prosze o sprawdzenie loga... zamul kompa

**Posty:** 53 · przez **Haczor** 02 Lis 2006, 22:36

Ostatnio moj komp zaczął strasznie zamulać..... juz nawet mi emotiony na gg nie dzailaja

Sądze, żę mam jakiegos wirusa ale moj antywirus sobie z nim nie radzi... (mam avg free edition)...
Czym powinienem przeskanowac kompa i co powinienem zrobic??

**Posty:** 18165 · przez **wojtas** 02 Lis 2006, 22:38

podaj loga :
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 53 · przez **Haczor** 02 Lis 2006, 22:45

Kod: Zaznacz wszystko: [quote] Logfile of HijackThis v1.99.1 Scan saved at 21:20:12, on 2006-11-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\D-Link\Air Utility\AirCFG.exe C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\Lexmark P910 Series\ezprint.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\lxbycoms.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Private\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1045 O4 - HKLM\..\Run: [LXBYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBYtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [lxbymon.exe] "C:\Program Files\Lexmark P910 Series\lxbymon.exe" O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark P910 Series\ezprint.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [Wengo] "C:/Documents and Settings/Private/wengophone.exe" -background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: 2Mega Camera Manager Monitor.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: ScanPanel.lnk = C:\Program Files\Trust\Easy Webscan\ScnPanel.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Utwórz Ulubione dla urządzenia przenośnego - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: lxby_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbycoms.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe [/quote]

**Posty:** 935 · przez **Aqui** 02 Lis 2006, 23:13

Czysto..daj silentrunners

**Posty:** 53 · przez **Haczor** 02 Lis 2006, 23:23

A jak to zrobic ??

**Posty:** 7838 · przez **Lukesh** 02 Lis 2006, 23:27

A jak to zrobic ??

Drugi post w tym temacie: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

Btw. Dysk w jakim trybie pracuje? UDMA, czy PIO? (sprawdzasz w menedzerze urzadzen >> kontrolerze dyskowym (we właściwościach urządzeń)) Jeśli w tym drugim, wywal kontroler dysku z systemu i zresetuj kompa - powinno przyspieszyc :wink:

**Posty:** 53 · przez **Haczor** 03 Lis 2006, 08:39

Kod: Zaznacz wszystko
"Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS] "Wengo" = ""C:/Documents and Settings/Private/wengophone.exe" -background" [file not found] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "AVG7_EMC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS] "nwiz" = "nwiz.exe /installquiet" ["NVIDIA Corporation"] "MMTray" = ""C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"" [file not found] "D-Link Air Utility" = "C:\Program Files\D-Link\Air Utility\AirCFG.exe" ["D-Link"] "ANIWZCSService" = "C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe" ["Alpha Networks Inc."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."] "HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" ["HP"] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1045" ["DAEMON'S HOME"] "LXBYCATS" = "rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBYtime.dll,_RunDLLEntry@16" [MS] "lxbymon.exe" = ""C:\Program Files\Lexmark P910 Series\lxbymon.exe"" ["Lexmark International, Inc."] "EzPrint" = ""C:\Program Files\Lexmark P910 Series\ezprint.exe"" ["Lexmark International Inc."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real Alternative\rpshell.dll" ["RealNetworks, Inc."] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{2a593622-8895-4df2-b750-034c78aea7bd}" = "Philips Key Ring Wearable Audio Player (128 MB)Shell Hook" -> {HKLM...CLSID} = "Philips Key Ring Wearable Audio Player (128 MB)Shell Hook" \InProcServer32\(Default) = "PHIL142h.dll" ["Philips, Inc."] "{7bc1c135-9db5-4e1d-bc38-51d775477dc4}" = "Philips Key Ring Wearable Audio Player (64 MB)Shell Hook" -> {HKLM...CLSID} = "Philips Key Ring Wearable Audio Player (64 MB)Shell Hook" \InProcServer32\(Default) = "PHIL140h.dll" ["Philips, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{6af09ec9-b429-11d4-a1fb-0090960218cb}" = "My Bluetooth Places" -> {HKLM...CLSID} = "My Bluetooth Places" \InProcServer32\(Default) = "C:\WINDOWS\system32\btneighborhood.dll" ["WIDCOMM, Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinUHA\(Default) = "{095177B8-8097-4D32-9081-A8949C47020E}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\WinUHA\SHELLW~1.DLL" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinUHA\(Default) = "{095177B8-8097-4D32-9081-A8949C47020E}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\WinUHA\SHELLW~1.DLL" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Private\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS] Startup items in "Private" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "2Mega Camera Manager Monitor" -> shortcut to: "C:\Program Files\MD40323\ICON.EXE" [empty string] "Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Bluetooth Manager" -> shortcut to: "C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe" ["TOSHIBA CORPORATION."] "BTTray" -> shortcut to: "C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe" ["WIDCOMM, Inc."] "ScanPanel" -> shortcut to: "C:\Program Files\Trust\Easy Webscan\ScnPanel.exe" [empty string] Enabled Scheduled Tasks: ------------------------ "{63D47164-736C-473A-A688-D9F5CBF07BD9}_PRIVATE-13B1DD6_Private" -> launches: "C:\WINDOWS\system32\mobsync.exe /Schedule="{63D47164-736C-473A-A688-D9F5CBF07BD9}_PRIVATE-13B1DD6_Private"" [MS] "{A1A8A2DA-D6FD-4473-A507-956F9C515BF9}_PRIVATE-13B1DD6_Private" -> launches: "C:\WINDOWS\system32\mobsync.exe /Schedule="{A1A8A2DA-D6FD-4473-A507-956F9C515BF9}_PRIVATE-13B1DD6_Private"" [MS] "{AE8934DC-256F-4B45-A175-624FC5750974}_PRIVATE-13B1DD6_Private" -> launches: "C:\WINDOWS\system32\mobsync.exe /Schedule="{AE8934DC-256F-4B45-A175-624FC5750974}_PRIVATE-13B1DD6_Private"" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 20 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}" -> {HKLM...CLSID} = "Java Plug-in 1.5.0_04" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."] {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\ "ButtonText" = "Utwórz Ulubione dla urządzenia przenośnego" "CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}" -> {HKLM...CLSID} = "Create Mobile Favorite" \InProcServer32\(Default) = "C:\Program Files\Microsoft ActiveSync\inetrepl.dll" [MS] {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\ "MenuText" = "Utwórz Ulubione dla urządzenia przenośnego..." "CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}" -> {HKLM...CLSID} = "Create Mobile Favorite" \InProcServer32\(Default) = "C:\Program Files\Microsoft ActiveSync\inetrepl.dll" [MS] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {CCA281CA-C863-46EF-9331-5C8D4460577F}\ "ButtonText" = "@btrez.dll,-4015" "MenuText" = "@btrez.dll,-4017" "Script" = "C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm" [null data] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."] Bluetooth Service, btwdins, "C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe" ["WIDCOMM, Inc."] HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]} lxby_device, lxby_device, "C:\WINDOWS\system32\lxbycoms.exe -service" ["Lexmark International, Inc."] NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] SecuROM User Access Service (V7), UserAccess7, "C:\WINDOWS\system32\UAService7.exe" [null data] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Bluetooth Printer Port\Driver = "bthcrp.dll" ["WIDCOMM, Inc."] hpzlnt04\Driver = "hpzlnt04.dll" ["HP"] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] P910 Series Port\Driver = "lxbylmpm.DLL" ["Lexmark International, Inc."] Toshiba Bluetooth Monitor\Driver = "tbtmon.dll" ["Toshiba America Business Solutions, Inc."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 28772 seconds, including 29 seconds for message boxes)

[/code]

**Posty:** 8694 · przez **Red** 03 Lis 2006, 09:52

W tym logu jest czysto.

**Posty:** 53 · przez **Haczor** 03 Lis 2006, 15:15

To co powienem teraz zrobic?? MAm sciagnac jakies anty virusy? albo cos?? Czy juz nic nie moge robic??

**Posty:** 8694 · przez **Red** 03 Lis 2006, 15:23

Nie bardzo rozumiem twoje zdanie....napisz dokładniej co masz na myśli.

**Posty:** 935 · przez **Aqui** 03 Lis 2006, 17:38

Po pierwsze:
Przeczysc rejestr tym programem jv16 PowerTools 2006 1.5.2.344
Instrukcja:
Opcje rejestru ==> Narzędzia ==> Czyszczenie rejestru ==> Po zakończeniu ==> Wybierz ==> Wybór specjalny == > Pozycje które można bezpiecznie usunąć
Start==>uruchom==>msconfig i w zaklade uruchamianie odznacz

O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1045
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [Wengo] "C:/Documents and Settings/Private/wengophone.exe" -background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

Nastepnie przeskanuj www.ewido.net i wklej wynik na forum
Przeskanuj takze http://www.kaspersky.pl/virusscanner.html
Z tych 2 programow wklej raporty na forum,wyrzuc oczywscie wszystko co znalazly
Daj jeszcze loga z http://download.bleepingcomputer.com/sUBs/combofix.exe

Sciagnij programik ,kliknij dwa razy na niego ,wybierz "Y" i enter.Czekasz na działanie i loga ktory sie wygeneruje,wklejasz go tu na forum do sprawdzenia

**Posty:** 53 · przez **Haczor** 07 Lis 2006, 09:27

Kod: Zaznacz wszystko
--------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 16:06:06 2006-11-06 + Scan result: C:\Documents and Settings\Private\Ustawienia lokalne\Temp\1805D.tmp -> Adware.180Solutions : Cleaned. C:\Documents and Settings\Private\Cookies\private@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. :mozilla.37:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. :mozilla.38:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. :mozilla.43:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. :mozilla.44:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. :mozilla.57:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. :mozilla.58:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Private\Cookies\private@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Private\Cookies\private@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Private\Cookies\private@my.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Private\Ustawienia lokalne\Temp\Cookies\private@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned. C:\Documents and Settings\Private\Ustawienia lokalne\Temp\Cookies\private@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned. :mozilla.32:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned. :mozilla.33:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned. C:\Documents and Settings\Private\Ustawienia lokalne\Temp\Cookies\private@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.26:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.27:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Documents and Settings\Private\Cookies\private@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Documents and Settings\Private\Ustawienia lokalne\Temp\Cookies\private@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.67:C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end

Kod: Zaznacz wszystko
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 6 listopad 2006 23:50:38 System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.83.0 Ostatnia aktualizacja Kaspersky Anti-Virus 6/11/2006 Liczba wpisów w bazie danych Kaspersky Anti-Virus238666 ------------------------------------------------------------------------------- Ustawienia skanowania: Skanowanie przy użyciu następujących baz danych: rozszerzone Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: C:\ D:\ Statystyki skanowania: Liczba skanowanych obiektów: 53055 Liczba wykrytych wirusów: 7 Liczba zainfekowanych obiektów: 22 / 0 Liczba podejrzanych obiektów: 0 Czas trwania skanowania: 02:53:53 Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie C:\Documents and Settings\All Users\Dane aplikacji\Grisoft\Avg7Data\avg7log.log Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Grisoft\Avg7Data\avg7log.log.lck Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat Object is locked pominięty C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat Object is locked pominięty C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Private\Cookies\index.dat Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\AVG7\Log\emc.log Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\Cache\_CACHE_001_ Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\Cache\_CACHE_002_ Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\Cache\_CACHE_003_ Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\Cache\_CACHE_MAP_ Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\cert8.db Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\history.dat Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\key3.db Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Mozilla\Firefox\Profiles\1zgtygtv.default\parent.lock Object is locked pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1f4eade4-760e651a.zip/BlackBox.class Zainfekowanych: Exploit.Java.ByteVerify pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1f4eade4-760e651a.zip/VerifierBug.class Zainfekowanych: Exploit.Java.ByteVerify pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1f4eade4-760e651a.zip/Beyond.class Zainfekowanych: Trojan-Downloader.Java.OpenConnection.aa pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-1f4eade4-760e651a.zip ZIP: zainfekowany - 3 pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-68d0d310-32dd5293.zip/GetAccess.class Zainfekowanych: Trojan-Downloader.Java.OpenConnection.aj pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-68d0d310-32dd5293.zip/Installer.class Zainfekowanych: Trojan-Downloader.Java.OpenConnection.aj pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-68d0d310-32dd5293.zip ZIP: zainfekowany - 2 pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-cb66fa7-11ddcb66.zip/GetAccess.class Zainfekowanych: Trojan-Downloader.Java.OpenConnection.aj pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-cb66fa7-11ddcb66.zip/Installer.class Zainfekowanych: Trojan-Downloader.Java.OpenConnection.aj pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-cb66fa7-11ddcb66.zip ZIP: zainfekowany - 2 pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv455.jar-1e572a99-31086cee.zip/Matrix.class Zainfekowanych: Trojan-Downloader.Java.OpenStream.c pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv455.jar-1e572a99-31086cee.zip/Counter.class Zainfekowanych: Trojan.Java.ClassLoader.h pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv455.jar-1e572a99-31086cee.zip/Parser.class Zainfekowanych: Trojan.Java.ClassLoader.d pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv455.jar-1e572a99-31086cee.zip ZIP: zainfekowany - 3 pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-44b20e04.zip/Matrix.class Zainfekowanych: Trojan-Downloader.Java.OpenStream.c pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-44b20e04.zip/Counter.class Zainfekowanych: Trojan.Java.ClassLoader.h pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-44b20e04.zip/Parser.class Zainfekowanych: Trojan.Java.ClassLoader.d pominięty C:\Documents and Settings\Private\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-44b20e04.zip ZIP: zainfekowany - 3 pominięty C:\Documents and Settings\Private\NTUSER.DAT Object is locked pominięty C:\Documents and Settings\Private\ntuser.dat.LOG Object is locked pominięty C:\Documents and Settings\Private\Pulpit\gg76.exe/stream/data0004 Zainfekowanych: Trojan.Win32.KillProc.p pominięty C:\Documents and Settings\Private\Pulpit\gg76.exe/stream Zainfekowanych: Trojan.Win32.KillProc.p pominięty C:\Documents and Settings\Private\Pulpit\gg76.exe NSIS: zainfekowany - 2 pominięty C:\Documents and Settings\Private\Pulpit\gg76.exe UPX: zainfekowany - 2 pominięty C:\Documents and Settings\Private\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat Object is locked pominięty C:\Documents and Settings\Private\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty C:\Documents and Settings\Private\Ustawienia lokalne\Historia\History.IE5\index.dat Object is locked pominięty C:\Documents and Settings\Private\Ustawienia lokalne\Historia\History.IE5\MSHist012006110620061107\index.dat Object is locked pominięty C:\Documents and Settings\Private\Ustawienia lokalne\Temp\Perflib_Perfdata_774.dat Object is locked pominięty C:\Documents and Settings\Private\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty C:\WINDOWS\$_hpcst$.hpc Object is locked pominięty C:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty C:\WINDOWS\SchedLgU.Txt Object is locked pominięty C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty C:\WINDOWS\Sti_Trace.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\edb.log Object is locked pominięty C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked pominięty C:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\default Object is locked pominięty C:\WINDOWS\system32\config\default.LOG Object is locked pominięty C:\WINDOWS\system32\config\SAM Object is locked pominięty C:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty C:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\SECURITY Object is locked pominięty C:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty C:\WINDOWS\system32\config\software Object is locked pominięty C:\WINDOWS\system32\config\software.LOG Object is locked pominięty C:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty C:\WINDOWS\system32\config\system Object is locked pominięty C:\WINDOWS\system32\config\system.LOG Object is locked pominięty C:\WINDOWS\system32\h323log.txt Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty C:\WINDOWS\wiadebug.log Object is locked pominięty C:\WINDOWS\wiaservc.log Object is locked pominięty C:\WINDOWS\WindowsUpdate.log Object is locked pominięty Proces skanowania został zakończony. [/quote]

Kod: Zaznacz wszystko
Private - 2006-11-07 7:51:13,20 Dodatek Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Private\Pulpit" ((((((((((((((((((((((((((((((( Files Created from 2020-07-07 to 202006-11-07 )))))))))))))))))))))))))))))))))) No new files created in this timespan (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "H/PC Connection Agent"="\"C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe" "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "nwiz"="nwiz.exe /installquiet" "D-Link Air Utility"="C:\\Program Files\\D-Link\\Air Utility\\AirCFG.exe" "ANIWZCSService"="C:\\Program Files\\Alpha Networks\\ANIWZCS Service\\WZCSLDR.exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb04.exe" "LXBYCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\LXBYtime.dll,_RunDLLEntry@16" "lxbymon.exe"="\"C:\\Program Files\\Lexmark P910 Series\\lxbymon.exe\"" "EzPrint"="\"C:\\Program Files\\Lexmark P910 Series\\ezprint.exe\"" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Moja bieżąca strona główna" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,86,01,00,00,00,00,00,00,7a,02,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Moduł wstępnego ładowania interfejsu Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Demon buforu kategorii składników" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="daemon" "hkey"="HKLM" "command"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1045" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mm_tray" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wengo] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="\"C:/Documents and Settings/Private/wengophone" "hkey"="HKCU" "command"="\"C:/Documents and Settings/Private/wengophone.exe\" -background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winampa" "hkey"="HKLM" "command"="C:\\Program Files\\Winamp\\winampa.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\{63D47164-736C-473A-A688-D9F5CBF07BD9}_PRIVATE-13B1DD6_Private.job C:\WINDOWS\tasks\{A1A8A2DA-D6FD-4473-A507-956F9C515BF9}_PRIVATE-13B1DD6_Private.job C:\WINDOWS\tasks\{AE8934DC-256F-4B45-A175-624FC5750974}_PRIVATE-13B1DD6_Private.job Completion time: 2006-11-07 7:56:40,67 C:\ComboFix.txt ... 2006-11-07 07:56

**Posty:** 935 · przez **Aqui** 07 Lis 2006, 16:41

http://www.searchengines.pl/phpbb203/index.php?showtopic=12510&st=8&
lektura :wink:

dodatkowo:
Start => Uruchom => wpisz cmd =>

RD /S /Q "C:\Documents and Settings\Nazwa Twojego konta\Ustawienia lokalne\Temp"

Autor postu otrzymał pochwałę

**Posty:** 53 · przez **Haczor** 07 Lis 2006, 18:12

co mam z tym zrobic??

Ostatnio jak czytalem forum zauwazylem temat w ktorym ktoc pisal ze caly czas ma uzycie procesora na 100% spojrzalem do siebie i tez tak mam

Powinienem cos z tym robic??

**Posty:** 935 · przez **Aqui** 07 Lis 2006, 19:18

A jaki proces zuzywa te 100%??
Masz to przeczytac i wykonac instrukcje wg tamtego schematu :roll:

**Posty:** 53 · przez **Haczor** 08 Lis 2006, 15:21

Yrobilem i wzskakuje mi cos takiego
Microsoft Windows XP [Wersja 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Private>C:\Documents and Settings\Nazwa Twojego konta\
Ustawienia lokalne\Temp
Nazwa 'C:\Documents' nie jest rozpoznawana jako polecenie wewnętrzne lub zewnętr
zne,
program wykonywalny lub plik wsadowy.

C:\Documents and Settings\Private>

**Posty:** 935 · przez **Aqui** 08 Lis 2006, 15:23

no bo w miejscu

Nazwa Twojego konta

wpisz nazwe swojego konta :wink:

**Posty:** 53 · przez **Haczor** 08 Lis 2006, 15:43

A to co do tego stanu procka

[ Dodano: Dzisiaj o 14:24 ]
Microsoft Windows XP [Wersja 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Private>C:\Documents and Settings\Private\Ustawienia l
okalne\Temp
Nazwa 'C:\Documents' nie jest rozpoznawana jako polecenie wewnętrzne lub zewnętr
zne,
program wykonywalny lub plik wsadowy.

C:\Documents and Settings\Private>C:\Documents and Settings\private\Ustawienia l
okalne\Temp
Nazwa 'C:\Documents' nie jest rozpoznawana jako polecenie wewnętrzne lub zewnętr
zne,
program wykonywalny lub plik wsadowy.

C:\Documents and Settings\Private>

**Posty:** 935 · przez **Aqui** 08 Lis 2006, 15:50

Sprobuj recznie wyczyscic folder

C:\Documents and Settings\Nazwa Twojego konta\Ustawienia lokalne\Temp

Zaznaczam,że ma byc oproznieny ten folder,a nie usuniety :!:

Proces gg.exe zżera Ci pamiec,zobacz czy jest to samo z wyłączonym gg
Ogolnie==>reinstal gg z czyszczeniem rejestru...

**Posty:** 53 · przez **Haczor** 08 Lis 2006, 16:08

No i teraz zonk... nie moge znalesc ustawien lokalnych!! :wow:

nie ma w zadnym profilu :wow:

A co do gg to tak jest caly czas

Czyli mam je odinstalowac i zainstalowac jeszcze raz poprostu??

prosze o sprawdzenie loga... zamul kompa

Prosze o sprawdzenie loga... Zamul kompa

Kto jest na forum