proszę o sprawdzenie

[Predi]

Mam problem z kompem, ostatnio zanim się "rozrusza" tzn odpalam go po dłuższym czasie przerwy (~1h) to zanim się włączy zresetuje się 10 razy. Później w trakcie robienia czegokolwiek również zdążają się resety ... Próbowałem już czyszczenia zasilacza, wszystkich wiatraczków, defragmentowania itp, po wakacjach mam zamiar zrobić formata ale na tym komputerze nie da się już nic robić (teraz nie mam oprogramowania więc nie moge zrobić formata). Może po prostu gdzieś w moim systemie siedzi jakiś wirus, sam już nie wiem. Z góry dzięki za pomoc

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:06:24, on 2007-08-16
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\user\Pulpit\Pobieranie\d2hackmap_v2.24_for_d2trade\d2hackmap_v2.24 for d2trade\d2hackmap_v2.24\bin\d2hackmap.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Ericsson\COMMUN~1\MOBILE~1\DbgOut.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: (no name) - {6CE47D72-CD82-4927-BE1A-911ECF645571} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [orcToByloLatwe] C:\WINDOWS\flood.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: BlueSoleil.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c570.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3436E0DB-26AB-471F-B264-57E13DCECE8D}: NameServer = 192.168.0.1,80.244.128.2
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4802 bytes

[wojtas]

skasuj wpis:

O2 - BHO: (no name) - {6CE47D72-CD82-4927-BE1A-911ECF645571} - (no file)

ten plik:

C:\WINDOWS\flood.exe

przeskanuj:

tu i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

oraz daj loga z combofixa

[Predi]

Wpis skasowany, pliku c:\windows\flood.exe nie mogę znaleźć

I log z combofixa

ComboFix 07-08-14.4 - "user" 2007-08-16 21:40:45.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.650 [GMT 2:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\ISTsvc
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\WINDOWS\1.exe
C:\WINDOWS\hosts
C:\WINDOWS\system32\winsys.exe


((((((((((((((((((((((((( Files Created from 2007-07-16 to 2007-08-16 )))))))))))))))))))))))))))))))


2007-08-16 21:39 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-16 21:27 <DIR> d-------- C:\WINDOWS\pss
2007-08-16 21:06 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-12 19:45 <DIR> d-------- C:\DOCUME~1\user\DANEAP~1\Gadu-Gadu
2007-08-09 12:13 <DIR> d-------- C:\Program Files\AutoIt3
2007-07-25 22:06 <DIR> d-------- C:\Program Files\Asprate
2007-07-22 20:36 <DIR> d-------- C:\Program Files\QuickTime Alternative
2007-07-22 20:28 761,856 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-07-22 20:28 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-07-22 20:28 <DIR> d-------- C:\Program Files\XviD


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-16 21:18 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll
2007-08-16 18:43 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-16 13:06 --------- d-------- C:\Program Files\Express WebPictures
2007-08-16 12:55 --------- d-------- C:\Program Files\IDoser v4
2007-08-16 12:50 --------- d-------- C:\Program Files\DOSBox-0.65
2007-08-16 12:49 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-12 22:52 --------- d-------- C:\Program Files\Gadu-Gadu
2007-08-12 20:57 --------- d-------- C:\DOCUME~1\user\DANEAP~1\Tibia
2007-08-12 19:44 --------- d-------- C:\Program Files\Winamp
2007-08-06 16:27 --------- d-------- C:\DOCUME~1\user\DANEAP~1\Hamachi
2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-07-28 00:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-28 00:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-28 00:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-27 23:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-27 23:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-07-23 20:59 --------- d-------- C:\Program Files\Real Alternative
2007-07-23 20:59 --------- d-------- C:\Program Files\Media Player Classic
2007-07-22 20:35 --------- d-------- C:\Program Files\DivX
2007-07-03 23:21 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-02 21:41 36624 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-07-02 21:41 2560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-07-02 21:41 2432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-07-02 21:41 129784 --------- C:\WINDOWS\system32\pxafs.dll
2007-07-02 21:41 118520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-07-02 21:41 116472 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-06-30 11:41 --------- d-------- C:\Program Files\TibiaBot NG
2007-06-29 01:00 --------- d-------- C:\Program Files\EA SPORTS
2007-06-25 20:21 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-06-25 20:21 249856 --------- C:\WINDOWS\Setup1.exe
2007-06-21 16:22 21840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-06-21 16:22 17212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-06-21 16:22 12067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-06-21 16:15 2829 --a------ C:\WINDOWS\DIIUnin.pif
2007-06-21 16:15 106496 --a------ C:\WINDOWS\DIIUnin.exe
2007-06-16 17:56 --------- d-------- C:\Program Files\Tremulous
2007-06-16 11:49 --------- d-------- C:\DOCUME~1\user\DANEAP~1\TibiaTestserver
2007-05-18 17:41 45959 --a------ C:\WINDOWS\setup-4.40.exe
2007-05-18 17:41 18944 --a------ C:\WINDOWS\Stub.exe
2007-05-16 17:19 85504 -----c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:19 510976 -----c--- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:19 1314816 -----c--- C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-16 17:18 86528 -----c--- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:18 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:18 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2005-03-31 23:17 40960 --a------ C:\Program Files\Uninstall_CDS.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"orcToByloLatwe"="C:\WINDOWS\flood.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 11:20]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-02-01 14:52:09]

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys
S3 FXDRV;FXDRV;\??\F:\Fxdrv.sys
S3 GMSIPCI;GMSIPCI;\??\F:\INSTALL\GMSIPCI.SYS
S3 SysCFG;SysCFG;\??\C:\WINDOWS\system32\drivers\SysCFG.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
AutoRun\command- I:\SETUP.EXE


Contents of the 'Scheduled Tasks' folder
2007-06-19 06:46:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-16 19:07:12 C:\WINDOWS\Tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-16 21:42:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-16 21:43:20
C:\ComboFix-quarantined-files.txt ... 2007-08-16 21:43

--- E O F ---

[wojtas]

w logu jest juz ok

skasuj tylko ten wpis:

O4 - HKLM\..\Run: [orcToByloLatwe] C:\WINDOWS\flood.exe

Autor postu otrzymał pochwałę

[Predi]

Dzięki za pomoc, jutro się zobaczy czy pomogło