Spowolnienie komputera

**Posty:** 369 · przez **Mati92** 31 Paź 2008, 16:36

witam od jakiegos czasu strasznie zwolnił mi komputer...straszliwie wolno chodzi nie tak jak tydzień temu czy wcześniej...oto log z hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:34:35, on 2008-10-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20861) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Chrypek\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [SpeedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: Download with Rapget - C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{6FEB7DDE-9795-455A-86F0-A48DD9388F1D}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 5595 bytes

**Posty:** 7956 · przez **Magik** 31 Paź 2008, 16:37

edytuj post i log wstaw w tagi 'code'-->nie rob bajzlu

na fix:

Kod: Zaznacz wszystko: O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

do tego log z combofixa-->

**Posty:** 369 · przez **Mati92** 31 Paź 2008, 17:01

oto log po operacji..

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:00:26, on 2008-10-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20861) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Chrypek\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [SpeedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O8 - Extra context menu item: Download with Rapget - C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{6FEB7DDE-9795-455A-86F0-A48DD9388F1D}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 5644 bytes

**Posty:** 7956 · przez **Magik** 31 Paź 2008, 17:06

dales te wpisy na FIX checked??-->dalej sa

BTW, wklej log z combo

**Posty:** 369 · przez **Mati92** 01 Lis 2008, 15:24

Oto logi po operacji z Combofix i hijackthis :

Kod: Zaznacz wszystko: ComboFix 08-10-31.02 - Chrypek 2008-11-01 14:16:39.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.622 [GMT 1:00] Uruchomiony z: C:\Documents and Settings\Chrypek\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-01 do 2008-11-01 ))))))))))))))))))))))))))))))) . 2008-11-01 14:09 . 2008-11-01 14:09 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-31 15:32 . 2008-10-31 15:32 <DIR> d-------- C:\!FixIEDef 2008-10-28 19:01 . 2008-11-01 11:36 <DIR> d-------- C:\Program Files\Metin2_PL 2008-10-28 15:07 . 2007-03-27 09:26 92,032 -ra------ C:\WINDOWS\system32\drivers\hmumdm.sys 2008-10-28 15:04 . 2008-10-28 15:30 <DIR> d-------- C:\Program Files\Asystent Plusfon 401i 2008-10-27 18:41 . 2008-10-27 18:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-10-27 17:37 . 2008-10-27 17:38 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-26 20:30 . 2008-10-27 18:54 <DIR> d-------- C:\Program Files\Winamp 2008-10-26 20:30 . 2008-10-27 17:39 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\Winamp 2008-10-26 20:20 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-10-26 20:20 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-10-26 08:38 . 2008-10-26 08:38 <DIR> d-------- C:\Program Files\foobar2000 2008-10-26 08:38 . 2008-10-30 17:09 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\foobar2000 2008-10-23 17:49 . 2008-10-23 17:49 <DIR> d-------- C:\WINDOWS\Sun 2008-10-23 17:49 . 2008-06-10 01:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-10-23 17:48 . 2008-10-23 17:49 <DIR> d-------- C:\Program Files\Java 2008-10-23 17:46 . 2008-10-23 17:46 <DIR> d-------- C:\Program Files\Common Files\Java 2008-10-21 21:19 . 2008-10-21 21:19 29 --a------ C:\WINDOWS\wordpad.ini 2008-10-21 21:18 . 2008-10-21 21:18 <DIR> d-------- C:\Temp 2008-10-21 21:17 . 2008-10-21 21:18 <DIR> d-------- C:\Program Files\Cool2000 2008-10-19 19:58 . 2008-10-19 19:58 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-10-19 19:58 . 2008-10-19 20:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-10-18 12:07 . 2008-10-18 12:07 <DIR> d-------- C:\Program Files\FlashFXP 2008-10-18 12:07 . 2008-10-18 12:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FlashFXP 2008-10-18 10:30 . 2008-10-18 12:06 <DIR> d-------- C:\Program Files\TC PowerPack 2008-10-17 17:55 . 2007-07-30 18:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-10-17 17:55 . 2007-07-30 18:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-10-17 17:55 . 2007-07-30 18:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-10-16 17:20 . 2008-10-16 17:20 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\Search Settings 2008-10-14 12:59 . 2008-10-14 13:02 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\Juce VST Host 2008-10-14 12:49 . 2008-10-14 12:49 <DIR> d-------- C:\Program Files\Search Settings 2008-10-14 12:49 . 2008-10-14 12:58 <DIR> d-------- C:\Program Files\Dealio 2008-10-13 20:58 . 2008-10-13 20:58 <DIR> d-------- C:\Program Files\VstPlugins 2008-10-13 20:58 . 2006-06-20 09:56 225,280 --a------ C:\WINDOWS\system32\rewire.dll 2008-10-13 20:57 . 2008-10-14 12:58 <DIR> d-------- C:\Program Files\Image-Line 2008-10-13 20:57 . 2002-07-07 23:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm 2008-10-13 20:56 . 2008-10-13 20:56 <DIR> d-------- C:\Program Files\Outsim 2008-10-13 20:54 . 2008-10-13 20:59 <DIR> d-------- C:\Program Files\FL Studio 8 2008-10-13 18:39 . 2006-10-26 18:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2008-10-13 18:37 . 2008-10-13 18:37 <DIR> d-------- C:\Program Files\MSBuild 2008-10-13 18:37 . 2008-10-13 18:37 <DIR> d-------- C:\Program Files\Microsoft Works 2008-10-13 18:35 . 2008-10-13 18:35 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-10-13 18:32 . 2008-10-13 18:36 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-10-13 18:31 . 2008-10-13 18:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-10-13 18:30 . 2008-10-13 18:30 <DIR> dr-h----- C:\MSOCache 2008-10-11 16:26 . 2008-10-11 16:26 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\Media Player Classic 2008-10-08 16:47 . 2008-10-08 16:47 <DIR> d-------- C:\Program Files\MyPortal 2008-10-08 16:47 . 2008-10-08 16:47 0 --ah----- C:\WINDOWS\system32\sx.inf 2008-10-07 18:46 . 2008-10-07 18:46 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-10-07 18:46 . 2008-10-07 18:46 <DIR> d-------- C:\WINDOWS\srchasst 2008-10-07 18:46 . 2008-10-07 18:46 <DIR> d-------- C:\WINDOWS\msagent 2008-10-07 18:46 . 2008-10-07 18:46 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-10-07 16:36 . 2008-10-07 16:36 <DIR> d-------- C:\WINDOWS\system32\pl 2008-10-07 16:36 . 2008-10-08 17:48 <DIR> d-------- C:\WINDOWS\system32\bits 2008-10-07 16:36 . 2008-10-07 16:36 <DIR> d-------- C:\WINDOWS\l2schemas 2008-10-07 16:30 . 2007-10-18 23:19 2,189,824 --a------ C:\WINDOWS\system32\ntoskrnl.exe 2008-10-07 16:26 . 2008-10-07 16:26 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-06 21:01 . 2008-10-06 21:01 221 --a------ C:\WINDOWS\HP_RedboxHprblog_HPSU.ini 2008-10-06 21:00 . 2008-10-27 21:49 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\Image Zone Express 2008-10-06 20:45 . 2008-10-06 20:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-10-06 20:44 . 2008-10-06 20:44 <DIR> d-------- C:\Program Files\Common Files\HP 2008-10-06 20:42 . 2008-10-06 20:42 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-10-06 20:41 . 2008-10-06 20:41 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-10-06 20:40 . 2005-03-08 05:43 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-10-06 20:39 . 2005-03-08 05:43 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2008-10-06 20:39 . 2005-03-08 05:43 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys 2008-10-06 20:38 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-10-06 20:38 . 2004-09-29 11:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-10-06 20:38 . 2004-09-29 11:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-10-06 20:38 . 2004-09-29 11:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-10-06 20:38 . 2004-09-29 11:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-10-06 20:38 . 2004-09-29 11:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-10-06 20:38 . 2004-09-29 11:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-10-06 20:35 . 2008-10-06 20:45 <DIR> d-------- C:\Program Files\HP 2008-10-06 20:33 . 2008-10-06 20:46 113,574 --a------ C:\WINDOWS\hpoins07.dat 2008-10-06 20:33 . 2005-05-24 09:22 21,124 --------- C:\WINDOWS\hpomdl07.dat 2008-10-06 20:32 . 2008-10-06 20:47 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\HP 2008-10-05 10:56 . 2008-10-05 10:56 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\Leadertech 2008-10-05 10:43 . 2008-03-05 14:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll 2008-10-05 10:43 . 2007-07-19 17:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2008-10-05 10:43 . 2007-05-16 15:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2008-10-05 10:43 . 2007-03-12 15:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2008-10-05 10:43 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-10-05 10:43 . 2006-09-28 15:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2008-10-05 10:43 . 2007-04-04 17:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2008-10-05 10:42 . 2005-05-26 14:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2008-10-05 10:38 . 2008-10-05 10:38 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-10-05 10:37 . 2008-10-05 10:37 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\DAEMON Tools 2008-10-05 10:37 . 2008-10-05 10:37 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-10-04 19:04 . 2008-10-04 19:04 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\Gadu-Gadu 2008-10-04 16:40 . 2008-10-04 16:40 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\ESET 2008-10-04 16:17 . 2008-10-19 17:38 <DIR> d-------- C:\Documents and Settings\Chrypek\Gadu-Gadu 2008-10-04 16:09 . 2008-10-04 16:09 <DIR> d-------- C:\Documents and Settings\Chrypek\Dane aplikacji\ATI . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-31 16:37 --------- d-----w C:\Program Files\AutoConnect 2008-10-27 17:52 --------- d-----w C:\Program Files\Common Files\Adobe 2008-10-06 20:01 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll 2008-10-04 15:39 --------- d-----w C:\Program Files\ESET 2008-10-04 15:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-10-04 15:20 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-04 15:19 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-10-04 15:17 --------- d-----w C:\Program Files\Gadu-Gadu 2008-10-04 15:15 --------- d-----w C:\Program Files\ALLPlayer 2008-10-04 15:12 --------- d-----w C:\Program Files\Real Alternative 2008-10-04 15:12 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-10-04 15:10 --------- d-----w C:\Program Files\Thomson 2008-10-04 15:07 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-10-04 15:07 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-10-04 15:07 --------- d-----w C:\Program Files\AvRack 2008-10-04 15:04 --------- d-----w C:\Program Files\ATI Technologies 2008-10-04 14:48 --------- d-----w C:\Program Files\Usługi online 2008-10-04 14:46 --------- d-----w C:\Program Files\Windows Media Connect 2 . ------- Sigcheck ------- 2007-07-10 14:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll 2008-08-14 14:46 2059008 740d5209ce5ec76bb99923a710cd0a53 C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2GDR\ntkrnlpa.exe 2008-08-14 14:40 2064256 bd1c2093733023e5afc1520c095c2195 C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2QFE\ntkrnlpa.exe 2008-08-14 14:26 2067328 5ab2f07ad3fd76790294ddccc6e06d46 C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3GDR\ntkrnlpa.exe 2008-08-14 18:27 2067328 638346856e53887b0c3da62a9ab2c203 C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3QFE\ntkrnlpa.exe 2007-10-18 23:19 2066816 9aa8aeee2c77b68af93691758eb0a78b C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-14 14:46 2181632 1e808411607a060ad7c582b7556c9afa C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2GDR\ntoskrnl.exe 2008-08-14 14:40 2187264 8eac2f887f5e093186a6b2e548f719ba C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP2QFE\ntoskrnl.exe 2008-08-14 14:26 2190464 9ce159c91e076ff6c25d055310ebb259 C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3GDR\ntoskrnl.exe 2008-08-14 18:27 2190464 dcdd970025463dfc9676ebe18abd6a86 C:\WINDOWS\SoftwareDistribution\Download\e0f2b4f68b88b3164335825c2ea24f7a\SP3QFE\ntoskrnl.exe 2007-10-18 23:19 2189824 1aeb1a9aa55de24bda1d441989ae4492 C:\WINDOWS\system32\ntoskrnl.exe 2007-10-17 20:30 974848 16df8a100e8966e48ba00c86f6c89972 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-31_15.26.57.26 ))))))))))))))))))))))))))))))))))))))))) . - 2008-10-31 14:11:43 52,338 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-31 16:41:20 52,338 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-10-31 14:11:43 66,740 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-10-31 16:41:20 66,740 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-10-31 14:11:43 380,744 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-31 16:41:20 380,744 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-10-31 14:11:43 436,610 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-10-31 16:41:20 436,610 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 295424] "SpeedX"="C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe" [2006-06-27 46718] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST – pasek zadań.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ATI CATALYST – pasek zadań.lnk backup=C:\WINDOWS\pss\ATI CATALYST – pasek zadań.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Chrypek^Menu Start^Programy^Autostart^Rejestracja FIFA 09.lnk] path=C:\Documents and Settings\Chrypek\Menu Start\Programy\Autostart\Rejestracja FIFA 09.lnk backup=C:\WINDOWS\pss\Rejestracja FIFA 09.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2005-06-29 00:09 32768 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a------ 2005-06-28 20:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-04-01 10:39 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2005-05-11 22:12 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 10:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 03:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 19:49 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] -ra------ 2005-05-17 11:48 77824 C:\WINDOWS\SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "SearchSettings"=C:\Program Files\Search Settings\SearchSettings.exe "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys [2007-10-17 16640] S3 MobileAdapter;Huawei Mobile Adapter USB Modem and USB Serial;C:\WINDOWS\system32\DRIVERS\hmumdm.sys [2007-03-27 92032] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Chrypek\Dane aplikacji\Mozilla\Firefox\Profiles\oe01mk95.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 14:21:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-01 14:22:05 ComboFix-quarantined-files.txt 2008-11-01 13:22:03 ComboFix2.txt 2008-10-31 14:27:20 Przed: 2 699 657 216 bajtów wolnych Po: 6,638,026,752 bajtów wolnych 263 --- E O F --- 2008-10-07 15:26:53

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:23:51, on 2008-11-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20861) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapidup\RapidUploader.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [SpeedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Download with Rapget - C:\Documents and Settings\Chrypek\Pulpit\Rapget\rapget.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{6FEB7DDE-9795-455A-86F0-A48DD9388F1D}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 5414 bytes

**Posty:** 18165 · przez **wojtas** 01 Lis 2008, 16:44

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.