Prosze o sprawdzemie loga (zamulony system, powolny net)

**Posty:** 15 · przez **kuqn** 23 Paź 2008, 14:46

Witam,
mam problem ze swoim komputerem, od jakiegos czasu strasznie muli mi sie system, internet wolno chodzi, strony w przegladarce powoli sie otwieraja oraz system bardzo dlugo sie zamyka. Skanowalem system KAV 2009 i nic nie znalazl. Logi generowalem programami HijackThis oraz Combofix. Z góry dziekuje za pomoc.

Combofix

Kod: Zaznacz wszystko: ComboFix 08-10-22.05 - klastuch 2008-10-23 14:28:27.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.461 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\klastuch\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\Vxdif.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-23 do 2008-10-23 ))))))))))))))))))))))))))))))) . 2008-10-23 14:14 . 2008-10-23 14:14 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-22 17:48 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2008-10-22 17:46 . 2008-10-22 17:46 <DIR> d-------- C:\Program Files\MSBuild 2008-10-22 17:46 . 2008-10-22 17:46 <DIR> d-------- C:\Program Files\Microsoft Works 2008-10-22 17:44 . 2008-10-22 17:44 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-10-22 17:42 . 2008-10-22 17:42 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8 2008-10-22 17:41 . 2008-10-22 17:45 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-10-22 17:41 . 2008-10-22 17:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-10-22 17:40 . 2008-10-22 17:40 <DIR> dr-h----- C:\MSOCache 2008-10-22 15:24 . 2008-10-22 15:24 4,767 --a------ C:\WINDOWS\Irremote.ini 2008-10-22 15:20 . 2008-10-22 15:20 <DIR> d-------- C:\Program Files\Windows Sidebar 2008-10-22 15:06 . 2008-10-22 15:23 <DIR> d-------- C:\Program Files\Nero 2008-10-22 15:05 . 2008-10-22 15:39 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-10-22 14:00 . 2008-10-22 14:00 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-21 22:25 . 2008-10-21 22:25 <DIR> d-------- C:\Documents and Settings\klastuch\Dane aplikacji\Ahead 2008-10-21 22:23 . 2003-03-29 16:45 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2008-10-21 22:23 . 2003-07-22 16:29 57,344 --a------ C:\WINDOWS\system32\ImageDrive.cpl 2008-10-21 22:22 . 2008-10-21 22:22 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-10-21 22:22 . 2008-10-22 14:45 <DIR> d-------- C:\Program Files\Ahead 2008-10-21 22:22 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2008-10-21 22:22 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2008-10-21 22:22 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2008-10-21 22:22 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-10-21 22:22 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2008-10-20 23:42 . 2008-10-20 23:42 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-10-20 23:09 . 2008-10-22 15:54 <DIR> d-------- C:\Documents and Settings\klastuch\Dane aplikacji\Nero 2008-10-20 23:04 . 2008-10-22 15:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-10-19 12:22 . 2008-10-19 12:33 <DIR> d-------- C:\Program Files\DOSBox-0.72 2008-10-18 10:46 . 2008-10-18 10:46 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-10-18 09:17 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2008-10-18 08:40 . 2008-10-18 08:40 <DIR> d-------- C:\WINDOWS\Logs 2008-10-17 22:15 . 2008-10-17 22:15 <DIR> d-------- C:\WINDOWS\Cache 2008-10-17 11:09 . 2008-10-17 11:09 <DIR> d-------- C:\Program Files\Atheros 2008-10-16 10:15 . 2008-09-08 12:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-16 10:14 . 2008-08-14 15:26 2,190,464 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-16 10:14 . 2008-08-14 15:26 2,146,816 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-16 10:14 . 2008-08-14 15:26 2,067,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-16 10:14 . 2008-08-14 15:26 2,025,472 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-16 10:14 . 2008-09-15 17:27 1,846,656 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-13 15:49 . 2008-10-13 15:49 <DIR> d-------- C:\WINDOWS\system32\pl 2008-10-13 15:49 . 2008-10-13 15:49 <DIR> d-------- C:\WINDOWS\system32\bits 2008-10-13 15:49 . 2008-10-13 15:49 <DIR> d-------- C:\WINDOWS\l2schemas 2008-10-13 15:45 . 2008-10-13 15:50 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-10-09 13:14 . 2008-10-03 19:26 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-10-09 13:14 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-10-09 13:14 . 2007-03-08 07:11 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-10-09 13:14 . 2008-08-26 10:26 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-10-09 13:14 . 2008-08-26 10:26 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-10-09 13:14 . 2008-08-26 10:26 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-10-09 13:14 . 2008-08-26 10:26 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-10-09 13:14 . 2008-08-26 10:26 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-10-09 13:14 . 2008-08-25 10:38 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-10-09 13:13 . 2008-10-13 15:49 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2008-10-09 11:47 . 2008-10-09 11:47 3,033 --a------ C:\WINDOWS\E220AutoRunLog.tmp 2008-10-09 11:43 . 2008-10-09 11:50 <DIR> d-------- C:\Program Files\iPlus 2008-10-09 11:43 . 2006-08-28 11:30 88,960 --a------ C:\WINDOWS\system32\drivers\ewusbmdm.sys 2008-10-09 11:35 . 2004-10-08 10:51 1,270,540 --a------ C:\WINDOWS\system32\drivers\AGRSM.sys 2008-10-09 11:35 . 2004-10-08 10:50 88,363 --a------ C:\WINDOWS\AGRSMMSG.exe 2008-10-09 11:35 . 2004-04-05 10:49 64,512 --------- C:\WINDOWS\system32\agrsmdel.exe 2008-10-09 11:35 . 2004-04-05 10:49 64,512 --a------ C:\WINDOWS\agrsmdel.exe 2008-10-09 11:33 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-10-09 11:21 . 2008-10-09 11:43 <DIR> d-------- C:\Documents and Settings\klastuch\Dane aplikacji\iPlus 2008-10-01 18:33 . 2008-10-23 13:02 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-09-27 18:43 . 2008-09-27 18:43 <DIR> d-------- C:\Program Files\Firefly Studios 2008-09-26 00:05 . 2008-09-26 00:05 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-09-23 22:08 . 2008-09-23 22:08 <DIR> d-------- C:\Program Files\NAPI-PROJEKT . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-23 12:36 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\Hamachi 2008-10-23 12:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-23 12:34 475,168 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-23 12:34 4,800 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-23 12:34 22,748 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-10-23 12:34 2,505,248 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-10-23 11:00 --------- d-----w C:\Program Files\Norton Security Scan 2008-10-17 21:28 --------- d-----w C:\Program Files\GameSpy Arcade 2008-10-17 20:17 --------- d-----w C:\Program Files\Common Files\Adobe 2008-10-17 09:30 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-17 09:09 21,275 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-10-17 08:25 --------- d-----w C:\Program Files\eMule 2008-10-17 08:25 --------- d-----w C:\Program Files\EA SPORTS 2008-09-22 18:58 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\Winamp 2008-09-21 21:57 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-21 20:57 --------- d-----w C:\Program Files\FreshDevices 2008-09-20 19:01 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2008-09-20 19:01 --------- d-----w C:\Program Files\Hamachi 2008-09-17 12:03 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\InterTrust 2008-09-15 17:26 --------- d-----w C:\Program Files\Real Alternative 2008-09-15 17:26 --------- d-----w C:\Program Files\Media Player Classic 2008-09-15 17:25 --------- d-----w C:\Program Files\SubEdit-Player 2008-09-15 17:10 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\Media Player Classic 2008-09-15 17:06 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-15 14:50 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-09-15 14:50 --------- d-----w C:\Program Files\AGEIA Technologies 2008-09-14 20:02 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-09-14 18:18 --------- d-----w C:\Program Files\DAEMON Tools Toolbar 2008-09-14 18:09 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-09-14 18:09 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\DAEMON Tools 2008-09-14 18:04 --------- d-----w C:\Program Files\SlySoft 2008-09-14 11:50 --------- d-----w C:\Program Files\Diskeeper Corporation 2008-09-14 10:59 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\Gadu-Gadu 2008-09-14 10:39 --------- d-----w C:\Program Files\Winamp 2008-09-14 10:21 --------- d-----w C:\Program Files\Opera 2008-09-14 10:18 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-09-14 10:18 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-09-14 10:04 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\ATI 2008-09-14 09:57 --------- d-----w C:\Program Files\Kaspersky Lab 2008-09-14 09:55 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-14 09:55 --------- d-----w C:\Program Files\ATI Technologies 2008-09-14 09:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-09-14 06:41 --------- d-----w C:\Program Files\Apoint2K 2008-09-14 06:40 1 ------w C:\WINDOWS\system32\drivers\Apfiltr.sys 2008-09-14 06:39 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-09-14 06:39 --------- d-----w C:\Program Files\Realtek 2008-09-14 06:38 --------- d-----w C:\Documents and Settings\klastuch\Dane aplikacji\InstallShield 2008-09-13 19:04 --------- d-----w C:\Program Files\microsoft frontpage 2008-09-13 19:03 --------- d-----w C:\Program Files\Usługi online 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-06 13:29 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-08-06 13:27 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-07-31 08:41 68,616 ----a-w C:\WINDOWS\system32\XAPOFX1_1.dll 2008-07-31 08:41 238,088 ----a-w C:\WINDOWS\system32\xactengine3_2.dll 2008-07-31 08:40 509,448 ----a-w C:\WINDOWS\system32\XAudio2_2.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 1695232] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112] "CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344] "iPlusManager"="C:\Program Files\iPlus\iPlusChecker.exe" [2006-08-28 274432] "ACU"="C:\Program Files\Atheros\ACU.exe" [2006-03-25 335961] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 201992] "RTHDCPL"="RTHDCPL.EXE" [2007-02-26 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe] "AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 C:\WINDOWS\AGRSMMSG.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] C:\Documents and Settings\klastuch\Menu Start\Programy\Autostart\ hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2008-09-20 625952] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"= "C:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784] R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8511b346-81d4-11dd-b0b7-806d6172696f}] \Shell\AutoRun\command - vxl.exe \Shell\explore\Command - vxl.exe \Shell\open\Command - vxl.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e01f8d95-8246-11dd-bad4-0017c406f75c}] \Shell\AutoRun\command - G:\x10u6iuj.bat \Shell\explore\Command - G:\x10u6iuj.bat \Shell\open\Command - G:\x10u6iuj.bat . Zawartość folderu 'Zaplanowane zadania' 2008-10-23 C:\WINDOWS\Tasks\Norton Security Scan for klastuch.job - C:\Program Files\Norton Security Scan\Nss.exe [2008-09-19 04:18] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe HKLM-Run-Apoint - (no file) . ------- Skan uzupełniający ------- . R0 -: HKCU-Main,Start Page = hxxp://www.daemon-search.com/startpage R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore O8 -: E&ksportuj do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 -: {6D1C50C5-96B6-4823-94FB-41EF38DE6EED} - C:\Program Files\FreshDevices\FreshDownload\fd.exe O9 -: {6D1C50C5-96B6-4823-94FB-41EF38DE6EED} - C:\Program Files\FreshDevices\FreshDownload\fd.exe - . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-23 14:36:35 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\acs.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Czas ukończenia: 2008-10-23 14:39:43 - komputer został uruchomiony ponownie [klastuch] ComboFix-quarantined-files.txt 2008-10-23 12:39:27 Przed: 3,949,125,632 bajtów wolnych Po: 7,524,233,216 bajtów wolnych 237 --- E O F --- 2008-10-22 12:01:00

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:44:40, on 2008-10-23 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Opera\opera.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll (file missing) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [iPlusManager] C:\Program Files\iPlus\iPlusChecker.exe O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: FreshDownload - {6D1C50C5-96B6-4823-94FB-41EF38DE6EED} - C:\Program Files\FreshDevices\FreshDownload\fd.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Usługa konfiguracji Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- End of file - 5743 bytes

**Posty:** 7956 · przez **Magik** 23 Paź 2008, 15:03

kosmetyka

Hijack

Kod: Zaznacz wszystko: O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll (file missing) O9 - Extra button: FreshDownload - {6D1C50C5-96B6-4823-94FB-41EF38DE6EED} - C:\Program Files\FreshDevices\FreshDownload\fd.exe (file missing)

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8511b346-81d4-11dd-b0b7-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e01f8d95-8246-11dd-bad4-0017c406f75c}]

zapisz jako fix.reg i odpal

zrob jakas optymalizacje

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem