problem z ventrilo

[Mao666]

Ventrilo posiadam juz ponad rok i nigdy nie mialem z nim problemow jednak od kilku dni regularnie zawiesza sie gdy rozmawiam i gram w gre (wczesniej chodzilo doskonale) zamieszczam swoje logi

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:29:41, on 2008-03-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hotkey\Hotkey.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Gadu-Gadu\gg.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\User\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\szczepionki.exe
C:\Documents and Settings\User\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Give4Free Plugin Installer - {208E7E77-507A-4649-B0C9-D39E9049C7A2} - C:\Program Files\Give4Free Plugin\ibho1.dll (file missing)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O3 - Toolbar: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Hotkey] C:\Program Files\Hotkey\Hotkey.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AVPDWIN] "C:\Program Files\Panda Software\Panda Demo\pandasft.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [LXDDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\User\Dane aplikacji\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_64.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_22.cab
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Seekmo/ie/bridge-c567.cab?0407451f125bb4702ef22c41b34bd5979c
5516009691352983
5d16a72533d83b2e3f66b7061404865d208e54adc74b1fca7477cb89ffd
e9ea6bac6a5dfd81ba8c3f1f16ecc:155ff7b6a3c39e5d13b88244eaad9a2e
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D6CC12B-F336-4CEA-9C6E-7C3CC6B597EC}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: lxdd_device -   - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=4
O24 - Desktop Component 1: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=5
O24 - Desktop Component 2: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=6
O24 - Desktop Component 3: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=7

--
End of file - 16603 bytes


Prosze o pomoc i z gory dziekuje

[Dzi@dek]

odinstaluj w dodaj usun programy Desktop Messenger

Start-uruchom-msconfig [enter] -> zakładka uruchamianie - odznacz zbędne programy w autostarcie [ restart]

Usuwasz wpisy w hijackthis:

F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: Give4Free Plugin Installer - {208E7E77-507A-4649-B0C9-D39E9049C7A2} - C:\Program Files\Give4Free Plugin\ibho1.dll (file missing)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)

O4 - HKLM\..\Run: [AVPDWIN] "C:\Program Files\Panda Software\Panda Demo\pandasft.exe"

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb124\Dealio.dll (file missing)
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Seekmo/ie/bridge-c567.cab?0407451f125bb4702ef22c 41b34bd5979c55160096913529835d16a72533d83b2e3f66b7061404865d208e54adc74b1fca7477 cb89ffde9ea6bac6a5dfd81ba8c3f1f16ecc:155ff7b6a3c39e5d13b88244eaad9a2e

Pogrubiony katalog usuwasz ręcznie do kosza ( pozostalość po demo )

Pobierz i zastosuj:
http://www.programosy.pl/program,atf-cleaner.html

i na koniec daj logi z Combofix oraz Hijackthis.

[Mao666]

Prosze tu masz nowe logi z Hijackthis i Combofix

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:16:28, on 2008-03-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hotkey\Hotkey.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\User\Pulpit\HiJackThis.exe
C:\Program Files\Common Files\Real\Update_OB\rndal.exe
C:\Program Files\Common Files\Real\Update_OB\rndal.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Hotkey] C:\Program Files\Hotkey\Hotkey.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [LXDDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\User\Dane aplikacji\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_64.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_22.cab
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D6CC12B-F336-4CEA-9C6E-7C3CC6B597EC}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: lxdd_device -   - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=4
O24 - Desktop Component 1: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=5
O24 - Desktop Component 2: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=6
O24 - Desktop Component 3: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=7

--
End of file - 13393 bytes

Kod: Zaznacz wszystko

ComboFix 08-03-01.3 - User 2008-03-02 17:18:23.1 - NTFSx86

Running from: C:\Documents and Settings\User\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\uninstall.exe

.
(((((((((((((((((((((((((   Files Created from 2008-02-02 to 2008-03-02  )))))))))))))))))))))))))))))))
.

2008-03-02 17:11 . 2008-03-02 17:11   <DIR>   d--------   C:\logs
2008-03-02 16:21 . 2004-08-04 00:44   395,776   --a------   C:\CF22255.exe
2008-03-01 18:11 . 2008-03-01 18:11   0   -ra------   C:\logwmemory.bin
2008-02-28 15:17 . 2008-02-28 15:17   <DIR>   d--------   C:\Program Files\Opera
2008-02-27 20:45 . 2008-02-27 20:45   <DIR>   d--------   C:\Program Files\VentriloMIX
2008-02-27 13:49 . 2008-02-27 14:01   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\GeoVid
2008-02-27 13:49 . 2004-08-18 15:00   1,712,128   --a------   C:\WINDOWS\system32\gdiplus.dll
2008-02-27 13:49 . 2005-06-07 15:11   60,416   --a------   C:\WINDOWS\system32\dsetup.dll
2008-02-27 13:34 . 2008-02-27 13:34   <DIR>   d--------   C:\Program Files\MyTubePlayer
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Program Files\Vstplugins
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Sony
2008-02-27 13:07 . 2008-02-27 13:07   <DIR>   d--------   C:\Program Files\Sony
2008-02-27 13:04 . 2008-02-27 13:05   <DIR>   d--------   C:\Program Files\Vegas Movie Studio 8.0
2008-02-27 11:16 . 2008-02-27 11:16   <DIR>   d--------   C:\Wimpy Desktop FLV Player 2
2008-02-27 10:27 . 2008-02-27 10:27   <DIR>   d--------   C:\Program Files\Orbitdownloader
2008-02-27 10:27 . 2008-03-02 16:32   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Orbit
2008-02-27 10:21 . 2008-02-27 10:21   <DIR>   d--------   C:\Firefox VideoDownloader 1.1.1
2008-02-27 10:18 . 2008-02-27 10:19   <DIR>   d--------   C:\Youtube Grabber 1.0
2008-02-26 15:32 . 2008-02-26 15:32   <DIR>   d--------   C:\Documents and Settings\User\.thumbnails
2008-02-26 15:09 . 2008-02-26 16:57   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.4
2008-02-26 15:06 . 2008-02-26 15:06   <DIR>   d--------   C:\Program Files\GIMP-2.0
2008-02-25 16:41 . 2008-02-25 16:42   <DIR>   d--------   C:\Hamachi
2008-02-25 16:16 . 2008-02-25 16:45   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Hamachi
2008-02-25 09:48 . 2008-02-26 12:34   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.2
2008-02-20 21:33 . 2006-10-31 19:55   5,656,576   --a------   C:\WINDOWS\system32\RLVirDev.ocx
2008-02-10 14:58 . 2008-02-10 14:58   <DIR>   d--------   C:\Program Files\PicSort

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 16:21   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Skype
2008-03-02 16:18   ---------   d-----w   C:\Program Files\Kalendarz XP
2008-03-02 16:12   ---------   d-----w   C:\Program Files\Lx_cats
2008-03-02 16:09   ---------   d-----w   C:\Program Files\Neostrada TP
2008-03-02 15:27   ---------   d-----w   C:\Program Files\Logitech
2008-03-02 15:24   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Dealio
2008-03-01 17:35   ---------   d--h--w   C:\Program Files\Give4Free Plugin
2008-02-29 21:44   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-02-27 12:26   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Sony
2008-02-26 10:49   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\Skype
2008-02-25 15:41   25,280   ----a-w   C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-25 10:55   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-01-21 14:45   ---------   d---a-w   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 14:12   ---------   d-----w   C:\Program Files\FlashGet
2008-01-19 11:32   ---------   d-----w   C:\Program Files\Belt Generator
2008-01-19 11:20   3,350   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-15 15:39   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\FaxCtr
2008-01-15 15:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\MegauploadToolbar
2008-01-15 15:17   ---------   d-----w   C:\Program Files\MegauploadToolbar
2008-01-15 14:56   ---------   d-----w   C:\Program Files\Tlen.pl
2008-01-12 14:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Tlen.pl
2008-01-10 12:17   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Publish Providers
2008-01-08 20:20   ---------   d-----w   C:\Program Files\Send File
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLds.DAT
2008-01-04 17:27   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\teamspeak2
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2007-09-03 11:44   0   ----a-w   C:\Documents and Settings\User\foczkiro.exe
2007-09-01 08:08   3,800   ----a-w   C:\Program Files\INSTALL.LOG
2005-11-15 18:25   66,880   ----a-w   C:\Documents and Settings\User\Dane aplikacji\GDIPFONTCACHEV1.DAT
2005-10-24 14:31   774,144   ----a-w   C:\Program Files\RngInterstitial.dll
2005-03-08 16:12   21,792   ----a-w   C:\Documents and Settings\Mikołaj\Dane aplikacji\GDIPFONTCACHEV1.DAT
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
1998-04-30 12:56   129,024   ----a-w   C:\Program Files\UNWISE.EXE
2007-11-01 12:17   56   --sh--r   C:\WINDOWS\system32\173AB39F64.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 17:07 196608]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 14:11 25448488]
"Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2006-11-10 21:30 1853128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"Hotkey"="C:\Program Files\Hotkey\Hotkey.exe" [2004-04-03 18:38 36864]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 15:46 172032]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 18:55 49152]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-08 09:54 77824]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 17:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 17:37 217088]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe" [2006-03-26 21:01 146432]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 09:39 167936]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 09:30 1106944]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23 75520]
"lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-02-13 00:58 291760]
"lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-02-06 00:32 20480]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-02-13 01:00 312240]
"LXDDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll" [2007-01-22 23:05 102400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe [2006-05-12 12:33:22 581693]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-01-30 15:07:26 962661]
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2005-08-17 18:00:55 882176]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-09-08 19:12:40 118784]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Orbit.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Orbit.lnk
backup=C:\WINDOWS\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPDWIN]
C:\Program Files\Panda Software\Panda Demo\pandasft.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2004-04-06 18:36 1298542 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-07-14 21:35 1961984 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Gadu-Gadu\\gg.exe"=
"C:\\Gadu-Gadu\\ggphone\\ggphone.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\eMule\\eMule.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"D:\\Ragnarok\\Ragnarok.exe"=
"D:\\Ragnarok\\sakray.exe"=
"D:\\Ragnarok\\Tokyo1017a.exe"=
"D:\\Soldat\\Soldat.exe"=
"D:\\Jazz 2 PL\\Jazz2.exe"=
"D:\\LF2\\lf2.exe"=
"C:\\WINDOWS\\system32\\lxddcoms.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\App4R.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6900:TCP"= 6900:TCP:login-server_sql
"5121:TCP"= 5121:TCP:map-server_sql
"6121:TCP"= 6121:TCP:char-server_sql
"3306:TCP"= 3306:TCP:login-server_sql
"6100:TCP"= 6100:TCP:login-server_sql
"6666:TCP"= 6666:TCP:map-server_sql


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 17:21:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  LXDDCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll,_RunDLLEnanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-02 17:22:09
ComboFix-quarantined-files.txt  2008-03-02 16:21:54

[wojtas]

O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -

skasuj ten wpis ^^

potem ten plik

C:\CF22255.exe

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPDWIN]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

zastosuj sie do tego tematu:

http://forum.programosy.pl/optymalizacja-windowsa-xp-vt89133.html

[Mao666]

Zrobilem wszystko jak pisze jednak nadal zawiesza sie i podczas grania system bierze 20% CPU

[wojtas]

daj nowe logi

[Mao666]

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:03:19, on 2008-03-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hotkey\Hotkey.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Gadu-Gadu\gg.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Kalendarz XP\Kalendarz.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Documents and Settings\User\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Hotkey] C:\Program Files\Hotkey\Hotkey.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [LXDDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-746137067-412668190-839522115-1003\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\User\Dane aplikacji\Dealio\kb124\res\DealioSearch.html
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie_ctx.htm
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll (file missing)
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_64.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_22.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D6CC12B-F336-4CEA-9C6E-7C3CC6B597EC}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: lxdd_device -   - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=4
O24 - Desktop Component 1: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=5
O24 - Desktop Component 2: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=6
O24 - Desktop Component 3: (no name) - http://poczta.onet.pl/zalacznik.html?a=v&k=0&f=0&ui=23416661&s=7

--
End of file - 13536 bytes


[wojtas]

start>uruchom>msconfig> zakladka uruchamianie i odznacz wpisy programow ktore nie potrzebnie sie Twoim zdaniem właczaja ze startem systemu i daj loga z combo

[Mao666]

Kod: Zaznacz wszystko

ComboFix 08-03-01.3 - User 2008-03-02 17:18:23.1 - NTFSx86

Running from: C:\Documents and Settings\User\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\uninstall.exe

.
(((((((((((((((((((((((((   Files Created from 2008-02-02 to 2008-03-02  )))))))))))))))))))))))))))))))
.

2008-03-02 17:11 . 2008-03-02 17:11   <DIR>   d--------   C:\logs
2008-03-02 16:21 . 2004-08-04 00:44   395,776   --a------   C:\CF22255.exe
2008-03-01 18:11 . 2008-03-01 18:11   0   -ra------   C:\logwmemory.bin
2008-02-28 15:17 . 2008-02-28 15:17   <DIR>   d--------   C:\Program Files\Opera
2008-02-27 20:45 . 2008-02-27 20:45   <DIR>   d--------   C:\Program Files\VentriloMIX
2008-02-27 13:49 . 2008-02-27 14:01   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\GeoVid
2008-02-27 13:49 . 2004-08-18 15:00   1,712,128   --a------   C:\WINDOWS\system32\gdiplus.dll
2008-02-27 13:49 . 2005-06-07 15:11   60,416   --a------   C:\WINDOWS\system32\dsetup.dll
2008-02-27 13:34 . 2008-02-27 13:34   <DIR>   d--------   C:\Program Files\MyTubePlayer
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Program Files\Vstplugins
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Sony
2008-02-27 13:07 . 2008-02-27 13:07   <DIR>   d--------   C:\Program Files\Sony
2008-02-27 13:04 . 2008-02-27 13:05   <DIR>   d--------   C:\Program Files\Vegas Movie Studio 8.0
2008-02-27 11:16 . 2008-02-27 11:16   <DIR>   d--------   C:\Wimpy Desktop FLV Player 2
2008-02-27 10:27 . 2008-02-27 10:27   <DIR>   d--------   C:\Program Files\Orbitdownloader
2008-02-27 10:27 . 2008-03-02 16:32   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Orbit
2008-02-27 10:21 . 2008-02-27 10:21   <DIR>   d--------   C:\Firefox VideoDownloader 1.1.1
2008-02-27 10:18 . 2008-02-27 10:19   <DIR>   d--------   C:\Youtube Grabber 1.0
2008-02-26 15:32 . 2008-02-26 15:32   <DIR>   d--------   C:\Documents and Settings\User\.thumbnails
2008-02-26 15:09 . 2008-02-26 16:57   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.4
2008-02-26 15:06 . 2008-02-26 15:06   <DIR>   d--------   C:\Program Files\GIMP-2.0
2008-02-25 16:41 . 2008-02-25 16:42   <DIR>   d--------   C:\Hamachi
2008-02-25 16:16 . 2008-02-25 16:45   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Hamachi
2008-02-25 09:48 . 2008-02-26 12:34   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.2
2008-02-20 21:33 . 2006-10-31 19:55   5,656,576   --a------   C:\WINDOWS\system32\RLVirDev.ocx
2008-02-10 14:58 . 2008-02-10 14:58   <DIR>   d--------   C:\Program Files\PicSort

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 16:21   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Skype
2008-03-02 16:18   ---------   d-----w   C:\Program Files\Kalendarz XP
2008-03-02 16:12   ---------   d-----w   C:\Program Files\Lx_cats
2008-03-02 16:09   ---------   d-----w   C:\Program Files\Neostrada TP
2008-03-02 15:27   ---------   d-----w   C:\Program Files\Logitech
2008-03-02 15:24   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Dealio
2008-03-01 17:35   ---------   d--h--w   C:\Program Files\Give4Free Plugin
2008-02-29 21:44   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-02-27 12:26   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Sony
2008-02-26 10:49   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\Skype
2008-02-25 15:41   25,280   ----a-w   C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-25 10:55   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-01-21 14:45   ---------   d---a-w   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 14:12   ---------   d-----w   C:\Program Files\FlashGet
2008-01-19 11:32   ---------   d-----w   C:\Program Files\Belt Generator
2008-01-19 11:20   3,350   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-15 15:39   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\FaxCtr
2008-01-15 15:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\MegauploadToolbar
2008-01-15 15:17   ---------   d-----w   C:\Program Files\MegauploadToolbar
2008-01-15 14:56   ---------   d-----w   C:\Program Files\Tlen.pl
2008-01-12 14:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Tlen.pl
2008-01-10 12:17   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Publish Providers
2008-01-08 20:20   ---------   d-----w   C:\Program Files\Send File
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLds.DAT
2008-01-04 17:27   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\teamspeak2
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2007-09-03 11:44   0   ----a-w   C:\Documents and Settings\User\foczkiro.exe
2007-09-01 08:08   3,800   ----a-w   C:\Program Files\INSTALL.LOG
2005-11-15 18:25   66,880   ----a-w   C:\Documents and Settings\User\Dane aplikacji\GDIPFONTCACHEV1.DAT
2005-10-24 14:31   774,144   ----a-w   C:\Program Files\RngInterstitial.dll
2005-03-08 16:12   21,792   ----a-w   C:\Documents and Settings\Mikołaj\Dane aplikacji\GDIPFONTCACHEV1.DAT
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
1998-04-30 12:56   129,024   ----a-w   C:\Program Files\UNWISE.EXE
2007-11-01 12:17   56   --sh--r   C:\WINDOWS\system32\173AB39F64.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 17:07 196608]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 14:11 25448488]
"Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2006-11-10 21:30 1853128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"Hotkey"="C:\Program Files\Hotkey\Hotkey.exe" [2004-04-03 18:38 36864]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 15:46 172032]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 18:55 49152]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-08 09:54 77824]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 17:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 17:37 217088]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe" [2006-03-26 21:01 146432]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 09:39 167936]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 09:30 1106944]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23 75520]
"lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-02-13 00:58 291760]
"lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-02-06 00:32 20480]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-02-13 01:00 312240]
"LXDDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll" [2007-01-22 23:05 102400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe [2006-05-12 12:33:22 581693]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-01-30 15:07:26 962661]
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2005-08-17 18:00:55 882176]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-09-08 19:12:40 118784]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Orbit.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Orbit.lnk
backup=C:\WINDOWS\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPDWIN]
C:\Program Files\Panda Software\Panda Demo\pandasft.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2004-04-06 18:36 1298542 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-07-14 21:35 1961984 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Gadu-Gadu\\gg.exe"=
"C:\\Gadu-Gadu\\ggphone\\ggphone.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\eMule\\eMule.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"D:\\Ragnarok\\Ragnarok.exe"=
"D:\\Ragnarok\\sakray.exe"=
"D:\\Ragnarok\\Tokyo1017a.exe"=
"D:\\Soldat\\Soldat.exe"=
"D:\\Jazz 2 PL\\Jazz2.exe"=
"D:\\LF2\\lf2.exe"=
"C:\\WINDOWS\\system32\\lxddcoms.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\App4R.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6900:TCP"= 6900:TCP:login-server_sql
"5121:TCP"= 5121:TCP:map-server_sql
"6121:TCP"= 6121:TCP:char-server_sql
"3306:TCP"= 3306:TCP:login-server_sql
"6100:TCP"= 6100:TCP:login-server_sql
"6666:TCP"= 6666:TCP:map-server_sql


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 17:21:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  LXDDCATS = rundll32
**************************************************************************
.
Completion time: 2008-03-02 17:22:09
ComboFix-quarantined-files.txt  2008-03-02 16:21:54



[Dzi@dek]

Log niepełny.

[Mao666]

Uzupelnione

[wojtas]

Otworz notatnik i wklej w nim to:

File::
C:\CF22255.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPDWIN]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[Mao666]

Kod: Zaznacz wszystko

ComboFix 08-03-01.3 - User 2008-03-02 17:18:23.1 - NTFSx86

Running from: C:\Documents and Settings\User\Dane aplikacji\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\uninstall.exe

.
(((((((((((((((((((((((((   Files Created from 2008-02-02 to 2008-03-02  )))))))))))))))))))))))))))))))
.

2008-03-02 17:11 . 2008-03-02 17:11   <DIR>   d--------   C:\logs
2008-03-02 16:21 . 2004-08-04 00:44   395,776   --a------   C:\CF22255.exe
2008-03-01 18:11 . 2008-03-01 18:11   0   -ra------   C:\logwmemory.bin
2008-02-28 15:17 . 2008-02-28 15:17   <DIR>   d--------   C:\Program Files\Opera
2008-02-27 20:45 . 2008-02-27 20:45   <DIR>   d--------   C:\Program Files\VentriloMIX
2008-02-27 13:49 . 2008-02-27 14:01   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\GeoVid
2008-02-27 13:49 . 2004-08-18 15:00   1,712,128   --a------   C:\WINDOWS\system32\gdiplus.dll
2008-02-27 13:49 . 2005-06-07 15:11   60,416   --a------   C:\WINDOWS\system32\dsetup.dll
2008-02-27 13:34 . 2008-02-27 13:34   <DIR>   d--------   C:\Program Files\MyTubePlayer
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Program Files\Vstplugins
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Sony
2008-02-27 13:07 . 2008-02-27 13:07   <DIR>   d--------   C:\Program Files\Sony
2008-02-27 13:04 . 2008-02-27 13:05   <DIR>   d--------   C:\Program Files\Vegas Movie Studio 8.0
2008-02-27 11:16 . 2008-02-27 11:16   <DIR>   d--------   C:\Wimpy Desktop FLV Player 2
2008-02-27 10:27 . 2008-02-27 10:27   <DIR>   d--------   C:\Program Files\Orbitdownloader
2008-02-27 10:27 . 2008-03-02 16:32   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Orbit
2008-02-27 10:21 . 2008-02-27 10:21   <DIR>   d--------   C:\Firefox VideoDownloader 1.1.1
2008-02-27 10:18 . 2008-02-27 10:19   <DIR>   d--------   C:\Youtube Grabber 1.0
2008-02-26 15:32 . 2008-02-26 15:32   <DIR>   d--------   C:\Documents and Settings\User\.thumbnails
2008-02-26 15:09 . 2008-02-26 16:57   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.4
2008-02-26 15:06 . 2008-02-26 15:06   <DIR>   d--------   C:\Program Files\GIMP-2.0
2008-02-25 16:41 . 2008-02-25 16:42   <DIR>   d--------   C:\Hamachi
2008-02-25 16:16 . 2008-02-25 16:45   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Hamachi
2008-02-25 09:48 . 2008-02-26 12:34   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.2
2008-02-20 21:33 . 2006-10-31 19:55   5,656,576   --a------   C:\WINDOWS\system32\RLVirDev.ocx
2008-02-10 14:58 . 2008-02-10 14:58   <DIR>   d--------   C:\Program Files\PicSort

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 16:21   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Skype
2008-03-02 16:18   ---------   d-----w   C:\Program Files\Kalendarz XP
2008-03-02 16:12   ---------   d-----w   C:\Program Files\Lx_cats
2008-03-02 16:09   ---------   d-----w   C:\Program Files\Neostrada TP
2008-03-02 15:27   ---------   d-----w   C:\Program Files\Logitech
2008-03-02 15:24   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Dealio
2008-03-01 17:35   ---------   d--h--w   C:\Program Files\Give4Free Plugin
2008-02-29 21:44   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-02-27 12:26   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Sony
2008-02-26 10:49   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\Skype
2008-02-25 15:41   25,280   ----a-w   C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-25 10:55   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-01-21 14:45   ---------   d---a-w   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-01-20 14:12   ---------   d-----w   C:\Program Files\FlashGet
2008-01-19 11:32   ---------   d-----w   C:\Program Files\Belt Generator
2008-01-19 11:20   3,350   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-15 15:39   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\FaxCtr
2008-01-15 15:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\MegauploadToolbar
2008-01-15 15:17   ---------   d-----w   C:\Program Files\MegauploadToolbar
2008-01-15 14:56   ---------   d-----w   C:\Program Files\Tlen.pl
2008-01-12 14:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Tlen.pl
2008-01-10 12:17   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Publish Providers
2008-01-08 20:20   ---------   d-----w   C:\Program Files\Send File
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLds.DAT
2008-01-04 17:27   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\teamspeak2
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2007-09-03 11:44   0   ----a-w   C:\Documents and Settings\User\foczkiro.exe
2007-09-01 08:08   3,800   ----a-w   C:\Program Files\INSTALL.LOG
2005-11-15 18:25   66,880   ----a-w   C:\Documents and Settings\User\Dane aplikacji\GDIPFONTCACHEV1.DAT
2005-10-24 14:31   774,144   ----a-w   C:\Program Files\RngInterstitial.dll
2005-03-08 16:12   21,792   ----a-w   C:\Documents and Settings\Mikołaj\Dane aplikacji\GDIPFONTCACHEV1.DAT
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
1998-04-30 12:56   129,024   ----a-w   C:\Program Files\UNWISE.EXE
2007-11-01 12:17   56   --sh--r   C:\WINDOWS\system32\173AB39F64.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 17:07 196608]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 14:11 25448488]
"Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2006-11-10 21:30 1853128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"Hotkey"="C:\Program Files\Hotkey\Hotkey.exe" [2004-04-03 18:38 36864]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 15:46 172032]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 18:55 49152]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-08 09:54 77824]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 17:47 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 17:37 217088]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe" [2006-03-26 21:01 146432]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-03-22 09:39 167936]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 09:30 1106944]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23 75520]
"lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-02-13 00:58 291760]
"lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-02-06 00:32 20480]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-02-13 01:00 312240]
"LXDDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll" [2007-01-22 23:05 102400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe [2006-05-12 12:33:22 581693]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-01-30 15:07:26 962661]
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2005-08-17 18:00:55 882176]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-09-08 19:12:40 118784]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Orbit.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Orbit.lnk
backup=C:\WINDOWS\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPDWIN]
C:\Program Files\Panda Software\Panda Demo\pandasft.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2004-04-06 18:36 1298542 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-07-14 21:35 1961984 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Gadu-Gadu\\gg.exe"=
"C:\\Gadu-Gadu\\ggphone\\ggphone.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\eMule\\eMule.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"D:\\Ragnarok\\Ragnarok.exe"=
"D:\\Ragnarok\\sakray.exe"=
"D:\\Ragnarok\\Tokyo1017a.exe"=
"D:\\Soldat\\Soldat.exe"=
"D:\\Jazz 2 PL\\Jazz2.exe"=
"D:\\LF2\\lf2.exe"=
"C:\\WINDOWS\\system32\\lxddcoms.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\App4R.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6900:TCP"= 6900:TCP:login-server_sql
"5121:TCP"= 5121:TCP:map-server_sql
"6121:TCP"= 6121:TCP:char-server_sql
"3306:TCP"= 3306:TCP:login-server_sql
"6100:TCP"= 6100:TCP:login-server_sql
"6666:TCP"= 6666:TCP:map-server_sql


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 17:21:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  LXDDCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll,_RunDLLEntry@16????
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-02 17:22:09
ComboFix-quarantined-files.txt  2008-03-02 16:21:54


[wojtas]

Ty dałes stary log z combofixa. odpal combo i czekaj na nowy log

[Mao666]

Kod: Zaznacz wszystko

ComboFix 08-03-01.3 - User 2008-03-03 21:08:55.1 - NTFSx86

Running from: C:\Documents and Settings\User\Pulpit\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-02-03 to 2008-03-03  )))))))))))))))))))))))))))))))
.

2008-03-03 17:41 . 2008-03-03 18:54   <DIR>   d--------   C:\Program Files\Spyware Doctor
2008-03-03 17:41 . 2008-03-03 17:41   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\PC Tools
2008-03-03 17:41 . 2007-12-10 14:53   81,288   --a------   C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-03 17:41 . 2007-12-10 14:53   66,952   --a------   C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-03 17:41 . 2007-12-10 14:53   41,864   --a------   C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-03 17:41 . 2007-12-10 14:53   29,576   --a------   C:\WINDOWS\system32\drivers\kcom.sys
2008-03-02 17:11 . 2008-03-02 17:11   <DIR>   d--------   C:\logs
2008-03-01 18:11 . 2008-03-01 18:11   0   -ra------   C:\logwmemory.bin
2008-02-28 15:17 . 2008-02-28 15:17   <DIR>   d--------   C:\Program Files\Opera
2008-02-27 20:45 . 2008-02-27 20:45   <DIR>   d--------   C:\Program Files\VentriloMIX
2008-02-27 13:49 . 2008-02-27 14:01   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\GeoVid
2008-02-27 13:49 . 2004-08-18 15:00   1,712,128   --a------   C:\WINDOWS\system32\gdiplus.dll
2008-02-27 13:49 . 2005-06-07 15:11   60,416   --a------   C:\WINDOWS\system32\dsetup.dll
2008-02-27 13:34 . 2008-02-27 13:34   <DIR>   d--------   C:\Program Files\MyTubePlayer
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Program Files\Vstplugins
2008-02-27 13:08 . 2008-02-27 13:08   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Sony
2008-02-27 13:07 . 2008-02-27 13:07   <DIR>   d--------   C:\Program Files\Sony
2008-02-27 13:04 . 2008-02-27 13:05   <DIR>   d--------   C:\Program Files\Vegas Movie Studio 8.0
2008-02-27 11:16 . 2008-02-27 11:16   <DIR>   d--------   C:\Wimpy Desktop FLV Player 2
2008-02-27 10:27 . 2008-03-03 15:24   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Orbit
2008-02-27 10:21 . 2008-02-27 10:21   <DIR>   d--------   C:\Firefox VideoDownloader 1.1.1
2008-02-27 10:18 . 2008-02-27 10:19   <DIR>   d--------   C:\Youtube Grabber 1.0
2008-02-26 15:32 . 2008-02-26 15:32   <DIR>   d--------   C:\Documents and Settings\User\.thumbnails
2008-02-26 15:09 . 2008-02-26 16:57   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.4
2008-02-26 15:06 . 2008-02-26 15:06   <DIR>   d--------   C:\Program Files\GIMP-2.0
2008-02-25 16:41 . 2008-02-25 16:42   <DIR>   d--------   C:\Hamachi
2008-02-25 16:16 . 2008-02-25 16:45   <DIR>   d--------   C:\Documents and Settings\User\Dane aplikacji\Hamachi
2008-02-25 09:48 . 2008-02-26 12:34   <DIR>   d--------   C:\Documents and Settings\User\.gimp-2.2
2008-02-20 21:33 . 2006-10-31 19:55   5,656,576   --a------   C:\WINDOWS\system32\RLVirDev.ocx
2008-02-10 14:58 . 2008-02-10 14:58   <DIR>   d--------   C:\Program Files\PicSort

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-03 20:07   ---------   d---a-w   C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-03-03 20:03   ---------   d-----w   C:\Program Files\Neostrada TP
2008-03-03 19:54   ---------   d-----w   C:\Program Files\Kalendarz XP
2008-03-03 19:54   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Skype
2008-03-03 19:45   ---------   d-----w   C:\Program Files\Lx_cats
2008-03-03 15:49   ---------   d-----w   C:\Program Files\FlashGet
2008-03-02 15:27   ---------   d-----w   C:\Program Files\Logitech
2008-02-29 21:44   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-02-27 12:26   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Sony
2008-02-26 10:49   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\Skype
2008-02-25 15:41   25,280   ----a-w   C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-25 10:55   ---------   d-----w   C:\Documents and Settings\Mikołaj\Dane aplikacji\MEGAUPLOADTOOLBAR
2008-01-19 11:32   ---------   d-----w   C:\Program Files\Belt Generator
2008-01-19 11:20   3,350   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-15 15:39   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\FaxCtr
2008-01-15 15:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\MegauploadToolbar
2008-01-15 15:17   ---------   d-----w   C:\Program Files\MegauploadToolbar
2008-01-15 14:56   ---------   d-----w   C:\Program Files\Tlen.pl
2008-01-12 14:18   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Tlen.pl
2008-01-10 12:17   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\Publish Providers
2008-01-08 20:20   ---------   d-----w   C:\Program Files\Send File
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT
2008-01-07 10:21   20   ---h--w   C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLds.DAT
2008-01-04 17:27   ---------   d-----w   C:\Documents and Settings\User\Dane aplikacji\teamspeak2
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2007-09-03 11:44   0   ----a-w   C:\Documents and Settings\User\foczkiro.exe
2007-09-01 08:08   3,800   ----a-w   C:\Program Files\INSTALL.LOG
2005-11-15 18:25   66,880   ----a-w   C:\Documents and Settings\User\Dane aplikacji\GDIPFONTCACHEV1.DAT
2005-10-24 14:31   774,144   ----a-w   C:\Program Files\RngInterstitial.dll
2005-03-08 16:12   21,792   ----a-w   C:\Documents and Settings\Mikołaj\Dane aplikacji\GDIPFONTCACHEV1.DAT
2004-03-11 12:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
1998-04-30 12:56   129,024   ----a-w   C:\Program Files\UNWISE.EXE
2007-11-01 12:17   56   --sh--r   C:\WINDOWS\system32\173AB39F64.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 17:07 196608]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-12 14:11 25448488]
"Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2006-11-10 21:30 1853128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"Hotkey"="C:\Program Files\Hotkey\Hotkey.exe" [2004-04-03 18:38 36864]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 15:46 172032]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50 4620288]
"nwiz"="nwiz.exe" [2004-10-29 16:50 921600 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50 86016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920]
"DataLayer"="C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-03-31 09:30 1106944]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23 75520]
"lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-02-13 00:58 291760]
"lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-02-06 00:32 20480]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-02-13 01:00 312240]
"LXDDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll" [ ]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe [2006-05-12 12:33:22 581693]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-01-30 15:07:26 962661]
Kalendarz XP.lnk - C:\Program Files\Kalendarz XP\Kalendarz.exe [2005-08-17 18:00:55 882176]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-09-08 19:12:40 118784]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Orbit.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Orbit.lnk
backup=C:\WINDOWS\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-02-18 18:55 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2004-04-06 18:36 1298542 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
C:\Program Files\Tlen.pl\tlen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
--a------ 2005-01-18 17:47 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
--a------ 2005-01-18 17:37 217088 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-07-14 21:35 1961984 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2005-03-22 09:39 167936 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-03-26 21:01 146432 C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6900:TCP"= 6900:TCP:login-server_sql
"5121:TCP"= 5121:TCP:map-server_sql
"6121:TCP"= 6121:TCP:char-server_sql
"3306:TCP"= 3306:TCP:login-server_sql
"6100:TCP"= 6100:TCP:login-server_sql
"6666:TCP"= 6666:TCP:map-server_sql


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 21:11:48
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-03 21:14:20
ComboFix-quarantined-files.txt  2008-03-03 20:14:13
ComboFix2.txt  2008-03-02 16:22:10

Zauwazylem ze po 1-2 min sciagana z neta czegokolwiek transfer mi sie zawiesza do 0kb/s i mozna to naprawic tylko ponownym uruchomieniem sciagana czy to moze byc jakis wirus skanowalem wszystko awastem i nie wykryl niczego potem skanowalem spyware doctor i znalazl 22 wirusy wywalilem wszystkie i dalej nie widac poprawy
P.S Moze ktos mi dac LXDDtime.dll z windows XP

[wojtas]

logi masz czyste to nie wina wirusow

Autor postu otrzymał pochwałę

[Mao666]

No wiec czego?
Co moze miec na to wplyw?
Dzwonilem do TP ale tam mi doradzil przeskanowanie dysku co jak juz pisalem nic nie dalo

[wojtas]

nie wiem moze przeinstaluj ta aplikacje zrob defragmentacje dysku.