prosze o sprawdzenie loga

[pawciolo]

prosze o sprawdzenie loga bo ostatnio jak zauwazyłem mój komp chodzi taki "zamulony" normalnie start mi sie otwiera godzine.
Log

Logfile of HijackThis v1.99.1
Scan saved at 19:54:52, on 2008-02-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\avast\aswUpdSv.exe
D:\avast\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\avast\ashDisp.exe
D:\Instalki\NEROTO~1\DRIVES~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\BySoft FreeRAM\FreeRAM.exe
D:\avast\ashMaiSv.exe
D:\avast\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
D:\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\WinRAR.exe
C:\DOCUME~1\Pawel\USTAWI~1\Temp\Rar$EX00.328\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] D:\avast\ashDisp.exe
O4 - HKLM\..\Run: [Nero DriveSpeed] D:\Instalki\NEROTO~1\DRIVES~1.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BySoft FreeRAM] D:\Program Files\BySoft FreeRAM\FreeRAM.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} - C:\Program Files\Common Files\moje.js
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\avast\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\avast\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\avast\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\avast\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: VideoAcceleratorEngine - Unknown owner - D:\PROGRA~1\DAP\SPEEDB~1\VideoAcceleratorEngine.exe (file missing)

i jeszcze jeden problem mam z tym co sie jak nacisnie CTRL+ALT+DELETE no i ne mam u góry paska wyłańczania i opcji. załanczam screena
http://up.programosy.pl/view/na_programoski_menadzer.jpg.html

[Jaramaniak]

jezeli chodzi o ten menadzer zadan to napewno nic groznego bo sam tak mialem wystarczy pare razy gdzies ponaciskac, ale zapomnialem w co

Autor postu otrzymał pochwałę

[Kapucino]

menadzer zadań: kliknij 2 razy ( tak jakbyś otwierał skrót) na tym beżowym tle. powinno powrócić do normy
loga niech sprawdzi specjalista w tej dziedzinie

[pawciolo]

dzieki kapucino powrociło do normy ale czekam jezcze na scpecjaliste od logów

[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[pawciolo]

Ale jak uruchomiź ten tryb awaryjny?? jak ten pasek taki leci w prawo czy gdy pisze zapraszamy i czy przytrzymac F8??

[Dzi@dek]

Po restarcie systemu i ładowaniu klikasz F8 kilkukrotnie aż sie pojawi okno z wyborem.

[pawciolo]

Nie działa wciskam wielokrotnie szybko gdy pisze windows xp i te na dole ten pasek tak leci ale nic sie nie dzieje co robic

[Dzi@dek]

wciskam wielokrotnie szybko gdy pisze windows xp

To troche za późno.
Pobierz narzędzie BootSafe - uruchom i zaznacz opcje pierwszą od dołu.

[pawciolo]

ok działa wrzucam loga z SDFIXA
Log

SDFix: Version 1.142

Run by Administrator on 2008-02-14 at 23:42

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFIX\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found






Removing Temp Files...

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-14 23:47:02
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:d13e1258
"s2"=dword:7714736b
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:c6,9e,89,8d,4d,61,91,07,23,12,dc,d0,da,39,79,13,61,d3,16,b3,b7,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,ce,c2,1d,3c,27,75,d1,b2,ba,15,5c,76,6e,e3,27,90,20,..
"khjeh"=hex:f0,fe,46,41,50,76,1d,9a,e9,d9,8b,f5,43,f7,f4,39,bd,4a,42,ec,33,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:5f,db,d2,37,29,6c,f1,f1,0c,f7,62,1e,a8,40,8c,bc,15,36,6a,38,55,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:91,49,cd,98,7c,77,b1,02,43,02,9b,51,4d,51,17,b7,0d,7d,1e,09,99,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:c6,9e,89,8d,4d,61,91,07,23,12,dc,d0,da,39,79,13,61,d3,16,b3,b7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,ce,c2,1d,3c,27,75,d1,b2,ba,15,5c,76,6e,e3,27,90,20,..
"khjeh"=hex:f0,fe,46,41,50,76,1d,9a,e9,d9,8b,f5,43,f7,f4,39,bd,4a,42,ec,33,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:5f,db,d2,37,29,6c,f1,f1,0c,f7,62,1e,a8,40,8c,bc,15,36,6a,38,55,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:91,49,cd,98,7c,77,b1,02,43,02,9b,51,4d,51,17,b7,0d,7d,1e,09,99,..

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\\Gadu-Gadu\\gg.exe"="D:\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"D:\\Program Files\\Gore\\Gore.exe"="D:\\Program Files\\Gore\\Gore.exe:*:Enabled:Gore"
"D:\\Program Files\\BearShare\\BearShare.exe"="D:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"D:\\Program Files\\gry\\The Heat of War\\System\\Iwo.exe"="D:\\Program Files\\gry\\The Heat of War\\System\\Iwo.exe:*:Enabled:Iwo"
"D:\\Program Files\\gry\\WF.exe"="D:\\Program Files\\gry\\WF.exe:*:Enabled:WF"
"D:\\Program Files\\gry\\Postal 2 STP\\System\\Postal2.exe"="D:\\Program Files\\gry\\Postal 2 STP\\System\\Postal2.exe:*:Enabled:Postal2"
"D:\\Program Files\\gry\\Tibia\\The Heat of War\\System\\Iwo.exe"="D:\\Program Files\\gry\\Tibia\\The Heat of War\\System\\Iwo.exe:*:Enabled:Iwo"
"D:\\Program Files\\gry\\heroes 4\\Aphex.exe"="D:\\Program Files\\gry\\heroes 4\\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"D:\\Program Files\\gry\\OperationFlashpoint\\ofp.exe"="D:\\Program Files\\gry\\OperationFlashpoint\\ofp.exe:*:Disabled:Operation Flashpoint"
"D:\\Program Files\\gry\\Spartan\\SPARTAN.EXE"="D:\\Program Files\\gry\\Spartan\\SPARTAN.EXE:*:Enabled:SPARTAN"
"D:\\Program Files\\gry\\OperationFlashpoint\\OperationFlashpoint.exe"="D:\\Program Files\\gry\\OperationFlashpoint\\OperationFlashpoint.exe:*:Enabled:Operation Flashpoint"
"D:\\Program Files\\Gta San Andreas\\server\\MTA Server.exe"="D:\\Program Files\\Gta San Andreas\\server\\MTA Server.exe:*:Enabled:MTA Server"
"D:\\Program Files\\Project Nomads\\Run\\bin\\win32\\nomads.exe"="D:\\Program Files\\Project Nomads\\Run\\bin\\win32\\nomads.exe:*:Enabled:nomads"
"D:\\Program Files\\Vietcong\\vietcong.exe"="D:\\Program Files\\Vietcong\\vietcong.exe:*:Enabled:vietcong"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"D:\\Program Files\\WF.exe"="D:\\Program Files\\WF.exe:*:Enabled:WF"
"D:\\Program Files\\OperationFlashpoint\\ofp.exe"="D:\\Program Files\\OperationFlashpoint\\ofp.exe:*:Enabled:Operation Flashpoint"
"D:\\Program Files\\Americas Secret Operations - Close Conflict\\System\\cqc.exe"="D:\\Program Files\\Americas Secret Operations - Close Conflict\\System\\cqc.exe:*:Enabled:cqc"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"D:\\Program Files\\Postal 2 STP\\System\\Postal2.exe"="D:\\Program Files\\Postal 2 STP\\System\\Postal2.exe:*:Enabled:Postal2"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------


Files with Hidden Attributes:

Sun 22 Apr 2007 5,371,704 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Tue 27 Nov 2007 88 ..SHR --- "C:\WINDOWS\system32\C846867689.sys"
Mon 28 Jan 2008 3,350 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 1 Dec 2005 2,045 ...H. --- "C:\WINDOWS\system32\whlb32g.dll"
Mon 13 Mar 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 22 Dec 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Wed 4 Apr 2007 0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"

Finished!

Z combo fixa i HJ jutro...
Ok mam Log z Combofixa
Log

ComboFix 08-02-15.2 - Pawel 2008-02-15 10:05:38.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.413 [GMT 1:00]
Running from: D:\Program Files\sciogniete pliki z moozilli\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-15 to 2008-02-15 )))))))))))))))))))))))))))))))
.

2008-02-15 10:04 . 2008-02-15 10:07 53,248 --a------ C:\WINDOWS\PSEXESVC.EXE
2008-02-14 23:40 . 2008-02-14 23:40 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-14 23:39 . 2007-10-26 20:56 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-02-14 23:39 . 2006-05-15 15:21 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-02-14 23:39 . 2006-05-15 14:27 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-02-14 23:39 . 2008-02-14 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-02-14 23:39 . 2006-05-15 15:21 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-02-14 23:39 . 2006-05-15 15:21 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-02-14 23:39 . 2006-05-15 15:21 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-02-14 22:33 . 2008-02-15 10:04 <DIR> d-------- C:\SDFIX
2008-02-14 18:58 . 2008-02-14 18:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-14 18:58 . 2008-02-14 18:58 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-12 20:04 . 2008-02-12 20:04 <DIR> d-------- C:\Program Files\uTorrent
2008-02-12 20:04 . 2008-02-14 15:10 <DIR> d-------- C:\Documents and Settings\Pawel\Dane aplikacji\uTorrent
2008-02-07 14:39 . 2008-02-07 14:39 <DIR> d-------- C:\Documents and Settings\Pawel\Dane aplikacji\Expressivo
2008-02-07 14:30 . 2008-02-07 14:30 <DIR> d-------- C:\Documents and Settings\Pawel\Dane aplikacji\eSkiMoS R2
2008-02-04 17:45 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-02-04 17:45 . 2006-07-28 09:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2008-02-04 17:45 . 2006-07-28 09:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2008-02-03 18:32 . 2008-02-03 18:32 <DIR> d-------- C:\Program Files\directx
2008-01-31 18:35 . 2008-01-31 18:39 <DIR> d-------- C:\Documents and Settings\Pawel\Dane aplikacji\GetRightToGo
2008-01-26 17:37 . 2008-02-01 12:38 <DIR> d-------- C:\Documents and Settings\Pawel\.gimp-2.2
2008-01-26 14:58 . 2008-01-26 14:58 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Trymedia
2008-01-26 14:56 . 2008-01-26 14:56 <DIR> d-------- C:\Program Files\Creative
2008-01-26 14:56 . 2003-04-01 15:13 139,264 --a------ C:\WINDOWS\system32\eax.dll
2008-01-25 18:25 . 2008-01-25 18:25 5,242,934 --------- C:\WINDOWS\click_wallpaper.bmp
2008-01-19 00:58 . 2008-01-19 00:58 23 --a------ C:\WINDOWS\sys.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 17:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-01 11:37 --------- d-----w C:\Documents and Settings\Pawel\Dane aplikacji\gtk-2.0
2008-01-28 13:05 3,350 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-24 23:35 --------- d-----w C:\Documents and Settings\Pawel\Dane aplikacji\Skype
2008-01-17 19:16 --------- d-----w C:\Documents and Settings\Pawel\Dane aplikacji\GanymedeNet
2007-12-26 15:00 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-22 13:44 --------- d-----w C:\Program Files\Yahoo!
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-21 18:23 81,920 -c--a-w C:\WINDOWS\system32\frapsvid.dll
2007-10-27 08:26 246 -c--a-w C:\Documents and Settings\Pawel\FIX.REG
2007-01-18 09:32 7,680 -csha-w C:\Program Files\Common Files\Thumbs.db
2006-09-29 12:53 766 -c--a-w C:\Program Files\Common Files\sms.ico
2006-09-29 12:53 70 -c--a-w C:\Program Files\Common Files\moje.js
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"BySoft FreeRAM"="D:\Program Files\BySoft FreeRAM\FreeRAM.exe" [2004-12-17 21:44 318976]
"Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2007-05-10 15:36 2111176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 11:52 339968]
"HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe" [2003-04-01 15:41 270336]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24 282624]
"avast!"="D:\avast\ashDisp.exe" [2007-12-04 14:00 79224]
"Nero DriveSpeed"="D:\Instalki\NEROTO~1\DRIVES~1.EXE" [2004-04-14 03:16 561152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 08:44 15360]
"Picasa Media Detector"="D:\Picasa2\PicasaMediaDetector.exe" [2007-10-23 22:18 443968]

[HKLM\~\startupfolder\C:^Documents and Settings^Pawel^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk]
path=C:\Documents and Settings\Pawel\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk
backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
D:\Ares\Ares.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BySoft FreeRAM]
--------- 2004-12-17 21:44 318976 D:\Program Files\BySoft FreeRAM\FreeRAM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
-----c--- 2006-11-12 11:48 157592 D:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-05-10 15:36 2111176 D:\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InternetCalls]
D:\InternetCalls\InternetCalls.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2007-10-23 22:18 443968 D:\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipBuster]
D:\VoipBuster\VoipBuster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-10 06:28 36352 D:\Winamp\winampa.exe

R0 AFPAnsi;G-DATA Ukrywacz Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2002-10-09 13:53]
R2 Vcs;Vcs support;C:\WINDOWS\system32\Drivers\Vcs.sys [2002-12-09 15:11]
S0 FO_PAnt;FotoOffice VirtualDisc Driver;C:\WINDOWS\system32\Drivers\FO_PAnt.sys []
S2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2003-03-05 08:07]
S2 sbbotdi;sbbotdi;D:\PROGRA~1\DAP\SPEEDB~1\sbbotdi.sys []
S3 GVTDrv;GVTDrv;C:\WINDOWS\system32\drivers\GVTDrv.sys [2006-08-20 09:55]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
S3 usb2vcom;USB Data Cable;C:\WINDOWS\system32\DRIVERS\usb2vcom.sys [2005-08-06 04:06]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-15 10:07:06
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-15 10:07:48
ComboFix-quarantined-files.txt 2008-02-15 09:07:26
ComboFix2.txt 2007-10-26 19:56:36
ComboFix3.txt 2007-05-23 20:25:26
.
2008-02-13 22:52:52 --- E O F ---

Hijacka
Log

Logfile of HijackThis v1.99.1
Scan saved at 10:09:10, on 2008-02-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\avast\aswUpdSv.exe
D:\avast\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
D:\avast\ashMaiSv.exe
D:\avast\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\QuickTime\qttask.exe
D:\avast\ashDisp.exe
D:\Instalki\NEROTO~1\DRIVES~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\BySoft FreeRAM\FreeRAM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
D:\WinRAR.exe
C:\DOCUME~1\Pawel\USTAWI~1\Temp\Rar$EX00.297\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - D:\Program Files\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] D:\avast\ashDisp.exe
O4 - HKLM\..\Run: [Nero DriveSpeed] D:\Instalki\NEROTO~1\DRIVES~1.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BySoft FreeRAM] D:\Program Files\BySoft FreeRAM\FreeRAM.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Wyslij SMS'a - {215940F1-E7E0-4801-BEE3-44D045534106} - C:\Program Files\Common Files\moje.js
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\avast\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\avast\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\avast\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\avast\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: VideoAcceleratorEngine - Unknown owner - D:\PROGRA~1\DAP\SPEEDB~1\VideoAcceleratorEngine.exe (file missing)

Licze na waszo pomoc

[wojtas]

przeskanuj te pliki:

C:\WINDOWS\PSEXESVC.EXE
C:\WINDOWS\system32\eax.dll
C:\WINDOWS\sys.ini

na tych stronach:

http://virusscan.jotti.org/
http://www.virustotal.com/


i daj raporty

[pawciolo]

pierwsza stronka nie działa ale ta druga daje raporty ale są tam w rzędzie i mam je skopiować i dać tu??
wrażie czego dam
plik C:\WINDOWS\PSEXESVC.EXE
wykryła panda Application/Psexec.
plik C:\WINDOWS\system32\eax.dll
nic nie wykryło
plik C:\WINDOWS\sys.ini
Też nic nie wykryło
chyba takie raporty miały być z tej stronki

[Dzi@dek]

ale ta druga daje raporty ale są tam w rzędzie i mam je skopiować i dać tu??

Daj w *.txt

[pawciolo]

a gdzie to kliknąć?

[wojtas]

ale są tam w rzędzie i mam je skopiować i dać tu??

tak zrób

[pawciolo]

juz napisalem wczesniej ze tylko w jednym pliku C:\WINDOWS\PSEXESVC.EXE wykryła panda Application/Psexec. a te dwa pliki so bez wirusów

[wojtas]

czyli je zostaw sa ok jeszcze przeskanuj:

C:\WINDOWS\system32\whlb32g.dll

Jeśli nie będzie widoczny, to najpierw usuń atrybuty ochronne:
>>Start>>Panel Sterowania>>Opcje Folderów>>Widok>>usuń zaznaczenie przy "Ukryj chronione pliki systemowe">
>zaznacz przy "Pokaż ukryte pliki">>Zastosuj>>OK.

[pawciolo]

C:\WINDOWS\system32\whlb32g.dll ten plik został zeskanowany i przez antiwirus Prevx1 pisze ze jest to wirus nazwa: Polynomial.Code.Exploit to chyba wirus??

[wojtas]

jesli tylko przez jeden skaner zostal wykryty wirus to nie ruszaj go

[pawciolo]

to co dalej mam zrobic bo zobaczyłem poprawe. system zaczoł sybciej chodzić ale jeszcze mam problem z pingiem w grach mam przeważnie 150 a to jest troche denerwoujące.