Nagłe zwolnienie wszystkiego

**Posty:** 369 · przez **Mati92** 26 Lut 2009, 22:46

Witam mój problem polega na tym, że nagle system zaczął mi chodzić strasznie wolno a strony wczytują się długo a nie mówiąc już o obrazkach na niej.

oto log z HijackThis.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:45:32, on 2009-02-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20627) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Chrypek\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Rapget] C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.exe O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: Download with Rapget - C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38039F3B-2F3B-4E66-916D-C3235E49BFDF}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 6677 bytes

**Posty:** 18165 · przez **wojtas** 27 Lut 2009, 14:36

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 369 · przez **Mati92** 27 Lut 2009, 15:44

oto logi:

combofix:

Kod: Zaznacz wszystko: ComboFix 09-02-26.02 - Chrypek 2009-02-27 14:35:59.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.612 [GMT 1:00] Uruchomiony z: c:\documents and settings\Chrypek\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ISODRIVE -------\Service_ISODrive ((((((((((((((((((((((((( Pliki utworzone od 2009-01-27 do 2009-02-27 ))))))))))))))))))))))))))))))) . 2009-02-27 14:15 . 2009-02-27 14:15 642,560 --a------ c:\windows\system32\dllcache\user32.dll 2009-02-27 14:12 . 2009-02-27 14:31 <DIR> d-------- C:\SDFix 2009-02-26 21:54 . 2009-02-27 14:14 <DIR> d-------- c:\windows\ERUNT 2009-02-26 21:54 . 2009-02-26 21:54 <DIR> d-------- C:\fsaua.data 2009-02-26 21:54 . 2009-02-26 21:54 <DIR> d-------- C:\ERDNT 2009-02-26 21:54 . 2009-02-26 21:54 <DIR> d-------- C:\!FixIEDef 2009-02-26 18:52 . 2009-02-27 08:47 <DIR> d-------- c:\program files\Unlocker 2009-02-26 18:52 . 2009-02-26 18:59 <DIR> d-------- c:\documents and settings\Chrypek\Dane aplikacji\Desktopicon 2009-02-26 18:29 . 2009-02-26 18:43 <DIR> d-------- c:\program files\WinPcap 2009-02-26 18:28 . 2009-02-26 18:43 <DIR> d-------- c:\program files\Cain 2009-02-26 16:26 . 2009-02-26 16:26 <DIR> d--h----- c:\windows\system32\GroupPolicy 2009-02-26 12:00 . 2008-03-21 13:57 23,856 --a------ c:\windows\system32\spupdsvc.exe 2009-02-26 12:00 . 2008-03-21 13:57 14,640 --------- c:\windows\system32\spmsgXP_2k3.dll 2009-02-26 12:00 . 2009-02-26 12:00 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-02-26 12:00 . 2009-02-26 12:00 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf 2009-02-26 11:40 . 2009-02-26 11:40 1,107,296 --a------ c:\windows\system32\WdfCoInstaller01007.dll 2009-02-26 11:40 . 2009-02-26 11:40 24,616 --a------ c:\windows\system32\drivers\ggsemc.sys 2009-02-26 11:40 . 2009-02-26 11:40 13,224 --a------ c:\windows\system32\drivers\ggflt.sys 2009-02-26 11:09 . 2008-05-12 13:15 122,024 --a------ c:\windows\system32\drivers\s3117mdm.sys 2009-02-26 11:09 . 2008-05-12 13:15 117,544 --a------ c:\windows\system32\drivers\s3117unic.sys 2009-02-26 11:09 . 2008-05-12 13:15 115,368 --a------ c:\windows\system32\drivers\s3117mgmt.sys 2009-02-26 11:09 . 2008-05-12 13:15 111,784 --a------ c:\windows\system32\drivers\s3117obex.sys 2009-02-26 11:09 . 2008-05-12 13:15 90,408 --a------ c:\windows\system32\drivers\s3117bus.sys 2009-02-26 11:09 . 2008-05-12 13:15 25,768 --a------ c:\windows\system32\drivers\s3117nd5.sys 2009-02-26 11:09 . 2008-05-12 13:15 15,016 --a------ c:\windows\system32\drivers\s3117mdfl.sys 2009-02-26 11:09 . 2008-05-12 13:15 12,200 --a------ c:\windows\system32\drivers\s3117whnt.sys 2009-02-26 11:09 . 2008-05-12 13:15 12,200 --a------ c:\windows\system32\drivers\s3117wh.sys 2009-02-26 11:09 . 2008-05-12 13:15 12,200 --a------ c:\windows\system32\drivers\s3117cmnt.sys 2009-02-26 11:09 . 2008-05-12 13:15 12,200 --a------ c:\windows\system32\drivers\s3117cm.sys 2009-02-26 11:09 . 2008-05-12 13:15 10,792 --a------ c:\windows\system32\drivers\s3117cr.sys 2009-02-26 11:08 . 2009-02-26 17:48 <DIR> d----c--- c:\windows\system32\DRVSTORE 2009-02-26 11:08 . 2009-02-26 17:48 <DIR> d-------- c:\program files\Sony Ericsson 2009-02-25 14:00 . 2009-02-25 14:00 <DIR> d-------- c:\program files\Microsoft Silverlight 2009-02-23 22:49 . 2009-02-24 12:15 217 --a------ c:\windows\wcx_ftp.ini 2009-02-23 22:48 . 2009-02-24 12:15 855 --a------ c:\windows\wincmd.ini 2009-02-23 22:48 . 2008-08-08 07:04 545 --a------ c:\windows\UC.PIF 2009-02-23 22:48 . 2008-08-08 07:04 545 --a------ c:\windows\RAR.PIF 2009-02-23 22:48 . 2008-08-08 07:04 545 --a------ c:\windows\PKZIP.PIF 2009-02-23 22:48 . 2008-08-08 07:04 545 --a------ c:\windows\PKUNZIP.PIF 2009-02-23 22:48 . 2008-08-08 07:04 545 --a------ c:\windows\NOCLOSE.PIF 2009-02-23 22:48 . 2008-08-08 07:04 545 --a------ c:\windows\LHA.PIF 2009-02-23 22:48 . 2008-08-08 07:04 545 --a------ c:\windows\ARJ.PIF 2009-02-13 14:31 . 2009-02-13 14:43 <DIR> d-------- c:\program files\Metin2_PL 2009-02-09 18:10 . 2009-02-09 18:11 <DIR> d-------- c:\program files\VS Online 2009-02-09 14:25 . 2009-02-09 14:25 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2009-02-09 14:06 . 2009-02-09 14:06 <DIR> d-------- c:\program files\EA GAMES 2009-02-09 14:06 . 2008-03-13 02:10 445,504 -ra------ c:\windows\system32\vp6vfw.dll 2009-02-08 21:29 . 2009-02-08 21:30 <DIR> d-------- c:\documents and settings\Chrypek\Dane aplikacji\DivX 2009-02-08 21:27 . 2009-02-10 06:47 <DIR> d-------- c:\program files\DivX 2009-02-08 20:52 . 2009-02-08 21:01 <DIR> d-------- c:\program files\YouTube Video Downloader 2009-02-08 20:44 . 2007-02-25 15:36 383,238 --a------ c:\windows\system32\libmp3lame-0.dll 2009-02-08 20:37 . 2009-02-08 20:37 <DIR> d-------- c:\windows\Applian FLV Player 2009-02-08 20:37 . 2009-02-08 20:37 <DIR> d-------- c:\program files\FLV Player 2009-01-29 15:57 . 2009-01-29 15:57 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\FlashFXP 2009-01-28 15:41 . 2009-02-14 09:25 69 --a------ c:\windows\NeroDigital.ini 2009-01-27 18:28 . 2009-01-27 18:28 <DIR> d-------- c:\documents and settings\Sandra\Dane aplikacji\Nero 2009-01-27 15:40 . 2009-01-27 15:40 <DIR> d-------- c:\documents and settings\Chrypek\Dane aplikacji\ipla 2009-01-27 15:40 . 2009-01-27 15:40 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ipla 2009-01-27 15:39 . 2009-01-27 15:40 <DIR> d-------- c:\program files\ipla 2009-01-27 15:39 . 2009-01-27 15:39 1,700,352 --a------ c:\windows\system32\gdiplus.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-27 13:38 --------- d-----w c:\program files\AutoConnect 2009-02-27 13:08 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\foobar2000 2009-02-27 07:47 --------- d-----w c:\program files\Google 2009-02-26 20:34 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-02-26 19:22 --------- d-----w c:\program files\QuickTime 2009-02-26 19:22 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\uTorrent 2009-02-26 17:19 501,248 ----a-w c:\windows\Help\PROWOKATOR_GG1.4.EXE 2009-02-26 15:16 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-14 22:09 --------- d-----w c:\program files\Asystent Plusfon 401i 2009-02-08 19:46 --------- d-----w c:\program files\ALLPlayer 2009-02-08 18:30 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2009-02-08 16:21 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\Image Zone Express 2009-02-06 17:12 --------- d-----w c:\program files\Gadu-Gadu 2009-01-26 19:57 --------- d-----w c:\program files\NeroInstall.bak 2009-01-26 19:56 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\Nero 2009-01-26 19:55 --------- d-----w c:\program files\Common Files\Nero 2009-01-26 19:53 --------- d-----w c:\program files\Nero 2009-01-26 19:53 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Nero 2009-01-25 08:15 --------- d-----w c:\program files\Common Files\Adobe 2009-01-25 08:10 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\AdobeUM 2009-01-25 07:44 --------- d-----w c:\program files\microsoft frontpage 2009-01-21 16:04 --------- d-----w c:\program files\uTorrent 2009-01-21 13:07 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-01-21 13:07 --------- d-----w c:\program files\Java 2009-01-21 10:58 --------- d-----w c:\program files\Common Files\Apple 2009-01-21 10:58 --------- d-----w c:\program files\Apple Software Update 2009-01-21 10:58 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2009-01-21 10:58 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2009-01-21 10:57 --------- d-----w c:\program files\DirectShow Pack 2009-01-20 12:33 --------- d-----w c:\program files\MSBuild 2009-01-20 12:33 --------- d-----w c:\program files\Microsoft Works 2009-01-20 12:31 --------- d-----w c:\program files\Microsoft.NET 2009-01-20 12:30 --------- d-----w c:\program files\Microsoft Visual Studio 8 2009-01-18 17:46 --------- d-----w c:\program files\HP 2009-01-18 17:42 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant 2009-01-18 17:35 139,264 ----a-w c:\windows\system32\hpzjrd01.dll 2009-01-18 17:25 --------- d-----w c:\program files\Common Files\HP 2009-01-18 17:25 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP 2009-01-18 17:23 --------- d-----w c:\program files\Common Files\Hewlett-Packard 2009-01-18 17:17 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\HP 2009-01-18 16:39 --------- d-----w c:\documents and settings\Sandra\Dane aplikacji\Media Player Classic 2009-01-18 16:39 --------- d-----w c:\documents and settings\Sandra\Dane aplikacji\DivX 2009-01-18 10:04 --------- d-----w c:\program files\Native Instruments 2009-01-17 20:35 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-01-17 20:13 --------- d-----w c:\documents and settings\Sandra\Dane aplikacji\Gadu-Gadu 2009-01-17 20:09 --------- d-----w c:\documents and settings\Sandra\Dane aplikacji\ESET 2009-01-17 19:54 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\FLEXnet 2009-01-17 19:41 --------- d-----w c:\program files\Bonjour 2009-01-17 19:32 --------- d-----w c:\program files\Common Files\Macrovision Shared 2009-01-17 13:57 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\Media Player Classic 2009-01-17 09:47 --------- d-----w c:\program files\UltraISO 2009-01-17 09:47 --------- d-----w c:\program files\Common Files\EZB Systems 2009-01-17 09:26 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\Gadu-Gadu 2009-01-16 23:34 --------- d-----w c:\program files\Real Alternative 2009-01-16 23:33 --------- d-----w c:\program files\K-Lite Codec Pack 2009-01-16 23:33 --------- d-----w c:\program files\foobar2000 2009-01-16 23:31 --------- d-----w c:\program files\CCleaner 2009-01-16 23:26 --------- d-----w c:\program files\Thomson 2009-01-16 23:26 --------- d-----w c:\documents and settings\Chrypek\Dane aplikacji\ESET 2009-01-16 23:25 --------- d-----w c:\program files\ESET 2009-01-16 23:25 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET 2009-01-16 23:23 --------- d-----w c:\program files\Realtek Sound Manager 2009-01-16 23:23 --------- d-----w c:\program files\Common Files\InstallShield 2009-01-16 23:23 --------- d-----w c:\program files\AvRack 2009-01-16 23:21 472,576 ----a-w c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe 2009-01-16 23:21 --------- d-----w c:\program files\Radeon Omega Drivers 2009-01-16 23:21 --------- d-----w c:\program files\MultiRes 2009-01-16 23:15 --------- d-----w c:\program files\Usługi online 2009-01-16 23:13 --------- d-----w c:\program files\Windows Media Connect 2 2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll 2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll 2008-12-08 11:53 57,344 ----a-w c:\windows\system32\ff_vfw.dll . ------- Sigcheck ------- 2007-07-10 14:06 642560 ce594e18fe0d0af804f1f3694921ce62 c:\windows\system32\user32.dll 2009-02-27 14:15 642560 ce594e18fe0d0af804f1f3694921ce62 c:\windows\system32\dllcache\user32.dll 2008-10-16 21:33 826368 ae07c4b0da51517cffb9c20c4a6df4a3 c:\windows\SoftwareDistribution\Download\f55b8c7241a4bd71036722b6a2dd2d85\SP2GDR\wininet.dll 2008-10-16 20:49 827904 8663aad6958c7b091eb0fd6ed74559dd c:\windows\SoftwareDistribution\Download\f55b8c7241a4bd71036722b6a2dd2d85\SP2QFE\wininet.dll 2007-07-13 23:56 814592 ce7193c5f7c01b19768e066087c1c919 c:\windows\system32\wininet.dll 2007-10-16 00:19 360576 0fb6743e937c7bb248b2530a5a77abc6 c:\windows\system32\drivers\tcpip.sys 2007-10-18 23:19 2066816 9aa8aeee2c77b68af93691758eb0a78b c:\windows\system32\ntkrnlpa.exe 2007-10-18 23:19 2189824 1aeb1a9aa55de24bda1d441989ae4492 c:\windows\system32\ntoskrnl.exe 2007-10-17 20:30 974848 16df8a100e8966e48ba00c86f6c89972 c:\windows\explorer.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2004-08-28 295424] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-01-20 1451248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168] "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "Rapget"="c:\documents and settings\Chrypek\Pulpit\Rapget\rapget.exe" [2008-06-03 171008] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2007-10-09 c:\windows\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Chrypek^Menu Start^Programy^Autostart^lsass.exe] path=c:\documents and settings\Chrypek\Menu Start\Programy\Autostart\lsass.exe backup=c:\windows\pss\lsass.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate] --a------ 2008-11-24 20:44 869888 c:\program files\ALLPlayer\ALLUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2007-05-08 16:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2008-02-28 17:07 1828136 c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPLA!] --a------ 2008-12-23 11:33 2794232 c:\program files\ipla\ipla.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2008-02-18 16:29 2221352 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2008-02-28 09:59 570664 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rapget] --a------ 2008-06-03 20:29 171008 c:\documents and settings\Chrypek\Pulpit\Rapget\rapget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] --------- 2008-09-16 12:16 1833296 c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2009-01-21 14:07 136600 c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VS Online] --a------ 2008-10-03 19:16 1098752 c:\program files\VS Online\VSOnline.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA] --a------ 2006-02-22 02:05 344064 c:\windows\system32\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] -ra------ 2005-05-17 11:48 77824 c:\windows\SOUNDMAN.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Metin2_PL\\metin2.bin"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [2007-10-17 16640] R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-06-10 468224] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-02-26 13224] S3 MobileAdapter;Huawei Mobile Adapter USB Modem and USB Serial;c:\windows\system32\drivers\hmumdm.sys [2009-01-23 88960] S3 s3117bus;Sony Ericsson Device 3117 driver (WDM);c:\windows\system32\drivers\s3117bus.sys [2009-02-26 90408] S3 s3117mdfl;Sony Ericsson Device 3117 USB WMC Modem Filter;c:\windows\system32\drivers\s3117mdfl.sys [2009-02-26 15016] S3 s3117mdm;Sony Ericsson Device 3117 USB WMC Modem Driver;c:\windows\system32\drivers\s3117mdm.sys [2009-02-26 122024] S3 s3117mgmt;Sony Ericsson Device 3117 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s3117mgmt.sys [2009-02-26 115368] S3 s3117nd5;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (NDIS);c:\windows\system32\drivers\s3117nd5.sys [2009-02-26 25768] S3 s3117obex;Sony Ericsson Device 3117 USB WMC OBEX Interface;c:\windows\system32\drivers\s3117obex.sys [2009-02-26 111784] S3 s3117unic;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (WDM);c:\windows\system32\drivers\s3117unic.sys [2009-02-26 117544] . . ------- Skan uzupełniający ------- . uStart Page = about:blank uInternet Settings,ProxyOverride = *.local IE: Download with Rapget - c:\documents and settings\Chrypek\Pulpit\Rapget\rapget.htm IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 TCP: {38039F3B-2F3B-4E66-916D-C3235E49BFDF} = 194.204.159.1 217.98.63.164 FF - ProfilePath - c:\documents and settings\Chrypek\Dane aplikacji\Mozilla\Firefox\Profiles\hombttv1.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-27 14:38:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1068) c:\windows\system32\Ati2evxx.dll c:\windows\system32\cscui.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe c:\windows\system32\IoctlSvc.exe c:\windows\system32\HPZipm12.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-02-27 14:40:35 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-02-27 13:40:33 Przed: 8 716 189 696 bajtów wolnych Po: 8,667,009,024 bajtów wolnych 315

SDFix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Chrypek on 2009-02-27 at 14:16 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-27 14:30:39 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000158 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3" "C:\\Program Files\\Metin2_PL\\metin2.bin"="C:\\Program Files\\Metin2_PL\\metin2.bin:*:Enabled:metin2" "C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"="C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe:*:Enabled:Update Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\FlashFXP\\FlashFXP.exe"="C:\\Program Files\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll" Thu 14 Aug 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Wed 30 Jul 2008 4,891,984 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll" [b]Finished![/b]

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:43:58, on 2009-02-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20627) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Chrypek\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Rapget] C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.exe O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: Download with Rapget - C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{38039F3B-2F3B-4E66-916D-C3235E49BFDF}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 6893 bytes

**Posty:** 18165 · przez **wojtas** 27 Lut 2009, 20:34

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\~\startupfolder\C:^Documents and Settings^Chrypek^Menu Start^Programy^Autostart^lsass.exe]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.