Wolne dzialanie komputera

**Posty:** 21 · przez **kadosh** 03 Sie 2008, 19:22

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:22:22, on 2008-08-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: H:\WINDOWS\System32\smss.exe H:\WINDOWS\system32\winlogon.exe H:\WINDOWS\system32\services.exe H:\WINDOWS\system32\lsass.exe H:\WINDOWS\system32\Ati2evxx.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\System32\svchost.exe H:\WINDOWS\system32\Ati2evxx.exe H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe H:\Program Files\Alwil Software\Avast4\ashServ.exe H:\WINDOWS\Explorer.EXE H:\WINDOWS\system32\spoolsv.exe H:\WINDOWS\RTHDCPL.EXE H:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE H:\Program Files\TP-LINK\TWCU\TWCU.exe H:\WINDOWS\system32\acs.exe H:\WINDOWS\system32\ctfmon.exe H:\Program Files\Gadu-Gadu\gg.exe H:\WINDOWS\system32\bgsvcgen.exe H:\Program Files\CDBurnerXP\NMSAccessU.exe H:\WINDOWS\system32\PnkBstrA.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\system32\UAService7.exe H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe H:\Program Files\Alwil Software\Avast4\ashWebSv.exe H:\Program Files\ATI Technologies\ATI.ACE\cli.exe H:\Program Files\ATI Technologies\ATI.ACE\cli.exe H:\Program Files\Mozilla Firefox\firefox.exe H:\WINDOWS\system32\wuauclt.exe H:\WINDOWS\system32\wscntfy.exe H:\WINDOWS\system32\wuauclt.exe I:\mp333\hi\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ATICCC] "H:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [TWCU] "H:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui O4 - HKLM\..\Run: [QuickTime Task] "I:\mp333\uik\QTTask.exe" -atboottime O4 - HKLM\..\Run: [REGSHAVE] H:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "H:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [EPSON Stylus D92 Series] H:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "H:\WINDOWS\TEMP\E_S98.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: ExifLauncher2.lnk = H:\Program Files\FinePixViewer\QuickDCF2.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - I:\mp333\aawservice.exe (file missing) O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - H:\WINDOWS\system32\acs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - H:\WINDOWS\system32\bgsvcgen.exe O23 - Service: NMSAccessU - Unknown owner - H:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - H:\WINDOWS\system32\UAService7.exe -- End of file - 5031 bytes

**Posty:** 7956 · przez **Magik** 03 Sie 2008, 19:30

kadosh

przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

Gdzie opis problemu!!
Dwa, logi wstawiamy w tagi 'code'
Trzy, co to za nazwa tematu???

i wklej log z combofix'a

**Posty:** 21 · przez **kadosh** 03 Sie 2008, 19:44

Kod: Zaznacz wszystko: ComboFix 08-08-02.01 - Remi 2008-08-03 19:36:47.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.558 [GMT 2:00] Running from: H:\Documents and Settings\Remi\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . H:\Documents and Settings\Remi\Dane aplikacji\inst.exe . ((((((((((((((((((((((((( Files Created from 2008-07-03 to 2008-08-03 ))))))))))))))))))))))))))))))) . 2008-07-28 18:08 . 2008-07-28 18:09 <DIR> d-------- H:\Documents and Settings\Remi\Dane aplikacji\BESTplayer 2008-07-26 09:52 . 2008-07-26 09:52 <DIR> d-------- H:\Documents and Settings\NetworkService\Dane aplikacji\Xfire 2008-07-25 21:25 . 2008-07-26 09:42 <DIR> d-------- H:\Program Files\Xfire 2008-07-25 21:25 . 2008-07-30 22:11 <DIR> d-------- H:\Documents and Settings\Remi\Dane aplikacji\Xfire 2008-07-22 02:41 . 2008-07-22 02:41 42,320 --a------ H:\WINDOWS\system32\xfcodec.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-03 12:33 135,168 ----a-w H:\WINDOWS\system32\UAService7.exe 2008-08-02 17:45 --------- d-----w H:\Program Files\Common Files\Wise Installation Wizard 2008-07-29 16:05 --------- d--h--w H:\Program Files\InstallShield Installation Information 2008-07-28 16:01 --------- d-----w H:\Documents and Settings\Remi\Dane aplikacji\Samsung 2008-07-14 16:42 136,888 ----a-w H:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-14 16:42 111,928 ----a-w H:\WINDOWS\system32\PnkBstrB.exe 2008-07-07 06:43 --------- d-----w H:\Program Files\Gadu-Gadu 2008-07-07 06:43 --------- d-----w H:\Documents and Settings\Remi\Dane aplikacji\Azureus 2008-06-20 17:42 246,784 ----a-w H:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w H:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w H:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w H:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-19 20:36 --------- d-----w H:\Program Files\MSXML 4.0 2008-06-18 20:03 --------- d-----w H:\Documents and Settings\Remi\Dane aplikacji\TransRender 2008-06-18 20:03 --------- d-----w H:\Documents and Settings\Remi\Dane aplikacji\Temporary 2008-06-18 20:03 --------- d-----w H:\Documents and Settings\Remi\Dane aplikacji\ConvertTemp 2008-06-17 17:30 --------- d-----w H:\Documents and Settings\Remi\Dane aplikacji\EPSON 2008-06-14 18:01 273,024 ------w H:\WINDOWS\system32\drivers\bthport.sys 2008-06-13 19:48 --------- d-----w H:\Program Files\Astonsoft 2008-06-13 18:11 --------- d--h--r H:\Documents and Settings\Remi\Dane aplikacji\SecuROM 2008-06-13 18:11 --------- d-----w H:\Documents and Settings\Remi\Dane aplikacji\Disney Interactive Studios 2008-06-13 18:10 108,144 ----a-w H:\WINDOWS\system32\CmdLineExt.dll 2008-06-11 19:57 --------- d-----w H:\Documents and Settings\All Users\Dane aplikacji\EPSON 2008-06-11 19:56 --------- d-----w H:\Program Files\EPSON 2008-05-07 05:16 1,291,264 ----a-w H:\WINDOWS\system32\quartz.dll 2007-11-27 20:35 47,360 ----a-w H:\Documents and Settings\Remi\Dane aplikacji\pcouffin.sys 2007-11-17 13:00 22,328 ----a-w H:\Documents and Settings\Remi\Dane aplikacji\PnkBstrK.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="H:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "Gadu-Gadu"="H:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] "MSMSGS"="H:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "EPSON Stylus D92 Series"="H:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE" [2006-09-27 06:00 139264] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="H:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112] "TWCU"="H:\Program Files\TP-LINK\TWCU\TWCU.exe" [2006-03-29 16:12 364544] "QuickTime Task"="I:\mp333\uik\QTTask.exe" [2008-03-28 23:37 413696] "REGSHAVE"="H:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 22:32 53248] "DAEMON Tools"="H:\Program Files\DAEMON Tools\daemon.exe" [2005-11-09 00:00 128920] "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 05:12 16062464 H:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 H:\WINDOWS\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="H:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] H:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ ExifLauncher2.lnk - H:\Program Files\FinePixViewer\QuickDCF2.exe [2008-04-14 20:46:25 303104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "H:\\Program Files\\Gadu-Gadu\\gg.exe"= "H:\\WINDOWS\\system32\\PnkBstrA.exe"= "H:\\WINDOWS\\system32\\PnkBstrB.exe"= "I:\\cod4\\iw3mp.exe"= "I:\\swat\\Content\\System\\Swat4.exe"= "I:\\swat\\Content\\System\\Swat4DedicatedServer.exe"= "I:\\OLEK\\MediaManager.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "23001:TCP"= 23001:TCP:BitComet 23001 TCP "23001:UDP"= 23001:UDP:BitComet 23001 UDP R0 videX32;videX32;H:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38] R0 xfilt;VIA SATA IDE Hot-plug Driver;H:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39] R2 NMSAccessU;NMSAccessU;H:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-03-09 11:20] S3 FXDrv32;FXDrv32;G:\FXDrv32.sys [] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);H:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;H:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;H:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . . ------- Supplementary Scan ------- . FireFox -: Profile - H:\Documents and Settings\Remi\Dane aplikacji\Mozilla\Firefox\Profiles\[u]0[/u]aapnxbd.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/firefox?client=firefox-a&rls=org.mozilla:pl:official ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-03 19:37:55 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... sorrki ale jestem troche zielony w tym [code][quote][/quote][/code] scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-03 19:38:28 ComboFix-quarantined-files.txt 2008-08-03 17:38:26 Pre-Run: 2,722,729,984 bajtów wolnych Post-Run: 2,916,204,544 bajtów wolnych 116 --- E O F --- 2008-07-10 06:47:18

Dodano 03.08.2008 18:45:15:
problem w tym ze komp zwolnil i net tez ,po drugie system sam sie zamyka ostatnio ,no i przegladarka nie uruchamia sie normalnie tylko wyskakuje jakies okienko .

**Posty:** 684 · przez **djarta** 03 Sie 2008, 19:49

Ja nie widzę w logach nic podejrzanego.

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!.

P.S
Jaki zasilacz (marka,moc)?