03 . 2008-05-30 18:03 524,288 --a------ C:\WINDOWS\system32\SET3F.tmp 2008-05-30 18:02 . 2008-05-30 18:03 557,056 --a------ C:\WINDOWS\system32\drivers\SET37.tmp 2008-05-30 18:02 . 2008-05-30 18:02 557,056 --a------ C:\WINDOWS\system32\drivers\SET36.tmp 2008-05-30 17:38 . 2008-05-30 17:38 <DIR> d-------- C:\ATI 2008-05-30 16:57 . 2008-05-30 16:57 557,056 --a------ C:\WINDOWS\system32\drivers\SETF.tmp 2008-05-30 16:54 . 2008-05-30 16:54 557,056 --a------ C:\WINDOWS\system32\drivers\SETE.tmp 2008-05-30 16:53 . 2001-08-17 22:00 2,944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys 2008-05-30 16:53 . 2001-08-17 22:00 2,944 --a------ C:\WINDOWS\system32\dllcache\msmpu401.sys 2008-05-30 16:33 . 2008-05-30 16:33 <DIR> d-------- C:\WINDOWS\LastGood 2008-05-30 16:33 . 2008-05-30 16:34 557,056 --a------ C:\WINDOWS\system32\drivers\SETC.tmp 2008-05-30 16:30 . 2008-05-30 16:30 6,717,440 --a------ C:\WINDOWS\system32\SET4B.tmp 2008-05-30 16:29 . 2008-05-30 16:30 1,507,328 --a------ C:\WINDOWS\system32\SET49.tmp 2008-05-30 16:28 . 2008-05-30 16:28 131,072 --a------ C:\WINDOWS\system32\SET44.tmp 2008-05-30 16:28 . 2008-05-30 16:28 0 --a------ C:\WINDOWS\system32\SET40.tmp 2008-05-30 16:27 . 2008-05-30 16:27 32,768 --a------ C:\WINDOWS\system32\SET37.tmp 2008-05-30 16:25 . 2008-05-30 16:25 524,288 --a------ C:\WINDOWS\system32\SET1E.tmp 2008-05-30 16:24 . 2008-05-30 16:24 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2008-05-30 16:21 . 2008-05-30 16:21 557,056 --a------ C:\WINDOWS\system32\drivers\SET30.tmp 2008-05-30 16:20 . 2008-05-30 16:21 557,056 --a------ C:\WINDOWS\system32\drivers\SET2F.tmp 2008-05-30 16:19 . 2008-05-30 16:19 32,768 --a------ C:\WINDOWS\system32\SET2D.tmp 2008-05-30 16:17 . 2008-05-30 16:17 1,441,792 --a------ C:\WINDOWS\system32\SET17.tmp 2008-05-30 16:17 . 2008-05-30 16:18 360,448 --a------ C:\WINDOWS\system32\SET1A.tmp 2008-05-30 16:16 . 2008-05-30 16:16 1,441,792 --a------ C:\WINDOWS\system32\SET16.tmp 2008-05-30 16:16 . 2008-05-30 16:16 557,056 --a------ C:\WINDOWS\system32\drivers\SET9.tmp 2008-05-30 16:15 . 2008-05-30 16:16 557,056 --a------ C:\WINDOWS\system32\drivers\SET8.tmp 2008-05-30 16:15 . 2008-05-30 16:15 557,056 --a------ C:\WINDOWS\system32\drivers\SET7.tmp 2008-05-30 16:14 . 2008-05-30 16:15 557,056 --a------ C:\WINDOWS\system32\drivers\SET6.tmp 2008-05-30 16:14 . 2008-05-30 16:14 557,056 --a------ C:\WINDOWS\system32\drivers\SET5.tmp 2008-05-29 17:58 . 2008-05-29 17:58 <DIR> d-------- C:\Documents and Settings\piotrek\PressService 2008-05-22 17:06 . 2008-05-22 17:06 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\Ashampoo 2008-05-22 17:06 . 2008-05-22 17:06 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-05-15 18:33 . 2008-05-15 18:33 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-05-15 18:23 . 2001-10-26 17:29 1,738,496 --a------ C:\WINDOWS\system32\nv4.dll 2008-05-15 18:23 . 2001-10-26 17:29 1,738,496 --a------ C:\WINDOWS\system32\dllcache\nv4.dll 2008-05-15 18:23 . 2001-08-17 20:50 731,648 --a------ C:\WINDOWS\system32\drivers\nv4.sys 2008-05-15 18:23 . 2001-08-17 20:50 731,648 --a------ C:\WINDOWS\system32\dllcache\nv4.sys 2008-05-11 11:35 . 2008-05-11 11:49 754 --a------ C:\WINDOWS\WORDPAD.INI 2008-05-07 20:02 . 2001-08-17 22:03 21,760 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-05-04 14:11 . 2004-03-02 17:37 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2008-05-04 14:11 . 2004-03-02 17:37 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2008-04-19 11:44 . 2008-04-19 11:44 <DIR> d-------- C:\Documents and Settings\piotrek\Dane aplikacji\CyberLink 2008-04-18 15:01 . 2008-04-18 15:01 <DIR> d--hs---- C:\FOUND.001 2008-04-10 19:49 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2008-04-10 19:49 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2008-04-10 19:49 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl 2008-04-10 19:49 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2008-04-10 19:49 . 2004-08-03 14:04 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2008-04-10 19:49 . 2004-08-03 14:03 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2008-04-10 19:49 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll 2008-04-10 19:41 . 2002-05-23 09:34 310,272 --a------ C:\WINDOWS\system32\winhttp.dll 2008-04-10 14:08 . 2008-04-10 14:08 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-04-04 12:33 . 2008-04-04 12:33 <DIR> d--h----- C:\WINDOWS\$MSI30UninstallMSI30-KB884016$ . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-26 03:10 299,520 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-02-26 03:01 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-02-26 02:49 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-02-26 02:16 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-02-21 16:20 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2008-02-21 16:20 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLds.DAT 2008-02-14 15:03 100,489 ----a-w C:\WINDOWS\UninstallFirefox.exe 2003-08-27 09:49 3,424 ----a-w C:\WINDOWS\inf\OTHER\cmiainfo.sys . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14 1077277] "WITaj!"="rem -- Anulowane uruchamianie programu WITaj! 2000" [] "Gadu-Gadu"="D:\GG\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392] "ares"="D:\PROGRAMY Z NETA\Ares\Ares.exe" [2007-12-31 15:29 962560] "Zegarynka"="D:\Mariusz\Zegarynka\Zegarynka.exe" [2003-11-16 23:27 1055232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "avast!"="D:\PROGRA~1\AVAST!~1.7\ashDisp.exe" [2008-05-16 01:19 79224] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-21 18:09 282624] "Adobe Reader Speed Launcher"="D:\PROGRAMY Z NETA\Adobe Reader 8\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "CafeNews"="D:\PROGRAMY Z NETA\Cafe News\CafeNews\CN.exe" [2007-06-28 14:43 1224704] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 17:29 13312] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Kalendarz XP.lnk - D:\Programy\Kalendarz\Kalendarz XP\Start.exe [2008-01-30 14:36:35 29696] NkbMonitor.exe.lnk - D:\Piotrek\Program do cyfr˘wki\NkbMonitor.exe [2008-02-21 18:12:33 118784] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-01-15 23:54 37376 D:\Programy\Winamp\winampa.exe R0 viasraid;viasraid;C:\WINDOWS\System32\DRIVERS\viasraid.sys [2003-08-05 07:14] R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-05-16 01:20] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-31 20:19:51 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-31 20:20:15 ComboFix-quarantined-files.txt 2008-05-31 18:20:12 Pre-Run: 4,201,594,880 bajtów wolnych Post-Run: 4,190,814,208 bajtów wolnych 222

hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:22:03, on 2008-05-31 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\PROGRAMY Z NETA\avast! 4.7\aswUpdSv.exe D:\PROGRAMY Z NETA\avast! 4.7\ashServ.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe D:\PROGRA~1\AVAST!~1.7\ashDisp.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Messenger\msmsgs.exe D:\PROGRAMY Z NETA\Ares\Ares.exe D:\Mariusz\Zegarynka\Zegarynka.exe D:\Programy\Kalendarz\Kalendarz XP\Kalendarz.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe D:\PROGRAMY Z NETA\avast! 4.7\ashWebSv.exe D:\PROGRAMY Z NETA\avast! 4.7\ashMaiSv.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\PROGRAMY Z NETA\Ares\chatServer.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\PROGRAMY Z NETA\avast! 4.7\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- End of file - 2239 bytes

**Posty:** 8001 · przez **Okocza** 31 Maj 2008, 20:24

hugo91 napisał(a):O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

do fixowania w hj

Autor postu otrzymał pochwałę

**Posty:** 7956 · przez **Magik** 31 Maj 2008, 20:27

Witam

no i dobra...HJT juz czysty.........przeprowadz jeszcze te operacje z postu pierwszego czyli czyszczenie kompa i powinno byc gut

**Posty:** 319 · przez **hugo91** 31 Maj 2008, 20:39

jest git eot

mulenie pc (uzycie procesora 100 %)

mulenie pc (uzycie procesora 100 %)

Kto jest na forum