Spowolnione procesy komputer - prosze o spr.loga

**Posty:** 271 · przez **Sythev** 10 Mar 2009, 13:24

Witam !

Nie wiem czemu ale mam dziwne wrażenie,że mój komputer strasznie długo myśli,długo wykonuje proste czynności..
a 2miesiące temu kupiłem przecież nowy komputer i troche mnie to dziwi..
Prosze o sprawdzenie loga i jakieś wskazówki,żeby szybciej chodził.

LOG:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:21:45, on 2009-03-10 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:pl O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBA24B3-9835-478F-A2A1-868EC66CF709}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: ArcaBit Control (ArcaRemoteService) - Unknown owner - C:\Program Files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe (file missing) O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ArcaBit Backup Service (AVBackup) - Unknown owner - C:\Program Files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe (file missing) O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ArcaBit Tasks Service (AVTasks2) - Unknown owner - C:\PROGRA~1\ArcaBit\Common\ARCATA~1.EXE (file missing) O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing) O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe -- End of file - 4859 bytes

Dodano 10.03.2009 12:29:50:
WWDC :

Dodano 10.03.2009 12:38:38:

Kod: Zaznacz wszystko: ComboFix 09-03-06.02 - Dom 2009-03-10 12:32:52.2 - NTFSx86 Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.1.1045.18.3326.1984 [GMT 1:00] Uruchomiony z: c:\users\Dom\Downloads\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-10 do 2009-03-10 ))))))))))))))))))))))))))))))) . 2009-03-09 22:31 . 2009-03-09 23:20 <DIR> d-------- c:\users\Dom\archive 2009-03-09 17:27 . 2009-03-09 17:27 <DIR> d-------- c:\users\Dom\AppData\Roaming\GanymedeNet 2009-03-09 17:27 . 2009-03-09 17:27 4 --a------ c:\windows\System32\proc1114473455.bin 2009-03-01 21:13 . 2009-03-01 21:13 <DIR> d-------- C:\VundoFix Backups 2009-02-19 00:59 . 2009-02-19 00:59 34,883 --a------ c:\users\Dom\zalaczniki.zip 2009-02-10 22:53 . 2009-02-10 22:53 <DIR> d-------- c:\users\Dom\AppData\Roaming\teamspeak2 2009-02-10 22:53 . 2009-02-10 22:53 <DIR> d-------- c:\program files\Teamspeak2_RC2 2009-02-10 22:53 . 2009-02-10 22:53 34,064 --a------ c:\windows\System32\lhacm.acm . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-09 21:33 --------- d-----w c:\program files\Steam 2009-03-09 19:42 --------- d-----w c:\program files\Common Files\Steam 2009-02-07 07:57 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-02-07 07:57 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-02-07 07:57 10,520 ----a-w c:\windows\System32\avgrsstx.dll 2009-02-07 07:57 --------- d-----w c:\programdata\avg8 2009-02-06 20:34 --------- d-----w c:\program files\Trend Micro 2009-02-06 20:26 50,688 ----a-w c:\users\Dom\ATF-Cleaner.exe 2009-02-02 19:11 --------- d-----w c:\program files\Vidalia Bundle 2009-02-02 19:11 --------- d-----w c:\program files\SkanerOnline 2009-01-31 15:08 --------- d-----w c:\programdata\Microsoft Help 2009-01-31 15:07 --------- d-----w c:\program files\Microsoft Works 2009-01-31 15:06 --------- d-----w c:\program files\Microsoft.NET 2009-01-31 14:12 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-31 13:31 --------- d-----w c:\program files\Common Files\InstallShield 2009-01-26 13:55 --------- d-----w c:\users\Dom\AppData\Roaming\Corel 2009-01-26 13:55 --------- d-----w c:\programdata\Corel 2009-01-26 13:54 --------- d-----w c:\programdata\Borland 2009-01-26 13:47 8 --sh--r c:\users\All Users\15C7767172.sys 2009-01-26 13:47 8 --sh--r c:\programdata\15C7767172.sys 2009-01-26 13:47 2,828 --sha-w c:\users\All Users\KGyGaAvL.sys 2009-01-26 13:47 2,828 --sha-w c:\programdata\KGyGaAvL.sys 2009-01-25 14:47 --------- d-----w c:\programdata\TVU Networks 2009-01-14 17:51 --------- d-----w c:\users\Dom\AppData\Roaming\PeerNetworking 2009-01-14 17:27 --------- d-----w c:\program files\Common Files\LightScribe 2009-01-14 17:22 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-22 08:05 51,232 ----a-w c:\users\Dom\wwdc.exe 2008-12-17 16:09 319,456 ----a-w c:\windows\DIFxAPI.dll 2008-12-17 16:09 315,392 ----a-w c:\windows\HideWin.exe 2008-09-28 13:53 242,176 ----a-w c:\users\Dom\aequitas.exe 2008-09-26 13:21 1,136,128 ----a-w c:\users\Dom\AequiAPI.dll 2008-04-16 19:04 174 --sha-w c:\program files\desktop.ini . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-07 1601304] "diagnostics"="c:\program files\Thomson\ST330\diagnostics\diagnostics.exe" [2008-12-17 557149] "EM_EXEC"="c:\progra~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2004-01-08 37888] "RtHDVCpl"="RtHDVCpl.exe" [2008-01-29 c:\windows\RtHDVCpl.exe] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NaturalColorLoad.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NaturalColorLoad.lnk backup=c:\windows\pss\NaturalColorLoad.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 c:\program files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-03-25 04:28 144784 c:\program files\Java\jre1.6.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 19:49 36352 c:\program files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{94EF9BF6-231C-4B27-B942-9DB68F00B20B}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{30BC7E75-AC1D-4F58-90DF-837E8873D1CA}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe "{312766FB-2843-4637-9A22-E6561F2F236F}"= UDP:c:\users\Dom\AppData\Local\Temp\RarSFX1\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{D59C81EB-092F-4F63-873A-1FF41C5C534B}"= TCP:c:\users\Dom\AppData\Local\Temp\RarSFX1\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{630D427E-1672-441D-8FB2-1F4EA962CA14}"= UDP:c:\users\Dom\AppData\Local\Temp\RarSFX2\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{DEE0F4BD-DD8D-4A74-B120-E7CFF021DF40}"= TCP:c:\users\Dom\AppData\Local\Temp\RarSFX2\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{F52D7C74-3CD8-4CBC-91D2-08F5DD292033}"= UDP:c:\users\Dom\AppData\Local\Temp\RarSFX3\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{D1E037A3-FE29-41FB-A678-BF007BF97322}"= TCP:c:\users\Dom\AppData\Local\Temp\RarSFX3\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{5B03697C-773E-4A8D-838E-9F5FA87CC90E}"= UDP:c:\users\Dom\AppData\Local\Temp\RarSFX4\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{B2191528-A58C-47D4-B9B7-E9FB11AA345A}"= TCP:c:\users\Dom\AppData\Local\Temp\RarSFX4\STHIWv\stInstall.exe:SpeedTouch Home Install Wizard "{FE12D0F1-6AC9-4CE7-BCED-E074E1A0336B}"= UDP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service "{169FEB98-A68D-4E98-97A5-FF011E92D78D}"= TCP:c:\program files\Thomson\ST330\service\st330service.exe:ST330 service "TCP Query User{7D4D77DF-28D3-4E89-98FD-DC9D95E4A0E1}c:\\program files\\steam\\steamapps\\fisq\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\fisq\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{3F79F56D-2DBF-4B03-BF0F-2E0EA87BCCD5}c:\\program files\\steam\\steamapps\\fisq\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\fisq\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{2C8D7456-A4E9-4A28-9D06-4E3F663F9D11}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{9A28137A-A81B-4A18-AA3D-B11CDE45034A}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "TCP Query User{2CF305F5-9119-49C8-A7A0-38DEC13DE82F}c:\\users\\dom\\desktop\\azereus.exe"= UDP:c:\users\dom\desktop\azereus.exe:azereus "UDP Query User{C6EB05E8-D0B4-41D6-8AE5-3C0CCEDAD024}c:\\users\\dom\\desktop\\azereus.exe"= TCP:c:\users\dom\desktop\azereus.exe:azereus "TCP Query User{9FFB30B7-A068-4B2F-B735-8588F36024A1}d:\\azer\\azereus.exe"= UDP:d:\azer\azereus.exe:azereus "UDP Query User{235BF3FA-4EEC-4295-874C-7A64F24B95C4}d:\\azer\\azereus.exe"= TCP:d:\azer\azereus.exe:azereus "{BE6A5F68-824A-40E8-A0D2-FBEB05393703}"= Disabled:UDP:50000:ArcaVir CommunicationPort (A) "{E54CDC02-2523-4FEE-813C-D49A438D1EE7}"= Disabled:UDP:50001:ArcaVir CommunicationPort (S) "{10C9A816-9FA1-4CB8-8C40-58EA51AC821B}"= Disabled:UDP:14380:BitComet 14380 TCP "{0EC7FD63-0F83-4771-AF0D-721E29C3156F}"= Disabled:TCP:14380:BitComet 14380 UDP "TCP Query User{F46D95D1-4C4D-46C7-9449-8CD84306974B}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{5CEC2D62-915C-4ADA-9C00-85E17FFE41F9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{8D679661-18EF-488D-B314-121217B530D4}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "TCP Query User{E2C37AD0-C230-4827-9698-0236D437ECDA}c:\\program files\\bitcomet\\bitcomet.exe"= Disabled:UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{65999302-7D2C-4932-A640-E585D442B836}c:\\program files\\bitcomet\\bitcomet.exe"= Disabled:TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "TCP Query User{66243DE4-1FF9-4104-A807-91BD868C81CA}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{EDC5215B-8D5E-4A33-A221-BB1D999533D2}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{B87023C3-607A-49B3-9953-8FCB28345001}c:\\users\\dom\\downloads\\gback\\azereus.exe"= UDP:c:\users\dom\downloads\gback\azereus.exe:azereus "UDP Query User{A2BD9D84-B504-4115-9588-0303BAB0B5B5}c:\\users\\dom\\downloads\\gback\\azereus.exe"= TCP:c:\users\dom\downloads\gback\azereus.exe:azereus "TCP Query User{2CE8EB3D-D148-47A6-9914-16F4B717D750}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.437\\gback\\azereus.exe"= UDP:c:\users\dom\appdata\local\temp\rar$ex00.437\gback\azereus.exe:azereus "UDP Query User{1ED43A47-BE9F-4688-A3D8-386D9C3E4E3F}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.437\\gback\\azereus.exe"= TCP:c:\users\dom\appdata\local\temp\rar$ex00.437\gback\azereus.exe:azereus "TCP Query User{4A20687B-59ED-4F91-9D5C-90128FA683AE}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.734\\gback\\azereus.exe"= UDP:c:\users\dom\appdata\local\temp\rar$ex00.734\gback\azereus.exe:azereus "UDP Query User{C44954D2-CE9A-43E9-ADF1-498A6022DD07}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.734\\gback\\azereus.exe"= TCP:c:\users\dom\appdata\local\temp\rar$ex00.734\gback\azereus.exe:azereus "TCP Query User{4C28990D-FB8F-428C-A03B-FBF8678848C3}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.484\\gback\\azereus.exe"= UDP:c:\users\dom\appdata\local\temp\rar$ex00.484\gback\azereus.exe:azereus "UDP Query User{7E9EB060-2441-49A0-AA97-0617A9C6A85B}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.484\\gback\\azereus.exe"= TCP:c:\users\dom\appdata\local\temp\rar$ex00.484\gback\azereus.exe:azereus "TCP Query User{D81E1BC7-885C-4F5E-A92B-061EF801F8CC}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.890\\gback\\azereus.exe"= UDP:c:\users\dom\appdata\local\temp\rar$ex00.890\gback\azereus.exe:azereus "UDP Query User{EF8E3885-CFE7-487E-8675-C9B16EF4CFD0}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.890\\gback\\azereus.exe"= TCP:c:\users\dom\appdata\local\temp\rar$ex00.890\gback\azereus.exe:azereus "TCP Query User{5F7D0662-041F-4E12-99F3-C9633A73520F}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.390\\gback\\azereus.exe"= UDP:c:\users\dom\appdata\local\temp\rar$ex00.390\gback\azereus.exe:azereus "UDP Query User{EF0E6F79-ED5C-4A57-ADE8-6FAB0F9DC3D9}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.390\\gback\\azereus.exe"= TCP:c:\users\dom\appdata\local\temp\rar$ex00.390\gback\azereus.exe:azereus "TCP Query User{A992A367-3377-4587-8E24-E368C70396F9}d:\\azer\\gback\\azereus.exe"= UDP:d:\azer\gback\azereus.exe:azereus "UDP Query User{18F52018-184D-4ACE-ABD9-66F59B10D00F}d:\\azer\\gback\\azereus.exe"= TCP:d:\azer\gback\azereus.exe:azereus "TCP Query User{E1D83859-63F2-460E-9B4D-F98C069FA2B3}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.860\\gback\\azereus.exe"= UDP:c:\users\dom\appdata\local\temp\rar$ex00.860\gback\azereus.exe:azereus "UDP Query User{EC13AEA3-12B4-4CCC-B49D-0CECED38CBE0}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.860\\gback\\azereus.exe"= TCP:c:\users\dom\appdata\local\temp\rar$ex00.860\gback\azereus.exe:azereus "TCP Query User{B3FEB3BE-6345-4C00-8C2C-AF8DA1F9148C}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.625\\gback\\azereus.exe"= UDP:c:\users\dom\appdata\local\temp\rar$ex00.625\gback\azereus.exe:azereus "UDP Query User{E16A12DB-6E2C-4C04-B824-B594F2C68497}c:\\users\\dom\\appdata\\local\\temp\\rar$ex00.625\\gback\\azereus.exe"= TCP:c:\users\dom\appdata\local\temp\rar$ex00.625\gback\azereus.exe:azereus "TCP Query User{1AA72925-E9AD-4F99-BDB3-46CE07376CCF}d:\\azer\\gback\\gback\\azereus.exe"= UDP:d:\azer\gback\gback\azereus.exe:azereus "UDP Query User{71A171E5-45F5-430D-9F28-4AE9046B5BA2}d:\\azer\\gback\\gback\\azereus.exe"= TCP:d:\azer\gback\gback\azereus.exe:azereus R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2008-12-17 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-02-07 107272] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-17 903960] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-17 298264] R3 ST330;ST330;c:\windows\System32\drivers\st330.sys [2008-12-17 30464] R3 STBUS;STBUS;c:\windows\System32\drivers\stbus.sys [2008-12-17 12672] R3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\System32\drivers\steth.sys [2008-12-17 40320] S2 ArcaRemoteService;ArcaBit Control;c:\program files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe --> c:\program files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe [?] S2 AVBackup;ArcaBit Backup Service;c:\program files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe --> c:\program files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe [?] S2 AVTasks2;ArcaBit Tasks Service;c:\progra~1\ArcaBit\Common\ARCATA~1.EXE --> c:\progra~1\ArcaBit\Common\ARCATA~1.EXE [?] S3 vmmouse;VMware Pointing Device;c:\windows\System32\drivers\vmmouse.sys [2008-04-16 11696] S3 vmx_svga;vmx_svga;c:\windows\System32\drivers\vmx_svga.sys [2008-04-16 62768] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40a4a29a-d0c0-11dd-a918-806e6f6e6963}] \shell\AutoRun\command - nfdmg.com \shell\explore\Command - nfdmg.com \shell\open\Command - nfdmg.com . Zawartość folderu 'Zaplanowane zadania' 2009-03-10 c:\windows\Tasks\User_Feed_Synchronization-{246AD1E8-2520-4098-AD2D-F27B767CFFE0}.job - c:\windows\system32\msfeedssync.exe [2008-01-18 22:33] . . ------- Skan uzupełniający ------- . uStart Page = about:blank IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta TCP: {8CBA24B3-9835-478F-A2A1-868EC66CF709} = 213.241.79.37 83.238.255.76 FF - ProfilePath - c:\users\Dom\AppData\Roaming\Mozilla\Firefox\Profiles\izn5r2ki.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.livescore.com/ FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPROULETTE.dll FF - plugin: c:\users\Dom\AppData\Roaming\Mozilla\Firefox\Profiles\izn5r2ki.default\extensions\{eaf8a4ef-d221-45ca-9deb-d0934b45fa34}\plugins\npOggX.dll FF - plugin: c:\users\Dom\AppData\Roaming\Mozilla\Firefox\Profiles\izn5r2ki.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll FF - plugin: c:\users\Dom\AppData\Roaming\Mozilla\Firefox\Profiles\izn5r2ki.default\extensions\tcastv1@tom.com\plugins\nptcast40.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-10 12:34:56 Windows 6.0.6001 Service Pack 1 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'Explorer.exe'(3388) c:\program files\Logitech\MouseWare\System\LgWndHk.dll c:\program files\Gadu-Gadu\ggwhook.dll c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll . Czas ukończenia: 2009-03-10 12:37:46 ComboFix-quarantined-files.txt 2009-03-10 11:37:43 Przed: 139 459 215 360 bajtów wolnych Po: 140,207,521,792 bajtów wolnych 196

**Posty:** 18165 · przez **wojtas** 10 Mar 2009, 18:17

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40a4a29a-d0c0-11dd-a918-806e6f6e6963}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 271 · przez **Sythev** 11 Mar 2009, 02:45

mam jeszcze taki problem :

co kilkanascie minut mi się wyświetla i przeszkadza w korzystaniu i graniu..
wychodzi z programu na pulpit ;/

**Posty:** 18165 · przez **wojtas** 11 Mar 2009, 22:51

zadzwon do nich tam moze cos poradza jesli to oryginał.

**Posty:** 271 · przez **Sythev** 12 Mar 2009, 01:42

w tym problem ,że nie jest to org.

**Posty:** 18165 · przez **wojtas** 12 Mar 2009, 16:52

więc CI nie pomożemy w tej kwestii

**Posty:** 271 · przez **Sythev** 12 Mar 2009, 20:01

ktoś mi wspominał,że są pewne łątki na to,żeby to nie wyskakiwało.. to prawda ?

**Posty:** 18165 · przez **wojtas** 12 Mar 2009, 21:58

tego nie wiem poszukaj sam. znajac zycie to cos jest ale tu nie dostaniesz takiego info

**Posty:** 271 · przez **Sythev** 12 Mar 2009, 23:14

witam !

przed chwila miałem dziwną sytuacje..
gdy grałem turniej ping w grze był 20 i nagle ok.300-400 i tak cąły czas..
boje się,że to jakiś trojan..
prosze o sprawdzenie loga :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:13:23, on 2009-03-12 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\AVG\AVG8\avgui.exe C:\Users\Dom\Desktop\Ventrilo.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DllHost.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:pl O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBA24B3-9835-478F-A2A1-868EC66CF709}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: ArcaBit Control (ArcaRemoteService) - Unknown owner - C:\Program Files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe (file missing) O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ArcaBit Backup Service (AVBackup) - Unknown owner - C:\Program Files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe (file missing) O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ArcaBit Tasks Service (AVTasks2) - Unknown owner - C:\PROGRA~1\ArcaBit\Common\ARCATA~1.EXE (file missing) O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing) O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe -- End of file - 4741 bytes

**Posty:** 8001 · przez **Okocza** 13 Mar 2009, 14:40

Sythev, nie ma nic w logu. nie jest to trojan, raczej cos z internetem