Zawieszajacy sie komputer/zwolniony

**Posty:** 1451 · przez **eisu** 08 Sie 2008, 14:09

Witam tak jak w temacie komputer zawiesza sie srednio co 10 min przy tym jest troszke zwolniony. wklejam logi>

Kod: Zaznacz wszystko: ComboFix 08-08-07.05 - tomek 2008-08-08 12:57:33.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1589 [GMT 2:00] Running from: C:\Documents and Settings\tomek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-08 to 2008-08-08 ))))))))))))))))))))))))))))))) . 2008-08-08 12:43 . 2008-08-08 12:53 <DIR> d-------- C:\Program Files\SkanerOnline 2008-08-08 12:30 . 2008-08-08 12:30 65,536 --ah----- C:\WINDOWS\MEMORY.DMP 2008-08-06 14:23 . 2008-08-06 14:23 <DIR> d-------- C:\Program Files\FDRLab 2008-08-06 11:24 . 2008-08-06 11:27 <DIR> d-------- C:\Program Files\YouTube Video Downloader 2008-07-29 13:19 . 2008-07-29 13:19 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-07-29 13:19 . 2008-07-29 13:19 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-07-29 13:18 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-07-29 13:15 . 2008-07-29 13:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-07-29 13:15 . 2008-07-29 13:15 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-07-29 13:15 . 2008-07-29 13:15 21,672 --a------ C:\WINDOWS\system32\drivers\ggsemc.sys 2008-07-29 13:15 . 2008-07-29 13:15 13,352 --a------ C:\WINDOWS\system32\drivers\ggflt.sys 2008-07-29 13:13 . 2008-07-29 13:13 <DIR> d-------- C:\Program Files\Sony Ericsson 2008-07-15 03:13 . 2008-07-18 01:14 <DIR> d-------- C:\Program Files\eMule 2008-07-14 00:50 . 2008-07-14 00:50 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-07-14 00:50 . 2008-08-06 15:36 <DIR> d-------- C:\Documents and Settings\tomek\Dane aplikacji\Nowe Gadu-Gadu 2008-07-13 22:26 . 2008-07-13 22:26 <DIR> d-------- C:\Program Files\WapSter 2008-07-13 22:26 . 2008-07-13 22:26 <DIR> d-------- C:\Documents and Settings\tomek\WapSter . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-08 10:51 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\DNA 2008-08-05 10:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\stamina 2008-07-20 23:34 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\BitTorrent 2008-07-05 22:09 --------- d-----w C:\Program Files\MyPortal 2008-07-01 19:36 --------- d-----w C:\Program Files\Stardock 2008-07-01 19:35 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE 2008-07-01 18:28 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys 2008-07-01 18:28 --------- d-----w C:\Program Files\Common Files\Stardock 2008-07-01 16:59 --------- d-----w C:\Program Files\Dziobas Rar Player 2008-07-01 15:19 --------- d-----w C:\Program Files\Winamp 2008-07-01 14:18 --------- d-----w C:\Program Files\Common Files\AOL 2008-07-01 14:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AOL 2008-06-30 20:05 --------- d-----w C:\Program Files\Total Video Converter 2008-06-30 17:58 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-06-30 17:39 --------- d-----w C:\Program Files\THQ 2008-06-30 17:28 --------- d-----w C:\Program Files\7-Zip 2008-06-30 15:34 --------- d-----w C:\Program Files\AdVantage 2008-06-22 17:20 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-22 17:20 --------- d-----w C:\Program Files\REALTEK RTL8187B Wireless LAN Driver 2008-06-22 17:20 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\InstallShield 2008-06-21 20:50 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-06-18 17:45 --------- d-----w C:\Program Files\DNA 2008-06-18 17:45 --------- d-----w C:\Program Files\BitTorrent 2008-06-18 17:43 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2008-06-12 20:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads 2008-06-09 18:07 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\Media Player Classic 2008-05-24 08:55 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-05-24 08:55 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2008-05-24 08:55 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-24 08:55 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll . ------- Sigcheck ------- 2007-07-10 15:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll 2007-07-14 00:56 814592 ce7193c5f7c01b19768e066087c1c919 C:\WINDOWS\system32\wininet.dll 2007-10-16 01:19 360576 0fb6743e937c7bb248b2530a5a77abc6 C:\WINDOWS\system32\drivers\tcpip.sys 2007-10-19 00:19 2145280 6c264e21d3bd7082b43fc016d760c1d1 C:\WINDOWS\system32\ntoskrnl.exe 2007-10-17 21:30 974848 16df8a100e8966e48ba00c86f6c89972 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 14:54 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 14:54 1555480 --a------ C:\Program Files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 14:54 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 14:54 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:44 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-11-05 11:12 884176] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 18:46 217544] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-18 19:45 289088] "Nowe Gadu-Gadu"="C:\Program Files\Nowe Gadu-Gadu\gg.exe" [2008-06-27 10:28 8798816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-03-17 08:05 135168] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-03-17 08:05 159744] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-03-17 08:05 131072] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 16:21 270336] "RTHDCPL"="RTHDCPL.EXE" [2007-10-17 20:20 16844800 C:\WINDOWS\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:44 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\GlobalSCAPE\\CuteFTP 8 Home\\ftpte.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"= "C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"= "C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"= R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-12-13 12:22] S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-07-29 13:15] S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 03:08] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:03:35, on 2008-08-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20627) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1098640 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?AuthParam=1212516068_8f5f920afd0effb52fffc1ea79b3dcc4&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab&File=jinstall-6u6-windows-i586-jc.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 6248 bytes

**Posty:** 684 · przez **djarta** 08 Sie 2008, 14:21

1)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1098640
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: Folder:: C:\Program Files\AdVantage C:\Program Files\free-downloads.net Registry:: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"=- [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AdVantage"=-

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

**Posty:** 1451 · przez **eisu** 08 Sie 2008, 14:48

Kod: Zaznacz wszystko: ComboFix 08-08-07.05 - tomek 2008-08-08 13:42:32.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1592 [GMT 2:00] Running from: C:\Documents and Settings\tomek\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-07-08 to 2008-08-08 ))))))))))))))))))))))))))))))) . 2008-08-08 13:03 . 2008-08-08 13:03 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-08 12:43 . 2008-08-08 12:53 <DIR> d-------- C:\Program Files\SkanerOnline 2008-08-08 12:30 . 2008-08-08 12:30 65,536 --ah----- C:\WINDOWS\MEMORY.DMP 2008-08-06 14:23 . 2008-08-06 14:23 <DIR> d-------- C:\Program Files\FDRLab 2008-08-06 11:24 . 2008-08-06 11:27 <DIR> d-------- C:\Program Files\YouTube Video Downloader 2008-07-29 13:19 . 2008-07-29 13:19 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-07-29 13:19 . 2008-07-29 13:19 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-07-29 13:18 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-07-29 13:15 . 2008-07-29 13:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-07-29 13:15 . 2008-07-29 13:15 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-07-29 13:15 . 2008-07-29 13:15 21,672 --a------ C:\WINDOWS\system32\drivers\ggsemc.sys 2008-07-29 13:15 . 2008-07-29 13:15 13,352 --a------ C:\WINDOWS\system32\drivers\ggflt.sys 2008-07-29 13:13 . 2008-07-29 13:13 <DIR> d-------- C:\Program Files\Sony Ericsson 2008-07-15 03:13 . 2008-07-18 01:14 <DIR> d-------- C:\Program Files\eMule 2008-07-14 00:50 . 2008-07-14 00:50 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-07-14 00:50 . 2008-08-06 15:36 <DIR> d-------- C:\Documents and Settings\tomek\Dane aplikacji\Nowe Gadu-Gadu 2008-07-13 22:26 . 2008-07-13 22:26 <DIR> d-------- C:\Program Files\WapSter 2008-07-13 22:26 . 2008-07-13 22:26 <DIR> d-------- C:\Documents and Settings\tomek\WapSter . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-08 11:41 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\DNA 2008-08-05 10:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\stamina 2008-07-20 23:34 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\BitTorrent 2008-07-05 22:09 --------- d-----w C:\Program Files\MyPortal 2008-07-01 19:36 --------- d-----w C:\Program Files\Stardock 2008-07-01 19:35 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE 2008-07-01 18:28 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys 2008-07-01 18:28 --------- d-----w C:\Program Files\Common Files\Stardock 2008-07-01 16:59 --------- d-----w C:\Program Files\Dziobas Rar Player 2008-07-01 15:19 --------- d-----w C:\Program Files\Winamp 2008-07-01 14:18 --------- d-----w C:\Program Files\Common Files\AOL 2008-07-01 14:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AOL 2008-06-30 20:05 --------- d-----w C:\Program Files\Total Video Converter 2008-06-30 17:58 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-06-30 17:39 --------- d-----w C:\Program Files\THQ 2008-06-30 17:28 --------- d-----w C:\Program Files\7-Zip 2008-06-30 15:34 --------- d-----w C:\Program Files\AdVantage 2008-06-22 17:20 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-22 17:20 --------- d-----w C:\Program Files\REALTEK RTL8187B Wireless LAN Driver 2008-06-22 17:20 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\InstallShield 2008-06-21 20:50 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-06-18 17:45 --------- d-----w C:\Program Files\DNA 2008-06-18 17:45 --------- d-----w C:\Program Files\BitTorrent 2008-06-18 17:43 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2008-06-12 20:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads 2008-06-09 18:07 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\Media Player Classic 2008-05-24 08:55 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-05-24 08:55 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2008-05-24 08:55 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-05-24 08:55 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll . ------- Sigcheck ------- 2007-07-10 15:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll 2007-07-14 00:56 814592 ce7193c5f7c01b19768e066087c1c919 C:\WINDOWS\system32\wininet.dll 2007-10-16 01:19 360576 0fb6743e937c7bb248b2530a5a77abc6 C:\WINDOWS\system32\drivers\tcpip.sys 2007-10-19 00:19 2145280 6c264e21d3bd7082b43fc016d760c1d1 C:\WINDOWS\system32\ntoskrnl.exe 2007-10-17 21:30 974848 16df8a100e8966e48ba00c86f6c89972 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 14:54 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 14:54 1555480 --a------ C:\Program Files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 14:54 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 14:54 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:44 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 18:46 217544] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-18 19:45 289088] "Nowe Gadu-Gadu"="C:\Program Files\Nowe Gadu-Gadu\gg.exe" [2008-06-27 10:28 8798816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-03-17 08:05 135168] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-03-17 08:05 159744] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-03-17 08:05 131072] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 16:21 270336] "RTHDCPL"="RTHDCPL.EXE" [2007-10-17 20:20 16844800 C:\WINDOWS\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\GlobalSCAPE\\CuteFTP 8 Home\\ftpte.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"= "C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"= "C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"= R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-12-13 12:22] S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-07-29 13:15] S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 03:08] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\tomek\Dane aplikacji\Mozilla\Firefox\Profiles\vovbhfph.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-08 13:43:12 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-08 13:43:35 ComboFix-quarantined-files.txt 2008-08-08 11:43:33 ComboFix2.txt 2008-08-08 11:40:41 ComboFix3.txt 2008-08-08 10:58:58 Pre-Run: 3,066,159,104 bajtów wolnych Post-Run: 3,058,839,552 bajtów wolnych 153

**Posty:** 684 · przez **djarta** 08 Sie 2008, 14:55

Nic się nie usunęło,powtórka.

**Posty:** 1451 · przez **eisu** 08 Sie 2008, 15:04

Kod: Zaznacz wszystko: ComboFix 08-08-07.05 - tomek 2008-08-08 14:00:15.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1492 [GMT 2:00] Running from: C:\Documents and Settings\tomek\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\tomek\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\AdVantage C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc C:\Program Files\AdVantage\AdVantage.exe C:\Program Files\AdVantage\AdVantage.htm C:\Program Files\AdVantage\AdVUninst.exe C:\Program Files\AdVantage\ffext.mod C:\Program Files\AdVantage\TR.dll C:\Program Files\AdVantage\user.db C:\Program Files\free-downloads.net C:\Program Files\free-downloads.net\INSTALL.LOG C:\Program Files\free-downloads.net\tbfree.dll C:\Program Files\free-downloads.net\toolbar.cfg C:\Program Files\free-downloads.net\UNWISE.EXE . ((((((((((((((((((((((((( Files Created from 2008-07-08 to 2008-08-08 ))))))))))))))))))))))))))))))) . 2008-08-08 14:01 . 2008-08-08 14:01 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-08-08 14:01 . 2008-08-08 14:01 <DIR> d-------- C:\WINDOWS\srchasst 2008-08-08 14:01 . 2008-08-08 14:01 <DIR> d-------- C:\WINDOWS\msagent 2008-08-08 14:01 . 2008-08-08 14:01 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-08-08 13:03 . 2008-08-08 13:03 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-08 12:43 . 2008-08-08 12:53 <DIR> d-------- C:\Program Files\SkanerOnline 2008-08-06 14:23 . 2008-08-06 14:23 <DIR> d-------- C:\Program Files\FDRLab 2008-08-06 11:24 . 2008-08-06 11:27 <DIR> d-------- C:\Program Files\YouTube Video Downloader 2008-07-29 13:19 . 2008-07-29 13:19 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-07-29 13:19 . 2008-07-29 13:19 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-07-29 13:18 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-07-29 13:15 . 2008-07-29 13:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-07-29 13:15 . 2008-07-29 13:15 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-07-29 13:15 . 2008-07-29 13:15 21,672 --a------ C:\WINDOWS\system32\drivers\ggsemc.sys 2008-07-29 13:15 . 2008-07-29 13:15 13,352 --a------ C:\WINDOWS\system32\drivers\ggflt.sys 2008-07-29 13:13 . 2008-07-29 13:13 <DIR> d-------- C:\Program Files\Sony Ericsson 2008-07-15 03:13 . 2008-07-18 01:14 <DIR> d-------- C:\Program Files\eMule 2008-07-14 00:50 . 2008-07-14 00:50 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-07-14 00:50 . 2008-08-06 15:36 <DIR> d-------- C:\Documents and Settings\tomek\Dane aplikacji\Nowe Gadu-Gadu 2008-07-13 22:26 . 2008-07-13 22:26 <DIR> d-------- C:\Program Files\WapSter 2008-07-13 22:26 . 2008-07-13 22:26 <DIR> d-------- C:\Documents and Settings\tomek\WapSter . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-08 12:01 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\DNA 2008-08-05 10:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\stamina 2008-07-20 23:34 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\BitTorrent 2008-07-05 22:09 --------- d-----w C:\Program Files\MyPortal 2008-07-01 19:36 --------- d-----w C:\Program Files\Stardock 2008-07-01 19:35 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE 2008-07-01 18:28 163,712 ----a-w C:\WINDOWS\system32\drivers\vidstub.sys 2008-07-01 18:28 --------- d-----w C:\Program Files\Common Files\Stardock 2008-07-01 16:59 --------- d-----w C:\Program Files\Dziobas Rar Player 2008-07-01 15:19 --------- d-----w C:\Program Files\Winamp 2008-07-01 14:18 --------- d-----w C:\Program Files\Common Files\AOL 2008-07-01 14:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AOL 2008-06-30 20:05 --------- d-----w C:\Program Files\Total Video Converter 2008-06-30 17:39 --------- d-----w C:\Program Files\THQ 2008-06-30 17:28 --------- d-----w C:\Program Files\7-Zip 2008-06-22 17:20 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-22 17:20 --------- d-----w C:\Program Files\REALTEK RTL8187B Wireless LAN Driver 2008-06-22 17:20 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\InstallShield 2008-06-21 20:50 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-06-18 17:45 --------- d-----w C:\Program Files\DNA 2008-06-18 17:45 --------- d-----w C:\Program Files\BitTorrent 2008-06-12 20:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads 2008-06-09 18:07 --------- d-----w C:\Documents and Settings\tomek\Dane aplikacji\Media Player Classic . ------- Sigcheck ------- 2007-07-10 15:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll 2007-07-14 00:56 814592 ce7193c5f7c01b19768e066087c1c919 C:\WINDOWS\system32\wininet.dll 2007-10-16 01:19 360576 0fb6743e937c7bb248b2530a5a77abc6 C:\WINDOWS\system32\drivers\tcpip.sys 2007-10-19 00:19 2145280 6c264e21d3bd7082b43fc016d760c1d1 C:\WINDOWS\system32\ntoskrnl.exe 2007-10-17 21:30 974848 16df8a100e8966e48ba00c86f6c89972 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:44 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 18:46 217544] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-18 19:45 289088] "Nowe Gadu-Gadu"="C:\Program Files\Nowe Gadu-Gadu\gg.exe" [2008-06-27 10:28 8798816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-03-17 08:05 135168] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-03-17 08:05 159744] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-03-17 08:05 131072] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "BootSkin Startup Jobs"="C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 16:21 270336] "RTHDCPL"="RTHDCPL.EXE" [2007-10-17 20:20 16844800 C:\WINDOWS\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\GlobalSCAPE\\CuteFTP 8 Home\\ftpte.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"= "C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"= "C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"= R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-12-13 12:22] S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-07-29 13:15] S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 03:08] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-08 14:02:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\savedump.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe . ************************************************************************** . Completion time: 2008-08-08 14:03:08 - machine was rebooted [tomek] ComboFix-quarantined-files.txt 2008-08-08 12:03:04 ComboFix2.txt 2008-08-08 11:43:36 ComboFix3.txt 2008-08-08 11:40:41 ComboFix4.txt 2008-08-08 10:58:58 Pre-Run: 3,034,808,320 bajtów wolnych Post-Run: 3,026,452,480 bajt˘w wolnych 172

**Posty:** 7956 · przez **Magik** 08 Sie 2008, 15:08

eisu,

teraz lecisz

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

i skanujesz kompa tym genialnym narzedziem
http://www.programosy.pl/program,avg-anti-spyware.html

usuń ręcznie kwarantannę CF'a - C:\ Qoobox