proszę o sprawdzenie loga

[dawidov]

Od kilku dni mam kłopot z kompem resetuje się albo rozłącza się internet.
Niżej daje loga.

Logfile of HijackThis v1.99.1
Scan saved at 19:47:01, on 2007-05-19
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\System32\igfxtray.exe
E:\WINDOWS\System32\hkcmd.exe
E:\WINDOWS\System32\igfxpers.exe
E:\WINDOWS\stsystra.exe
E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
E:\Program Files\HP\HP Software Update\HPWuSchd2.exe
E:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Program Files\Common Files\SmartCom\RTEGPRS.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
E:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
E:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
E:\Documents and Settings\Katarzyna\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - E:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - E:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - E:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [igfxtray] E:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] E:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] E:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [kav] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [RTEGPRS] "E:\Program Files\Common Files\SmartCom\RTEGPRS.exe" tray
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = E:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{76FE013E-1BB6-43AD-BC37-4AD9592BC30B}: NameServer = 213.158.194.1 213.158.193.38
O20 - Winlogon Notify: igfxcui - E:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - E:\WINDOWS\System32\klogon.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

[wojtas]

skasuj wpisy + pogruiobny do kosza:

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - E:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - E:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

daj loga :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[dawidov]

"Katarzyna" - 2007-05-19 21:07:16 Dodatek Service Pack. 1
ComboFix 07-05.19.5.V - Running from: "E:\Documents and Settings\Katarzyna\Pulpit\"



((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-19 ))))))))))))))))))))))))))))))))))


2007-05-01 21:12 <DIR> d-------- E:\Program Files\SopCast
2007-05-01 21:12 <DIR> d-------- E:\DOCUME~1\KATARZ~1\DANEAP~1\SopCast
2007-04-23 16:23 <DIR> d-------- E:\Program Files\Leksykonia


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-19 19:09:06 -------- d-----w E:\Program Files\Kaspersky Lab
2007-05-01 18:51:10 -------- d--h--w E:\Program Files\WindowsUpdate
2007-04-10 18:14:09 -------- d-----w E:\Program Files\Real Alternative
2007-04-10 18:14:09 -------- d-----w E:\Program Files\Media Player Classic
2007-03-30 20:01:48 -------- d--h--w E:\Program Files\InstallShield Installation Information
2007-03-28 14:11:08 561,152 ----a-w E:\Program Files\CoolCDBurner.exe
2007-03-25 20:09:49 49,690 ----a-w E:\WINDOWS\system32\perfc015.dat
2007-03-25 20:09:49 355,724 ----a-w E:\WINDOWS\system32\perfh015.dat
2007-03-11 12:11:32 -------- d-----w E:\DOCUME~1\KATARZ~1\DANEAP~1\Skype
2007-03-10 09:58:07 -------- d-----w E:\Program Files\Gadu-Gadu
2007-03-06 12:50:54 1,101,824 ----a-w E:\WINDOWS\system32\NMSDVDXU.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 00:17]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=E:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [2006-11-09 16:21]
{C08DF07A-3E49-4E25-9AB0-D3882835F153}=E:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="E:\WINDOWS\System32\igfxtray.exe" [2006-02-07 02:39]
"igfxhkcmd"="E:\WINDOWS\System32\hkcmd.exe" [2006-02-07 02:36]
"igfxpers"="E:\WINDOWS\System32\igfxpers.exe" [2006-02-07 02:40]
"SigmatelSysTrayApp"="stsystra.exe" []
"SynTPEnh"="E:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 08:26]
"TkBellExe"="E:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-09-30 22:13]
"kav"="E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-03-24 19:09]
"@"="" []
"HP Software Update"="E:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12]
"SunJavaUpdateSched"="E:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="E:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05]
"RTEGPRS"="E:\Program Files\Common Files\SmartCom\RTEGPRS.exe" [2005-09-20 17:56]
"MSMSGS"="E:\Program Files\Messenger\msmsgs.exe" [2002-08-20 16:08]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0
Security Packages kerberos msv1_0 schannel wdigest
Notification Packages scecli

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV
NetworkService DnsCache
rpcss RpcSs
imgsvc StiSvc
termsvcs TermService

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

*Newly Created Service* -PROCEXP90


~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070519-210040-341
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - E:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

backup-20070519-210039-166
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - E:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-19 21:09:14
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

Completion time: 2007-05-19 21:09:40


--- E O F ---
((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-19 ))))))))))))))))))))))))))))))))))

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta