Wolniejszy komp

**Posty:** 2 · przez **Kamas_LFC** 11 Gru 2008, 00:16

Prosiłbym o sprawdzenie loga. Od niedawna net/komp zaczął mi przymulać. Szukam przyczyny. Przeskanowałem komp Kasperskim virus removal tool, CCleanerem, Spybotem. Znalazłem sporo syfu jednak nie jest to dalej stan jaki jest po formacie (format robiony był ok. 2 miesiące temu). Prosiłbym o pomoc. Pozdrawiam.

HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:05:48, on 2008-12-10 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Avast4\aswUpdSv.exe C:\Program Files\Avast4\ashServ.exe C:\PROGRA~1\Avast4\ashDisp.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\BlueSoleil\BTNtService.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Avast4\ashMaiSv.exe C:\Program Files\Avast4\ashWebSv.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [XPFix] C:\Program Files\GlobespanVirata\XPFix.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\BlueSoleil\BTNtService.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe -- End of file - 4914 bytes

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-12-09.03 - Kamas 2008-12-10 23:00:04.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.198 [GMT 1:00] Uruchomiony z: d:\moje pliki ściągane\Ostatnie\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-10 do 2008-12-10 ))))))))))))))))))))))))))))))) . 2008-12-08 23:57 . 2008-12-08 23:57 <DIR> d-------- c:\windows\ERUNT 2008-12-08 23:57 . 2008-12-08 23:57 <DIR> d-------- C:\ERDNT 2008-12-08 23:55 . 2008-12-08 23:55 <DIR> d-------- C:\!FixIEDef 2008-12-08 23:53 . 2008-07-08 13:54 148,496 --a------ c:\windows\system32\drivers\57953288.sys 2008-12-08 23:53 . 2008-12-10 18:52 24,608 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-12-08 23:53 . 2008-12-10 18:52 1,268 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-12-08 23:49 . 2008-12-08 23:49 <DIR> d-------- c:\program files\Trend Micro 2008-11-15 11:14 . 2008-11-15 11:14 <DIR> d-------- c:\documents and settings\All Users\Pulpit 2008-11-12 21:28 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 21:27 . 2008-09-04 18:17 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll 2008-11-11 13:04 . 2008-11-11 13:04 <DIR> d-------- c:\windows\SxsCaPendDel . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-10 21:17 4,000 ----a-w C:\ao.dat 2008-11-02 16:51 --------- d-----w c:\documents and settings\Kamas\Dane aplikacji\Sports Interactive 2008-11-02 16:51 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sports Interactive 2008-10-30 00:27 --------- d-----w c:\program files\Deluxe Ski Jump 3 2008-10-29 13:29 --------- d-----w c:\program files\Microsoft Works 2008-10-29 13:27 --------- d-----w c:\program files\Microsoft.NET 2008-10-27 08:10 --------- d-----w c:\program files\Borland 2008-10-27 07:54 --------- d-----w c:\program files\Mikromap 2008-10-27 07:46 --------- d-----w c:\program files\WinKalk 2008-10-27 07:38 --------- d-----w c:\program files\Autodesk 2008-10-27 07:37 54,784 ----a-w c:\windows\system32\drivers\CDAC11BA.EXE 2008-10-27 07:37 12,464 ----a-w c:\windows\system32\drivers\CDAC15BA.SYS 2008-10-27 07:37 --------- d-----w c:\program files\Common Files\Macrovision Shared 2008-10-27 07:37 --------- d-----w c:\program files\AnswerWorks 4.0 2008-10-27 07:36 --------- d-----w c:\program files\Common Files\Autodesk Shared 2008-10-27 07:36 --------- d-----w c:\program files\AutoCAD 2004 2008-10-27 07:36 --------- d-----w c:\documents and settings\Kamas\Dane aplikacji\Autodesk 2008-10-27 07:36 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Autodesk 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-17 09:48 --------- d-----w c:\documents and settings\Kamas\Dane aplikacji\OpenOffice.org 2008-10-17 09:45 --------- d-----w c:\program files\OpenOffice.org 3 2008-10-16 15:40 --------- d-----w c:\documents and settings\Kamas\Dane aplikacji\Windows Search 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-15 19:50 --------- d-----w c:\program files\SAGEM 2008-10-15 17:36 337,408 ------w c:\windows\system32\dllcache\netapi32.dll 2008-10-11 19:42 --------- d-----w c:\program files\SopCast 2008-10-07 15:39 71,285 ----a-w c:\windows\BricoPackUninst.cmd 2008-10-07 15:39 5,464 ----a-w c:\windows\BricoPackFoldersDelete.cmd 2008-10-07 15:39 219,648 ----a-w c:\windows\system32\uxtheme.dll 2008-09-15 16:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-15 16:27 1,846,656 ------w c:\windows\system32\dllcache\win32k.sys 2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-09-10 01:15 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\Avast4\ashDisp.exe" [2008-11-26 81000] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-07-02 118784] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-07-02 155648] "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-04-29 184320] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-07-24 684032] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-07-24 102400] "XPFix"="c:\program files\GlobespanVirata\XPFix.exe" [2004-07-23 217188] "AGRSMMSG"="AGRSMMSG.exe" [2004-02-21 c:\windows\AGRSMMSG.exe] "SoundMan"="SOUNDMAN.EXE" [2004-12-22 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\BlueSoleil\\BlueSoleil.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "d:\\Gierki\\FM09demo\\fm.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-07 111184] R1 is-L5MMGdrv;is-L5MMGdrv;c:\windows\system32\DRIVERS\57953288.sys [2008-12-08 148496] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-10-07 20560] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-07 33752] S3 PRISM_A00;PRISM 802.11 Driver;c:\windows\system32\DRIVERS\PRISMA00.sys [2008-10-07 393280] *Newly Created Service* - PROCEXP90 . . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FireFox -: Profile - c:\documents and settings\Kamas\Dane aplikacji\Mozilla\Firefox\Profiles\caycwpv2.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.gazeta.pl/ FF -: plugin - c:\documents and settings\Kamas\Dane aplikacji\Mozilla\Firefox\Profiles\caycwpv2.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\plugins\np_gp.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-10 23:02:30 Windows 5.1.2600 Dodatek Service Pack 3 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(592) c:\windows\system32\scecli.dll . Czas ukończenia: 2008-12-10 23:04:01 ComboFix-quarantined-files.txt 2008-12-10 22:03:58 Przed: 2,480,775,168 bajtów wolnych Po: 2,469,945,344 bajtów wolnych 133 --- E O F --- 2008-11-13 00:20:42

**Posty:** 18165 · przez **wojtas** 11 Gru 2008, 21:49

te plik/i :

c:\windows\system32\scecli.dll
c:\windows\system32\DRIVERS\57953288.sys

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 2 · przez **Kamas_LFC** 12 Gru 2008, 10:23

Skan z http://virusscan.jotti.org/:

c:\windows\system32\scecli.dll:

Kod: Zaznacz wszystko: Scanner results Scan taken on 12 Dec 2008 08:01:00 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

c:\windows\system32\DRIVERS\57953288.sys

Kod: Zaznacz wszystko: Scanner results Scan taken on 12 Dec 2008 08:05:34 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

Skan z http://www.virustotal.com/ :

c:\windows\system32\scecli.dll:

Kod: Zaznacz wszystko: Plik scecli.dll otrzymany 2008.12.12 09:11:05 (CET) Obecny status: Ładowanie ... w kolejce oczekuje skanowanie zakończono NIE ZNALEZIONO ZATRZYMANE Wynik: 0/38 (0%) Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.12.0 2008.12.12 - AntiVir 7.9.0.45 2008.12.11 - Authentium 5.1.0.4 2008.12.11 - Avast 4.8.1281.0 2008.12.11 - AVG 8.0.0.199 2008.12.12 - BitDefender 7.2 2008.12.12 - CAT-QuickHeal 10.00 2008.12.11 - ClamAV 0.94.1 2008.12.12 - Comodo 733 2008.12.11 - DrWeb 4.44.0.09170 2008.12.12 - eSafe 7.0.17.0 2008.12.11 - eTrust-Vet 31.6.6257 2008.12.12 - Ewido 4.0 2008.12.11 - F-Prot 4.4.4.56 2008.12.11 - F-Secure 8.0.14332.0 2008.12.12 - Fortinet 3.117.0.0 2008.12.12 - GData 19 2008.12.12 - Ikarus T3.1.1.45.0 2008.12.12 - K7AntiVirus 7.10.551 2008.12.11 - Kaspersky 7.0.0.125 2008.12.12 - McAfee 5461 2008.12.11 - McAfee+Artemis 5461 2008.12.11 - Microsoft 1.4205 2008.12.12 - NOD32 3685 2008.12.12 - Norman 5.80.02 2008.12.11 - Panda 9.0.0.4 2008.12.11 - PCTools 4.4.2.0 2008.12.11 - Prevx1 V2 2008.12.12 - Rising 21.07.41.00 2008.12.12 - SecureWeb-Gateway 6.7.6 2008.12.11 - Sophos 4.36.0 2008.12.12 - Sunbelt 3.2.1801.2 2008.12.11 - Symantec 10 2008.12.12 - TheHacker 6.3.1.2.184 2008.12.11 - TrendMicro 8.700.0.1004 2008.12.12 - VBA32 3.12.8.10 2008.12.11 - ViRobot 2008.12.12.1514 2008.12.12 - VirusBuster 4.5.11.0 2008.12.11 - Dodatkowe informacje File size: 186368 bytes MD5...: 3f74b6b4e2721272a117d25990141f73 SHA1..: 5039910584149512e55bef06189cc672afa0b4c8 SHA256: 8f20684eb631e324d0d17b72479164df8820ea61905aed4857d8f8f0882af1e2 SHA512: 563851cfe38365243e102d7dbc46cba482cc40bc1ce1d189fc79a48343b02795 28ad91df18f4d6482f57a9b51bcaf8bef072394f154472ad86b16377c243e7c7 ssdeep: 3072:iq7JkJZuI5634ij9m8QqiqB1YHjKxojBgI8EbY5RS/BpiUam8nS:iqWhZiI 8DB1QAoCa/ziev PEiD..: - TrID..: File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x7d5113a0 timedatestamp.....: 0x48039213 (Mon Apr 14 17:19:15 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x24aa3 0x24c00 6.32 b05df6e4fcd9993ae8d5a9e9be89b482 .data 0x26000 0x1004 0x800 3.18 5c6cfb7950fa44b09bfce634d5391547 .rsrc 0x28000 0x6144 0x6200 3.70 6091af139e28f38aac4c10e204301e9d .reloc 0x2f000 0x1c04 0x1e00 6.60 c59f32ba39347a6c464fb77f1c1feb80 ( 11 imports ) > ADVAPI32.dll: LsaSetDomainInformationPolicy, ImpersonateLoggedOnUser, RevertToSelf, GetNamedSecurityInfoW, SetNamedSecurityInfoW, GetSecurityDescriptorDacl, AllocateAndInitializeSid, LsaRemoveAccountRights, RegDeleteKeyW, ConvertStringSidToSidW, LsaLookupSids, OpenSCManagerW, EnumServicesStatusW, LsaClose, FreeSid, LsaOpenPolicy, LsaLookupNames2, LsaQueryInformationPolicy, LsaQueryDomainInformationPolicy, LsaFreeMemory, OpenServiceW, QueryServiceConfigW, QueryServiceObjectSecurity, CloseServiceHandle, RegOpenCurrentUser, ReportEventW, DeregisterEventSource, RegisterEventSourceW, OpenThreadToken, OpenProcessToken, DuplicateToken, CheckTokenMembership, EqualSid, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegQueryValueExW, RegCloseKey, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSecurityDescriptorToStringSecurityDescriptorW, RegEnumKeyExW > KERNEL32.dll: lstrcmpiW, lstrcpyW, lstrcatW, FormatMessageW, LoadLibraryW, GetProcAddress, FreeLibrary, GetEnvironmentStringsW, GetPrivateProfileStringW, Sleep, GetModuleHandleW, ReadFile, WideCharToMultiByte, WritePrivateProfileSectionW, WritePrivateProfileStringW, GetEnvironmentVariableW, GetTickCount, DeleteFileW, CopyFileW, GetFileAttributesW, GetPrivateProfileIntW, lstrlenW, CompareStringW, CreateFileW, LocalReAlloc, GetVolumeInformationW, GetDriveTypeW, GetFileSize, SetFileAttributesW, ExitThread, FreeLibraryAndExitThread, CreateThread, LeaveCriticalSection, WaitForSingleObject, EnterCriticalSection, GetCurrentThreadId, QueueUserWorkItem, InitializeCriticalSection, DeleteCriticalSection, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetCurrentProcessId, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, LocalFree, GetLastError, LoadLibraryExA, CloseHandle, GetCurrentProcess, GetCurrentThread, WriteFile, GetTimeFormatW, GetDateFormatW, FileTimeToSystemTime, CreateDirectoryW, GetSystemWindowsDirectoryW, GetComputerNameExW, GetComputerNameW, GetSystemDirectoryW, ExpandEnvironmentStringsW, SetLastError, GetPrivateProfileSectionW, LocalAlloc, SetFilePointer > msvcrt.dll: wcsncmp, _wcsupr, wcsncat, wcschr, wcscat, swprintf, _vsnwprintf, wcsstr, _except_handler3, _resetstkoflw, wcscpy, _wcsnicmp, wcsncpy, wcslen, _wcsicmp, _wfindfirst, fclose, _wfopen, _adjust_fdiv, malloc, _initterm, free, __2@YAPAXI@Z, __3@YAXPAX@Z, __CxxFrameHandler, _wtol, _itow, _wfindnext, towlower, _findclose, memmove > NETAPI32.dll: NetLocalGroupAddMembers > ntdll.dll: RtlNtStatusToDosError, RtlGetControlSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlGetOwnerSecurityDescriptor, RtlGetSaclSecurityDescriptor, RtlGetDaclSecurityDescriptor, RtlFreeSid, RtlAllocateAndInitializeSid, RtlMapGenericMask, RtlGetAce, NtAdjustPrivilegesToken, RtlTimeToTimeFields, RtlSystemTimeToLocalTime, NtQuerySystemTime, RtlCopySid, RtlLengthSid, RtlSubAuthoritySid, RtlSubAuthorityCountSid, RtlIdentifierAuthoritySid, NtQueryInformationToken, RtlGetNtProductType, RtlLengthRequiredSid, RtlFreeUnicodeString, RtlConvertSidToUnicodeString, RtlInitUnicodeString, RtlValidSid, RtlTimeToSecondsSince1980, NtQueryObject, RtlLengthSecurityDescriptor, RtlMakeSelfRelativeSD, RtlRandomEx, RtlImageNtHeader, RtlFreeHeap, RtlAllocateHeap, RtlEqualSid > ole32.dll: CoCreateGuid, CoInitialize, CoCreateInstance, CoMarshalInterThreadInterfaceInStream, CoInitializeEx, CoGetInterfaceAndReleaseStream, CoUninitialize > OLEAUT32.dll: -, -, -, -, -, - > RPCRT4.dll: RpcBindingSetAuthInfoW, I_RpcExceptionFilter, RpcBindingFree, NdrClientCall2, RpcStringFreeW, RpcBindingFromStringBindingW, RpcStringBindingComposeW, NdrServerCall2 > SETUPAPI.dll: SetupFindNextLine, SetupGetFieldCount, SetupGetStringFieldW, SetupFindFirstLineW, SetupGetLineCountW, SetupOpenInfFileW, SetupCloseInfFile, SetupGetIntField, SetupGetMultiSzFieldW > USER32.dll: wsprintfW, LoadStringW > USERENV.dll: ProcessGroupPolicyCompletedEx ( 72 exports ) DeltaNotify, DllRegisterServer, DllUnregisterServer, InitializeChangeNotify, SceAddToNameList, SceAddToNameStatusList, SceAddToObjectList, SceAnalyzeSystem, SceAppendSecurityProfileInfo, SceBrowseDatabaseTable, SceCloseProfile, SceCommitTransaction, SceCompareNameList, SceCompareSecurityDescriptors, SceConfigureConvertedFileSecurity, SceConfigureSystem, SceCopyBaseProfile, SceCreateDirectory, SceDcPromoCreateGPOsInSysvol, SceDcPromoCreateGPOsInSysvolEx, SceDcPromoteSecurity, SceDcPromoteSecurityEx, SceEnforceSecurityPolicyPropagation, SceEnumerateServices, SceFreeMemory, SceFreeProfileMemory, SceGenerateGroupPolicy, SceGenerateRollback, SceGetAnalysisAreaSummary, SceGetAreas, SceGetDatabaseSetting, SceGetDbTime, SceGetObjectChildren, SceGetObjectSecurity, SceGetScpProfileDescription, SceGetSecurityProfileInfo, SceGetServerProductType, SceGetTimeStamp, SceIsSystemDatabase, SceLookupPrivRightName, SceNotifyPolicyDelta, SceOpenPolicy, SceOpenProfile, SceProcessEFSRecoveryGPO, SceProcessSecurityPolicyGPO, SceProcessSecurityPolicyGPOEx, SceRegisterRegValues, SceRollbackTransaction, SceSetDatabaseSetting, SceSetupBackupSecurity, SceSetupConfigureServices, SceSetupGenerateTemplate, SceSetupMoveSecurityFile, SceSetupRootSecurity, SceSetupSystemByInfName, SceSetupUnwindSecurityFile, SceSetupUpdateSecurityFile, SceSetupUpdateSecurityKey, SceSetupUpdateSecurityService, SceStartTransaction, SceSvcConvertSDToText, SceSvcConvertTextToSD, SceSvcFree, SceSvcGetInformationTemplate, SceSvcQueryInfo, SceSvcSetInfo, SceSvcSetInformationTemplate, SceSvcUpdateInfo, SceSysPrep, SceUpdateObjectInfo, SceUpdateSecurityProfile, SceWriteSecurityProfileInfo

c:\windows\system32\DRIVERS\57953288.sys

Kod: Zaznacz wszystko: Plik 39230840.sys otrzymany 2008.12.11 17:55:57 (CET) Obecny status: zakończono Wynik: 0/38 (0.00%) Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.12.0 2008.12.11 - AntiVir 7.9.0.43 2008.12.11 - Authentium 5.1.0.4 2008.12.11 - Avast 4.8.1281.0 2008.12.10 - AVG 8.0.0.199 2008.12.11 - BitDefender 7.2 2008.12.11 - CAT-QuickHeal 10.00 2008.12.11 - ClamAV 0.94.1 2008.12.11 - Comodo 733 2008.12.11 - DrWeb 4.44.0.09170 2008.12.11 - eSafe 7.0.17.0 2008.12.11 - eTrust-Vet 31.6.6256 2008.12.11 - Ewido 4.0 2008.12.11 - F-Prot 4.4.4.56 2008.12.10 - F-Secure 8.0.14332.0 2008.12.11 - Fortinet 3.117.0.0 2008.12.11 - GData 19 2008.12.11 - Ikarus T3.1.1.45.0 2008.12.11 - K7AntiVirus 7.10.551 2008.12.11 - Kaspersky 7.0.0.125 2008.12.11 - McAfee 5460 2008.12.10 - McAfee+Artemis 5460 2008.12.10 - Microsoft 1.4205 2008.12.10 - NOD32 3683 2008.12.11 - Norman 5.80.02 2008.12.11 - Panda 9.0.0.4 2008.12.10 - PCTools 4.4.2.0 2008.12.11 - Prevx1 V2 2008.12.11 - Rising 21.07.32.00 2008.12.11 - SecureWeb-Gateway 6.7.6 2008.12.11 - Sophos 4.36.0 2008.12.11 - Sunbelt 3.2.1801.2 2008.12.11 - Symantec 10 2008.12.11 - TheHacker 6.3.1.2.183 2008.12.11 - TrendMicro 8.700.0.1004 2008.12.11 - VBA32 3.12.8.10 2008.12.11 - ViRobot 2008.12.11.1513 2008.12.11 - VirusBuster 4.5.11.0 2008.12.11 - Dodatkowe informacje File size: 148496 bytes MD5...: 0aa3ad071827118fcc8f37f7a6ab7aa1 SHA1..: 59784c49ffe530931010070c8843366f9d7fa6f0 SHA256: 3e893bcf9e3ec8fa44c8ef0cf7c2d269212651d65c16b30bd953cc3a54f3b2aa SHA512: b56442c4271033f9547727ac097fc903f0bd51c062f415726aeee3e6abde24e1 ec127cb548086d5429ff4dc4e78c322b2594bb4f29f817338299f6c9c23bbc25 ssdeep: 3072:xoZsjyhxlNCet3MATPO1jUFLVFnRkPjcow9gT7wNwSk7Fa/4NJ:xnjyhx8A d6jcpgTsW/KqJ PEiD..: - TrID..: File type identification Win32 Executable Generic (68.0%) Generic Win/DOS Executable (15.9%) DOS Executable Generic (15.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x33010 timedatestamp.....: 0x4873470a (Tue Jul 08 10:52:58 2008) machinetype.......: 0x14c (I386) ( 8 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x1a848 0x1aa00 6.38 ca8bbffb8c1aac75560de3ffede16f38 NONPAGED 0x1c000 0x25 0x200 0.30 76fbfaa1c4997eccce3ca016c3b1345b .rdata 0x1d000 0x850 0xa00 4.25 6ffc26ac817e2ae1a1cf5ce42adc9f0b .data 0x1e000 0x1b00 0x600 6.42 2680643c152bf562cae4ab5d1ed2070c PAGE 0x20000 0x2cdc 0x2e00 6.28 7516763c152ec5b6c5df87c555fadbb5 INIT 0x23000 0x1b88 0x1c00 5.96 4459dca4b85a564cb98f26cfbff36fbe .rsrc 0x25000 0x400 0x400 3.36 09f200edb8e02e6fa4ab2f6bc27ad921 .reloc 0x26000 0x1b6e 0x1c00 6.47 5d73a4e2a3be56c2448dbd9511deefa3 ( 3 imports ) > ntoskrnl.exe: IoAllocateWorkItem, RtlDeleteElementGenericTableAvl, RtlGetElementGenericTableAvl, FsRtlIsNameInExpression, RtlInsertElementGenericTableAvl, InitSafeBootMode, InterlockedPopEntrySList, InterlockedPushEntrySList, ExInitializeNPagedLookasideList, ExDeleteNPagedLookasideList, SeTokenType, SeCreateClientSecurity, SeImpersonateClientEx, IoVerifyVolume, IoDeviceObjectType, IoBuildSynchronousFsdRequest, IoDeleteDevice, IoDeleteSymbolicLink, IoUnregisterShutdownNotification, MmIsAddressValid, IoFreeMdl, MmUnlockPages, MmProbeAndLockPages, IoAllocateMdl, IoRegisterShutdownNotification, IoCreateSymbolicLink, IoCreateDevice, RtlAppendUnicodeToString, KeDelayExecutionThread, KeQuerySystemTime, strncmp, IoGetCurrentProcess, ExGetPreviousMode, SeReleaseSubjectContext, IoQueueWorkItem, SeCaptureSubjectContext, PsDereferenceImpersonationToken, RtlCopySid, RtlLengthSid, SeQueryInformationToken, PsReferencePrimaryToken, PsReferenceImpersonationToken, PsIsThreadTerminating, IoThreadToProcess, RtlInitializeGenericTableAvl, READ_REGISTER_UCHAR, ProbeForRead, RtlLookupElementGenericTableAvl, ObQueryNameString, CmUnRegisterCallback, MmUserProbeAddress, CmRegisterCallback, ZwEnumerateValueKey, ZwDeleteValueKey, ZwQueryKey, wcsrchr, NtBuildNumber, KeClearEvent, ExInitializePagedLookasideList, ExDeletePagedLookasideList, PsLookupProcessByProcessId, RtlCopyUnicodeString, RtlNumberGenericTableElementsAvl, RtlEnumerateGenericTableAvl, PsSetLoadImageNotifyRoutine, PsSetCreateThreadNotifyRoutine, PsSetCreateProcessNotifyRoutine, PsRemoveCreateThreadNotifyRoutine, PsRemoveLoadImageNotifyRoutine, IoFreeWorkItem, IofCompleteRequest, IoWMIRegistrationControl, MmGetSystemRoutineAddress, RtlCompareMemory, IoWMIWriteEvent, ZwQueryInformationProcess, KeStackAttachProcess, _wcsicmp, KeUnstackDetachProcess, ZwOpenKey, ZwEnumerateKey, RtlUnicodeStringToInteger, ZwQueryValueKey, ZwCreateKey, RtlIntegerToUnicodeString, ZwSetValueKey, RtlAppendUnicodeStringToString, ZwDeleteKey, DbgBreakPoint, ZwCreateFile, IoGetRelatedDeviceObject, _vsnwprintf, KeQueryInterruptTime, strncpy, RtlInitUnicodeString, RtlCompareUnicodeString, IoFileObjectType, ObReferenceObjectByPointer, _allmul, KeWaitForMultipleObjects, KeSetEvent, ExDeleteResourceLite, ExInitializeResourceLite, memcpy, _except_handler3, ZwOpenProcess, ZwTerminateProcess, PsCreateSystemThread, ObReferenceObjectByHandle, ZwClose, PsTerminateSystemThread, ObfDereferenceObject, KeGetCurrentThread, PsGetCurrentProcessId, PsGetCurrentThreadId, RtlUpcaseUnicodeChar, RtlUpperChar, memset, ExAllocatePoolWithTag, KeInitializeEvent, IoBuildDeviceIoControlRequest, IofCallDriver, KeWaitForSingleObject, SeQueryAuthenticationIdToken, ExFreePoolWithTag > HAL.dll: KfReleaseSpinLock, KeGetCurrentIrql, ExAcquireFastMutex, ExReleaseFastMutex, KfAcquireSpinLock > FLTMGR.SYS: FltQueryInformationFile, FltGetRoutineAddress, FltIsDirectory, FltGetFileNameInformation, FltParseFileNameInformation, FltAllocateCallbackData, FltPerformSynchronousIo, FltFreeCallbackData, FltReferenceFileNameInformation, FltReleaseFileNameInformation, FltGetStreamHandleContext, FltGetStreamContext, FltEnumerateVolumeInformation, FltRegisterFilter, FltStartFiltering, FltSetCallbackDataDirty, FltGetDestinationFileNameInformation, FltSetStreamHandleContext, FltCancelFileOpen, FltSetStreamContext, FltReleaseContext, FltGetVolumeProperties, FltAllocateContext, FltQueryVolumeInformation, FltGetVolumeName, FltSetInstanceContext, FltSetVolumeContext, FltUnregisterFilter, FltFsControlFile, FltGetVolumeFromFileObject, FltGetVolumeContext, FltGetInstanceContext, FltCreateFile, FltClose, FltFlushBuffers, FltSetInformationFile, FltWriteFile, FltBuildDefaultSecurityDescriptor, FltCreateCommunicationPort, FltFreeSecurityDescriptor, FltObjectReference, FltAllocatePoolAlignedWithTag, FltReadFile, FltFreePoolAlignedWithTag, FltObjectDereference, FltSendMessage, FltCloseClientPort, FltCloseCommunicationPort, FltReleaseResource, FltAcquireResourceShared, FltAcquireResourceExclusive, FltGetFileNameInformationUnsafe ( 0 exports )

**Posty:** 18165 · przez **wojtas** 12 Gru 2008, 17:21

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Wolniejszy komp

Wolniejszy komp

Wolniejszy komp

Re: wolniejszy komp

Wolniejszy komp

Kto jest na forum