prosze o sprawdzenie loga

**Posty:** 12 · przez **pierwszaa** 28 Maj 2006, 21:15

Witam! Mam problem z kompem - po wejsciu na jakas stronke komp zaczal zamulac. Explorer nie dawal sie zamykac, dodatkowo kilka roznych mniejszych problemow. Przeskanowalam go spy sweeperem i spywere doctorem, costam bylo ale niewiele - pomoglo praktycznie na wszystko poza 2 rzeczami:
- defragmentator systemowy zniknal :| - jest "odinstalowany", a diskeeper po prostu nie dziala
- proba przywrocenia systemu czy zainstalowania nowego nic nie daje - wyskakuje komunikat ze zmienil sie jeden z plikow jadra i nie mozna kontynuowac.
Bardzo zalezy mi na tym zeby nie robic formata..
Bardzo prosze o pomoc i zalaczam logi

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"HitwarePKLite" = "C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE" ["Right Utilities Inc."]
"Hide IP Platinum" = "C:\Program Files\Hide IP Platinum\hideippla.exe" ["Volcano Force"]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]

HKLM\Software\Microsoft\Active Setup\Installed Components\
>{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer"
\StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS]
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express"
\StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS]
{8b15971b-5355-4c82-8c07-7e181ea07608}\(Default) = "Fax"
\StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser" [MS]
{94de52c8-2d59-4f1b-883e-79663d2d9a8c}\(Default) = "Fax Provider"
\StubPath = "rundll32.exe C:\WINDOWS\system32\Setup\FxsOcm.dll,XP_UninstallProvider" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{604B283A-4E26-4504-98E7-72859F949547}\(Default) = "RUPK"
-> {HKLM...CLSID} = "Hitware Popup Killer Lite"
\InProcServer32\(Default) = "C:\PROGRA~1\HITWAR~2\sypcms.dll" ["RIGHT Utilities Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{E976844F-E7A7-41E1-B7DF-6FDC48AE2C57}" = "MJ2Desc Shell Extension"
-> {HKLM...CLSID} = "CMJ2Desc PropertySheet Shell Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\mj2desc.dll" ["Morgan Multimedia"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Browseui.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{40950107-FEA6-4d53-A65F-B2DCBA57DD58}" = "Nokia Phone Browser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
-> {HKLM...CLSID} = "History Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Shdocvw.dll" [MS]
"{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE Microsoft AutoComplete"
-> {HKLM...CLSID} = "IE Microsoft AutoComplete"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Browseui.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{2F860D81-AF3C-11D4-BDB3-00E0987D8540}" = "UltimateZip Shell Extension"
-> {HKLM...CLSID} = "UltimateZip Shell Extension 1"
\InProcServer32\(Default) = "C:\PROGRA~1\ULTIMA~1\uzshlex.dll" [null data]
"{2F860D82-AF3C-11D4-BDB3-00E0987D8540}" = "UltimateZip Drag Drop Handler"
-> {HKLM...CLSID} = "UltimateZip Drag Drop Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\ULTIMA~1\uzshldr.dll" [null data]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
-> {HKLM...CLSID} = "ShellLink for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
-> {HKLM...CLSID} = "Shell Icon Handler for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration"
-> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration"
\InProcServer32\(Default) = "C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
INFECTION WARNING! "AppInit_DLLs" = "C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll" ["Agnitum Ltd."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * oodbs SsiEfr.e" [file not found], [MS], [file not found], [null data], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

hijack:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
C:\Program Files\Hide IP Platinum\hideippla.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Documents and Settings\Monika\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 211.76.98.66:80
O2 - BHO: RUPK - {604B283A-4E26-4504-98E7-72859F949547} - C:\PROGRA~1\HITWAR~2\sypcms.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKCU\..\Run: [HitwarePKLite] C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = C:\Program Files\Diskeeper Corporation\Diskeeper\ESIRegister.exe
O4 - Global Startup: kav.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe
O4 - Global Startup: outpost.lnk = C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - (no file)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

**Posty:** 655 · przez **rudyxp** 28 Maj 2006, 21:38

C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE

C:\WINDOWS\system32\wbem\wmiapsrv.exe

O2 - BHO: RUPK - {604B283A-4E26-4504-98E7-72859F949547} - C:\PROGRA~1\HITWAR~2\sypcms.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll

do wywalenia

===========
moj blad, przepraszam :oops:

**Posty:** 18165 · przez **wojtas** 28 Maj 2006, 21:45

C:\WINDOWS\System32\snmp.exe tego nie wywaylaj!

przez **Tom@szek** 28 Maj 2006, 22:30

pierwszaa

Po pierwsze - prosze wkleić całego log-a z hijackthis.
rudyxp
Nie bądź taki wyrywny - nie pisz czegoś czego nie rozumiesz.

**Posty:** 12 · przez **pierwszaa** 28 Maj 2006, 23:16

przepraszam za tego loga, sama nie wiem dlaczego tak zaznaczylam:)

Logfile of HijackThis v1.99.1
Scan saved at 21:43:15, on 2006-05-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
C:\Program Files\Hide IP Platinum\hideippla.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\AVANTB~1\avant.exe
C:\Program Files\eMule\emule.exe
C:\Documents and Settings\Monika\Pulpit\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 211.76.98.66:80
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKCU\..\Run: [HitwarePKLite] C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = C:\Program Files\Diskeeper Corporation\Diskeeper\ESIRegister.exe
O4 - Global Startup: kav.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe
O4 - Global Startup: outpost.lnk = C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\PROGRA~1\AVANTB~1\AddAllToADBlackList.htm
O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\PROGRA~1\AVANTB~1\AddToADBlackList.htm
O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\PROGRA~1\AVANTB~1\OpenInNewBrowser.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... - C:\PROGRA~1\AVANTB~1\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - C:\PROGRA~1\AVANTB~1\Highlight.htm
O8 - Extra context menu item: Szukaj - C:\PROGRA~1\AVANTB~1\Search.htm
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - (no file)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

**Posty:** 1665 · przez **SER** 28 Maj 2006, 23:19

rudyxp - bez komentarza :roll:

Wszystkie podane przez Ciebie pliki nie są szkodliwe

===========================

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - (no file)

Usuwasz tylko te wpisy

==================

Łączysz się przez proxy :?:

Autor postu otrzymał pochwałę

**Posty:** 12 · przez **pierwszaa** 28 Maj 2006, 23:28

dziekuje,usunelam
lacze sie bez proxy, a komp dalej muli
sprawdzilam go jeszcze counterspy i tez nic nie wykryl..

przez **jeff** 28 Maj 2006, 23:41

O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe

może to stanowi zamulacz ??

Autor postu otrzymał pochwałę

**Posty:** 12 · przez **pierwszaa** 28 Maj 2006, 23:44

hmm.. w sumie mozliwe, tylko ze do tej pory wszystko bylo ok.. sprawdzilam wszystko co mi przyszlo do glowy, poczawszy od kabli na serownikach skonczywszy..

faktycznie muli jakby mniej ale dalej cos jestnie tak:(

dzieki za pomoc!

przez **Tom@szek** 29 Maj 2006, 01:45

pierwszaa
Spróbuj defragmentacji dysku-ów.
Choćby tym narzędziem:
http://www.pcworld.pl/ftp/pc/programy/4507/Diskeeper.for.Windows.9.0.html

**Posty:** 12 · przez **pierwszaa** 29 Maj 2006, 01:51

wlasnie problem polega na tym ze defragmentator nie dziala..
Tak jak mi radzil SER (pozdrawiam i dziekuje:)) sciagnelam defragmentator windowsa, okazalo sie ze moj defragmentator jest - tyle ze nie ma do niego dostepu, po prostu sie nie chce uruchomic, a diskeeper "could not initialize"..

**Posty:** 8694 · przez **Red** 29 Maj 2006, 14:57

prosze jeszcze przeskanowac kompa ewido:
http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

wklej zawartosc loga ktory wygeneruje sie .....

**Posty:** 12 · przez **pierwszaa** 29 Maj 2006, 22:30

Wszystko zrobilam, wirusow/trojanow nie ma, a log wyglada tak:

Logfile of HijackThis v1.99.1
Scan saved at 20:52:58, on 2006-05-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
C:\Program Files\Hide IP Platinum\hideippla.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Monika\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 210.118.163.2:8080
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [HitwarePKLite] C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: kav.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe
O4 - Global Startup: outpost.lnk = C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - (no file)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

tego nie moge usunac:

O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - (no file)

przez **jeff** 29 Maj 2006, 22:53

ale masz wkleić log też z prog EWIDO

**Posty:** 12 · przez **pierwszaa** 29 Maj 2006, 23:40

---------------------------------------------------------
ewido anti-malware - Startup report
---------------------------------------------------------

+ Created on: 22:14:52, 2006-05-29
+ Report-Checksum: 5BFFC1D0

Reg\HKLM\Run NvCplDaemon RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Reg\HKCU\Run Gadu-Gadu "C:\Program Files\Gadu-Gadu\gg.exe" /tray
Reg\HKCU\Run HitwarePKLite C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
Reg\HKCU\Run Hide IP Platinum C:\Program Files\Hide IP Platinum\hideippla.exe
Shell\CommonStartup kav.lnk C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\kav.lnk
Shell\CommonStartup outpost.lnk C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\outpost.lnk

---------------------------------------------------------
ewido anti-malware - Process report
---------------------------------------------------------

+ Created on: 22:17:52, 2006-05-29
+ Report-Checksum: 9395434

0: System Process
4: System Process
252: C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
480: \SystemRoot\System32\smss.exe
544: \??\C:\WINDOWS\system32\csrss.exe
568: \??\C:\WINDOWS\system32\winlogon.exe
612: C:\WINDOWS\system32\services.exe
624: C:\WINDOWS\system32\lsass.exe
696: C:\WINDOWS\system32\NOTEPAD.EXE
776: C:\WINDOWS\system32\svchost.exe
836: C:\WINDOWS\system32\svchost.exe
868: C:\WINDOWS\System32\svchost.exe
948: C:\WINDOWS\system32\svchost.exe
1004: C:\WINDOWS\system32\svchost.exe
1224: C:\WINDOWS\system32\spoolsv.exe
1340: C:\Program Files\IncrediMail\bin\IncMail.exe
1492: C:\WINDOWS\Explorer.EXE
1580: System Process
1620: C:\PROGRA~1\HITWAR~2\HITWAR~1.EXE
1628: C:\Program Files\Hide IP Platinum\hideippla.exe
1644: C:\WINDOWS\System32\alg.exe
1648: System Process
1688: C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
1780: C:\WINDOWS\system32\nvsvc32.exe
2040: C:\WINDOWS\System32\snmp.exe
2436: C:\Program Files\Gadu-Gadu\gg.exe
2940: C:\Program Files\ewido anti-malware\SecuritySuite.exe
3376: C:\Program Files\Avant Browser\avant.exe
3484: C:\WINDOWS\system32\NOTEPAD.EXE

---------------------------------------------------------
ewido anti-malware - Connection report
---------------------------------------------------------

+ Created on: 22:17:33, 2006-05-29
+ Report-Checksum: 82775363

TCP 0.0.0.0:803 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1040 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1550 0.0.0.0:0 LISTENING
TCP 83.144.99.159:139 0.0.0.0:0 LISTENING
TCP 83.144.99.159:1461 217.17.45.144:443 ESTABLISHED
TCP 127.0.0.1:1037 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1614 127.0.0.1:1040 TIME_WAIT
UDP 0.0.0.0:161
UDP 0.0.0.0:1031
UDP 83.144.99.159:123
UDP 83.144.99.159:137
UDP 83.144.99.159:138
UDP 83.144.99.159:1900
UDP 127.0.0.1:123
UDP 127.0.0.1:1035
UDP 127.0.0.1:1054
UDP 127.0.0.1:1514
UDP 127.0.0.1:1900

**Posty:** 1665 · przez **SER** 29 Maj 2006, 23:43

Nie o to chodzi ...

==============

http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

Instalujes ten program, potem aktualizujesz sygnatury (Update -> Start update) i skanujesz komputer (Scanner -> Complete system scan). Po zakończeniu skanowania klikasz Save report -> zapisujesz

Dajesz nam zawartość tego raportu

**Posty:** 12 · przez **pierwszaa** 30 Maj 2006, 00:47

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 23:22:54, 2006-05-29
+ Report-Checksum: C45FB039

+ Scan result:

No infected objects found.

::Report End

no mowilam ze czysto:)

**Posty:** 1665 · przez **SER** 30 Maj 2006, 00:52

No niby czysto ... :roll:

Może spróbuj przywrócić system (jeśli masz włączone Przywracanie Systemu) do dnia, kiedy wszystko chodziło dobrze

Więcej pomysłów nie mam ...

**Posty:** 12 · przez **pierwszaa** 30 Maj 2006, 00:54

nie mam przywracania..

prosze o sprawdzenie loga

Prosze o sprawdzenie loga

Kto jest na forum