prosze o sprawdzenie loga - chwilowe zwiechy

[Tiempo]

Witam mam nastepujacy problem:
gdy gram w LFS'a mam takie chwilowe zwiechy 2-5s. po czym wszystko wraca do normy lecz tylko na kilka minut.
Zmienialem stery od wszystkiego, to samo z Directx na wersjach gry konczac.
Problem jest od niedawna, ale wczesniej wszystko smigalo az milo.
Mysle, ze to moze byc wina dysku - ten na ktorym zainstalowana jst gra ma 7 lat....

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 17:19:08, on 2007-12-22
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\temp1.exe
d:\Program Files\Winamp\winamp.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.547\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - d:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] "d:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - D:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - D:\PROGRA~1\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - d:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - d:\Program Files\FlashGet\FlashGet.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C08357D3-60F6-4E79-B586-978AB4C4EDC4}: NameServer = 83.238.255.76 213.241.79.37
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe



Daje logi, bo wychodzi na to, ze musialem zalapac jakiegos smiecia w tym malym balaganie

[wojtas]

F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

skasuj te wpisy

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[Tiempo]

Kod: Zaznacz wszystko


SDFix: Version 1.119

Run by Administrator on 2007-12-22 at 17:48

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\autorun.inf  - Deleted
C:\WINDOWS\autorun.inf  - Deleted
C:\WINDOWS\svchost.exe  - Deleted
C:\WINDOWS\system32\i  - Deleted
C:\WINDOWS\system32\TFTP1536  - Deleted
C:\WINDOWS\system32\TFTP1816  - Deleted
C:\WINDOWS\system32\TFTP2248  - Deleted
C:\WINDOWS\system32\TFTP2832  - Deleted
C:\WINDOWS\system32\TFTP2876  - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



                                 Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 17:52:24
Windows 5.1.2600  NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:f933c04f
"s2"=dword:0ed82c4a
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5c,eb,fa,ea,70,da,13,64,eb,ff,6e,7e,5f,8f,ba,2a,c1,ef,6a,05,eb,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2e,19,e8,49,c7,8e,55,9a,da,48,84,f8,0e,cd,28,b5,40,..
"khjeh"=hex:a5,97,6e,1f,8a,c6,ae,99,19,11,7e,49,fc,32,ca,eb,76,3a,df,95,54,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ea,d4,b1,51,8b,d4,af,71,df,f1,29,c4,f7,3e,3d,d8,6b,f5,1a,54,ab,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5c,eb,fa,ea,70,da,13,64,eb,ff,6e,7e,5f,8f,ba,2a,c1,ef,6a,05,eb,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2e,19,e8,49,c7,8e,55,9a,da,48,84,f8,0e,cd,28,b5,40,..
"khjeh"=hex:a5,97,6e,1f,8a,c6,ae,99,19,11,7e,49,fc,32,ca,eb,76,3a,df,95,54,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ea,d4,b1,51,8b,d4,af,71,df,f1,29,c4,f7,3e,3d,d8,6b,f5,1a,54,ab,..

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"d:\\Program Files\\PPMate\\ppmate.exe"="d:\\Program Files\\PPMate\\ppmate.exe:*:Enabled:PPMate"
"D:\\Program Files\\PPMate\\ppamnet.exe"="d:\\Program Files\\PPMate\\ppamnet.exe:*:Enabled:PPMate"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 16 Dec 2007         1,211 A.SHR --- "C:\copy.exe"
Sat 20 May 2006        70,207 A.SHR --- "C:\host.exe"
Sun 16 Dec 2007         1,211 A.SHR --- "C:\WINDOWS\xcopy.exe"
Wed  8 Aug 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Finished!


Kod: Zaznacz wszystko

ComboFix 07-12-21.4 - Administrator 2007-12-22 18:02:55.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.0.1250.1.1045.18.295 [GMT 1:00]
Running from: C:\ComboFix.exe
* Created a new restore point
.
   /wow section - STAGE 3

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\copy.exe
C:\host.exe
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]07523BB.bin
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]075267A.bin
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0752820.bin
C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]1DD01F3
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm
C:\WINDOWS\system32\temp1.exe
C:\WINDOWS\system32\temp2.exe
C:\WINDOWS\xcopy.exe
D:\copy.exe
D:\host.exe

.
(((((((((((((((((((((((((   Files Created from 2007-11-22 to 2007-12-22  )))))))))))))))))))))))))))))))
.

2007-12-22 18:02 . 2007-12-22 18:02   1,478,778   --a------   C:\ComboFix.exe
2007-12-22 17:47 . 2007-12-22 17:47   <DIR>   d--------   C:\WINDOWS\ERUNT
2007-12-22 17:40 . 2007-12-22 17:41   1,215,777   --a------   C:\SDFix.exe
2007-12-22 17:15 . 2007-12-22 17:15   212,843   --a------   C:\hijackthis_199.zip
2007-12-22 16:47 . 2007-12-22 16:47   54,156   --ah-----   C:\WINDOWS\QTFont.qfn
2007-12-22 16:47 . 2007-12-22 16:47   1,409   --a------   C:\WINDOWS\QTFont.for
2007-12-21 15:08 . 2007-12-21 15:10   <DIR>   d--------   C:\Program Files\Common Files\Symantec Shared
2007-12-18 22:48 . 2007-12-18 22:49   <DIR>   d--------   C:\Documents and Settings\Administrator\Dane aplikacji\ppStream
2007-12-18 22:48 . 2007-12-18 22:49   391   --a------   C:\WINDOWS\psnetwork.ini
2007-12-18 22:48 . 2007-12-18 22:48   14   --a------   C:\WINDOWS\Powerplayer.ini
2007-12-18 22:43 . 2007-12-18 22:43   4,488,265   --a------   C:\civic.flv
2007-12-18 22:13 . 2007-12-18 22:25   23,743,301   --a------   C:\KPW.flv
2007-12-18 20:16 . 2007-12-18 20:16   <DIR>   d--------   C:\Program Files\Winamp Toolbar
2007-12-18 20:16 . 2007-12-18 20:16   <DIR>   d--------   C:\Program Files\Winamp Remote
2007-12-18 20:16 . 2007-12-18 20:16   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-12-18 20:16 . 2007-12-18 20:16   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-12-18 20:13 . 2007-12-18 20:16   <DIR>   d--------   C:\Documents and Settings\Administrator\Dane aplikacji\Winamp
2007-12-18 17:08 . 2007-12-18 17:16   65,796,624   --a------   C:\824_Briana.AVI
2007-12-17 20:44 . 2007-12-17 20:46   <DIR>   d--------   C:\WINDOWS\nview
2007-12-17 20:44 . 2006-05-19 03:28   208,896   --a------   C:\WINDOWS\system32\NVUNINST.EXE
2007-12-17 20:44 . 2006-05-18 23:35   208,896   --a------   C:\WINDOWS\system32\nvudisp.exe
2007-12-17 20:44 . 2007-12-22 18:01   62,201   --a------   C:\WINDOWS\system32\nvapps.xml
2007-12-17 20:44 . 2006-05-18 23:35   16,960   --a------   C:\WINDOWS\system32\nvdisp.nvu
2007-12-17 20:42 . 2007-12-17 20:42   <DIR>   d--------   C:\NVIDIA
2007-12-17 20:41 . 2007-12-17 20:41   552   --a------   C:\WINDOWS\system32\d3d8caps.dat
2007-12-17 20:08 . 2007-12-17 20:12   <DIR>   d--------   C:\Program Files\RegCleaner
2007-12-16 10:20 . 2007-12-16 10:20   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2007-12-15 20:31 . 2001-08-18 06:24   135,040   --a------   C:\WINDOWS\system32\drivers\portcls.sys
2007-12-15 20:31 . 2001-08-18 06:24   135,040   --a--c---   C:\WINDOWS\system32\dllcache\portcls.sys
2007-12-15 20:31 . 2001-08-17 22:01   57,344   --a------   C:\WINDOWS\system32\drivers\drmk.sys
2007-12-15 20:31 . 2001-08-17 22:01   57,344   --a--c---   C:\WINDOWS\system32\dllcache\drmk.sys
2007-12-15 20:30 . 2007-10-04 17:14   136,260   --a------   C:\WINDOWS\system32\nvapps.nvb
2007-12-15 20:27 . 2007-12-15 20:27   98,304   --a------   C:\WINDOWS\system32\SET41.tmp
2007-12-15 11:37 . 2007-12-15 11:37   <DIR>   d--------   C:\Program Files\MSXML 4.0
2007-12-15 11:37 . 2007-12-15 11:38   <DIR>   d--------   C:\Program Files\GameSpy Arcade
2007-12-15 11:32 . 2007-12-15 11:32   <DIR>   d--------   C:\Program Files\DAEMON Tools
2007-12-04 20:24 . 2005-05-26 15:34   2,297,552   --a------   C:\WINDOWS\system32\d3dx9_26.dll
2007-12-04 20:23 . 2003-05-30 09:00   1,962,496   --a------   C:\WINDOWS\system32\quartz.dll
2007-12-04 20:23 . 2003-05-30 09:00   1,962,496   --a--c---   C:\WINDOWS\system32\dllcache\quartz.dll
2007-12-04 20:23 . 2002-12-12 00:14   1,798,144   --a------   C:\WINDOWS\system32\qedit.dll
2007-12-04 20:23 . 2002-12-12 00:14   1,798,144   --a--c---   C:\WINDOWS\system32\dllcache\qedit.dll
2007-12-04 20:23 . 2002-12-12 00:14   136,192   --a------   C:\WINDOWS\system32\mpg2splt.ax
2007-12-04 20:23 . 2002-12-12 00:14   136,192   --a--c---   C:\WINDOWS\system32\dllcache\mpg2splt.ax
2007-12-04 20:23 . 2003-05-30 09:00   132,608   --a--c---   C:\WINDOWS\system32\dllcache\devenum.dll
2007-12-04 20:23 . 2003-05-30 09:00   132,608   --a------   C:\WINDOWS\system32\devenum.dll
2007-12-02 21:29 . 2004-01-11 08:02   258,048   --a------   C:\WINDOWS\system32\GplMpgDec.ax
2007-12-02 21:29 . 2007-04-12 14:19   129,024   --a------   C:\WINDOWS\system32\AVERM.dll
2007-12-02 21:29 . 2006-09-26 13:57   28,672   --a------   C:\WINDOWS\system32\AVEQT.dll
2007-12-02 10:03 . 2007-12-02 10:05   <DIR>   d--------   C:\s

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 15:58   ---------   d-----w   C:\Documents and Settings\Administrator\Dane aplikacji\Skype
2007-12-21 14:00   ---------   d-----w   C:\Program Files\Norton Security Scan
2007-12-16 08:25   ---------   d-----w   C:\Documents and Settings\Administrator\Dane aplikacji\Hamachi
2007-12-14 20:23   685,816   ----a-w   C:\WINDOWS\system32\drivers\sptd.sys
2007-12-14 19:30   ---------   d-----w   C:\Documents and Settings\Administrator\Dane aplikacji\Tibia
2007-12-14 18:19   ---------   d-----w   C:\Program Files\Gadu-Gadu
2007-12-13 20:32   ---------   d-----w   C:\Documents and Settings\Administrator\Dane aplikacji\Temporary
2007-12-05 21:05   ---------   d-----w   C:\Program Files\SopCast
2007-12-05 20:21   ---------   d-----w   C:\Documents and Settings\Administrator\Dane aplikacji\SopCast
2007-11-23 15:45   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-11-18 13:07   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2007-11-16 12:10   ---------   d-----w   C:\Program Files\Stardock
2007-11-16 12:10   ---------   d-----w   C:\Program Files\Common Files\Stardock
2007-11-11 08:40   ---------   d-----w   C:\Documents and Settings\Administrator\Dane aplikacji\fltk.org
2007-11-04 19:38   ---------   d-----w   C:\Program Files\Asprate
2007-10-31 17:48   ---------   d-----w   C:\Program Files\Opera
2007-10-30 09:06   25,280   ----a-w   C:\WINDOWS\system32\drivers\hamachi.sys
2007-10-29 17:07   ---------   d-----w   C:\Program Files\kRk Software
2004-03-11 11:27   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-12-13 17:49   1185120   --a------   C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 06:14]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-10-23 01:47]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 10:38]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 16:35]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-09-07 14:25]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"SoundMan"="SOUNDMAN.EXE" [2004-01-09 02:54 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-05-18 23:35 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe]
"BearShare"="D:\Program Files\BearShare\BearShare.exe" [2006-08-01 17:04]
"WinampAgent"="d:\Program Files\Winamp\winampa.exe" [2007-12-20 16:16]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 18:29]

S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" [2007-07-29 14:40]
S3 SER120;OTI Serial port driver;C:\WINDOWS\System32\DRIVERS\SER120.sys [2004-12-08 17:24]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\System32\DRIVERS\sscdbus.sys [2005-12-22 11:24]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\System32\DRIVERS\sscdmdfl.sys [2005-12-22 11:24]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\System32\DRIVERS\sscdmdm.sys [2005-12-22 11:24]

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-12-21 15:15:05 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 18:03:46
Windows 5.1.2600  NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-22 18:04:17


Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 18:04:52, on 2007-12-22
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.125\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - d:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] "d:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - D:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - D:\PROGRA~1\FlashGet\jc_all.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{C08357D3-60F6-4E79-B586-978AB4C4EDC4}: NameServer = 83.238.255.76 213.241.79.37
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe



[wojtas]

juz czysto jest