skoki usługi system.exe

**Posty:** 4 · przez **Maverick69** 29 Sty 2008, 20:55

Witam,
usluga system.exe (na nowo postawionym systemie z oprogramowaniem ktorego zawsze uzywalem) skacze mi co ok 2min do 13% i w tym momencie blokuje mi sie na ulamek sekundy system (nawet winamp przerywa)

Log z HiJacka:

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\WapSter\AQQ\AQQ.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe E:\Instalki\Użytkowe\EVEREST Ultimate Edition 2007 v3.80.918 PL\everest.exe C:\Program Files\G6 FTP Server\G6FTPSrv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: everest.lnk = ? O4 - Startup: G6FTPSrv.lnk = C:\Program Files\G6 FTP Server\G6FTPSrv.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Jezeli macie jakis pomysl to mowcie jak sie tego pozbyc

**Posty:** 18165 · przez **wojtas** 29 Sty 2008, 21:19

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 4 · przez **Maverick69** 29 Sty 2008, 21:51

Zrobilem logi ponizej combofix:

Kod: Zaznacz wszystko: ComboFix 08-01-29.3 - Maverick 2008-01-29 20:43:00.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.668 [GMT 1:00] Running from: E:\Instalki\Użytkowe\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 ))))))))))))))))))))))))))))))) . 2008-01-29 20:38 . 2008-01-29 20:38 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-01-29 20:38 . 2008-01-29 20:39 <DIR> d--hs---- C:\WINDOWS\system32\dllcache 2008-01-29 20:38 . 2008-01-29 20:38 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-01-29 20:37 . 2008-01-29 20:37 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-29 20:36 . 2008-01-29 14:44 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-01-29 20:36 . 2008-01-29 14:44 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-01-29 20:36 . 2008-01-29 13:58 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-01-29 20:36 . 2008-01-29 14:44 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-01-29 20:36 . 2008-01-29 14:44 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-01-29 20:36 . 2008-01-29 14:44 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-01-29 20:36 . 2008-01-29 14:44 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-01-29 19:39 . 2008-01-29 19:39 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-29 18:30 . 2008-01-29 18:30 <DIR> d-------- C:\Documents and Settings\Maverick\Dane aplikacji\Ventrilo 2008-01-29 18:29 . 2008-01-29 18:29 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-29 17:43 . 2008-01-29 17:43 1,158 --a------ C:\WINDOWS\mozver.dat 2008-01-29 17:40 . 2008-01-29 17:40 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-01-29 17:38 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2008-01-29 17:38 . 2008-01-29 17:38 421 --a------ C:\WINDOWS\ODBC.INI 2008-01-29 17:37 . 2008-01-29 17:38 <DIR> d-------- C:\Program Files\PDFCreator 2008-01-29 17:37 . 2008-01-29 17:37 <DIR> d-------- C:\Program Files\Microsoft Works 2008-01-29 17:37 . 2008-01-29 17:37 <DIR> d-------- C:\Program Files\Foxit Software 2008-01-29 17:37 . 2004-03-09 01:00 662,288 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX 2008-01-29 17:37 . 1998-06-24 01:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX 2008-01-29 17:37 . 2001-10-28 17:42 116,224 --a------ C:\WINDOWS\system32\pdfcmnnt.dll 2008-01-29 17:37 . 1998-07-06 01:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL 2008-01-29 17:36 . 2008-01-29 17:37 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-01-29 17:36 . 2008-01-29 17:36 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-01-29 17:34 . 2008-01-29 17:35 <DIR> d-------- C:\Program Files\Winamp 2008-01-29 17:29 . 2008-01-29 17:31 <DIR> d-------- C:\Program Files\AutoCAD 2008 2008-01-29 17:29 . 2008-01-29 17:29 <DIR> d-------- C:\Documents and Settings\Maverick\Dane aplikacji\Autodesk 2008-01-29 17:29 . 2008-01-29 17:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk 2008-01-29 17:28 . 2008-01-29 17:31 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared 2008-01-29 17:28 . 2008-01-29 17:28 <DIR> d-------- C:\Program Files\Autodesk 2008-01-29 17:24 . 2008-01-29 17:24 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2008-01-29 17:24 . 2008-01-29 17:24 <DIR> d-------- C:\Program Files\ACD Systems 2008-01-29 17:24 . 2008-01-29 17:24 <DIR> d-------- C:\Documents and Settings\Maverick\Dane aplikacji\ACD Systems 2008-01-29 17:24 . 2008-01-29 17:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-01-29 17:24 . 2008-01-29 17:24 10,368 --a------ C:\WINDOWS\system32\drivers\pfc.sys 2008-01-29 17:22 . 2008-01-29 17:22 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-01-29 17:22 . 2008-01-29 17:22 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2008-01-29 17:20 . 2008-01-29 17:20 <DIR> d-------- C:\Program Files\CyberLink 2008-01-29 17:19 . 2008-01-29 17:20 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-01-29 17:19 . 2008-01-29 17:19 <DIR> d-------- C:\Program Files\Apple Software Update 2008-01-29 17:19 . 2008-01-29 17:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-01-29 17:18 . 2008-01-29 17:18 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-01-29 17:18 . 2008-01-29 17:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-01-29 17:16 . 2008-01-29 17:16 <DIR> d-------- C:\Program Files\SubEdit-Player 2008-01-29 17:14 . 2008-01-29 17:14 <DIR> d-------- C:\Downloads 2008-01-29 17:14 . 2008-01-29 17:14 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2008-01-29 17:13 . 2008-01-29 17:14 <DIR> d-------- C:\Program Files\BitComet 2008-01-29 17:09 . 2008-01-29 17:09 <DIR> d-------- C:\Program Files\WapSter 2008-01-29 17:09 . 2008-01-29 17:09 <DIR> d-------- C:\Documents and Settings\Maverick\WapSter 2008-01-29 17:08 . 2000-10-10 04:01 304,128 --a------ C:\WINDOWS\msflxgrd.ocx 2008-01-29 17:08 . 2003-05-17 13:08 140,288 --a------ C:\WINDOWS\system32\ComDlg32.ocx 2008-01-29 17:08 . 2006-01-13 14:00 15,872 --a------ C:\WINDOWS\system32\drivers\vd_filedisk.sys 2008-01-29 17:07 . 2008-01-29 17:08 <DIR> d-------- C:\Program Files\TC UP 2008-01-29 17:02 . 2008-01-29 17:02 <DIR> d-------- C:\Program Files\Nero 2008-01-29 17:02 . 2008-01-29 17:02 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-01-29 17:02 . 2008-01-29 17:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-01-29 16:54 . 2008-01-29 16:54 <DIR> d-------- C:\Documents and Settings\Maverick\Dane aplikacji\Thunderbird 2008-01-29 16:54 . 2008-01-29 16:54 <DIR> d-------- C:\Documents and Settings\Maverick\Dane aplikacji\Talkback 2008-01-29 16:53 . 2008-01-29 19:47 <DIR> d-------- C:\Program Files\Mozilla Thunderbird 2008-01-29 16:36 . 2008-01-29 18:56 <DIR> d-------- C:\Program Files\G6 FTP Server 2008-01-29 16:24 . 2008-01-29 16:24 0 --a------ C:\WINDOWS\nsreg.dat 2008-01-29 16:08 . 2008-01-29 16:08 <DIR> d-------- C:\Program Files\SymNetDrv 2008-01-29 15:55 . 2008-01-29 15:55 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-01-29 15:55 . 2008-01-29 16:21 <DIR> d-------- C:\Program Files\Norton Internet Security 2008-01-29 15:55 . 2008-01-29 15:55 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-01-29 15:55 . 2008-01-29 15:55 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-01-29 15:49 . 2008-01-29 18:24 <DIR> d-------- C:\Program Files\Norton SystemWorks 2008-01-29 15:49 . 2008-01-29 18:24 <DIR> d-------- C:\Documents and Settings\Maverick\Dane aplikacji\Symantec 2008-01-29 15:49 . 2006-09-15 22:52 124,016 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-01-29 15:49 . 2006-09-15 22:52 91,904 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-01-29 15:49 . 2008-01-29 15:55 4,608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys 2008-01-29 15:48 . 2008-01-29 16:09 <DIR> d-------- C:\Program Files\Symantec 2008-01-29 15:48 . 2008-01-29 20:43 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-01-29 15:48 . 2008-01-29 15:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-01-29 15:43 . 2008-01-29 15:43 <DIR> d-------- C:\Program Files\xp-AntiSpy 2008-01-29 15:42 . 2008-01-29 15:42 <DIR> d-------- C:\Program Files\DAEMON Tools 2008-01-29 15:41 . 2008-01-29 15:41 611,064 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-01-29 15:39 . 2008-01-29 20:40 51 --a------ C:\WINDOWS\iTouch.ini 2008-01-29 15:37 . 2008-01-29 15:37 <DIR> d-------- C:\Program Files\Logitech 2008-01-29 15:37 . 2008-01-29 15:37 <DIR> d-------- C:\Program Files\Common Files\Logitech 2008-01-29 15:31 . 2008-01-29 18:48 127,254 --a------ C:\WINDOWS\system32\nvapps.xml 2008-01-29 15:30 . 2008-01-29 15:30 <DIR> d-------- C:\WINDOWS\nview 2008-01-29 15:30 . 2007-06-28 17:43 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-01-29 15:30 . 2007-06-28 17:43 17,463 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-01-29 15:21 . 2008-01-29 15:21 <DIR> d-------- C:\Program Files\Realtek Sound Manager 2008-01-29 15:21 . 2008-01-29 17:20 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-01-29 15:21 . 2008-01-29 15:21 <DIR> d-------- C:\Program Files\AvRack 2008-01-29 15:05 . 2006-01-23 11:51 466,944 --a------ C:\WINDOWS\system32\CapabilityTable.exe 2008-01-29 15:05 . 2006-04-14 14:00 208,896 --------- C:\WINDOWS\system32\nvuide.exe 2008-01-29 15:05 . 2006-02-20 13:00 1,570 --------- C:\WINDOWS\system32\nvide.nvu 2008-01-29 15:04 . 2008-01-29 17:28 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-01-29 15:04 . 2008-01-29 15:04 <DIR> d-------- C:\NVIDIA 2008-01-29 15:04 . 2006-04-14 14:00 208,896 --a------ C:\WINDOWS\system32\nvusmb.exe 2008-01-29 15:04 . 2006-04-14 14:00 208,896 --a------ C:\WINDOWS\system32\nvunrm.exe 2008-01-29 15:04 . 2006-04-14 14:00 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-01-29 15:04 . 2006-04-14 20:08 101,888 --a------ C:\WINDOWS\system32\drivers\nvtcp.sys 2008-01-29 15:04 . 2006-02-20 13:00 3,903 --a------ C:\WINDOWS\system32\nvnrm.nvu . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-29 16:29 --------- d--h--w C:\Program Files\Uninstall Information 2008-01-29 13:01 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Norton SystemWorks"="C:\Program Files\Norton SystemWorks\cfgwiz.exe" [2004-09-10 03:12 132248] "AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 11:20 77824 C:\WINDOWS\SOUNDMAN.EXE] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 17:43 8466432] "nwiz"="nwiz.exe" [2007-06-28 17:43 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 17:43 81920] "zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2003-12-01 11:38 892928] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 19968 C:\WINDOWS\LOGI_MWX.EXE] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 11:42 58728] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-01-29 16:08 100056] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\Maverick\Menu Start\Programy\Autostart\ everest.lnk - E:\Instalki\Uľytkowe\EVEREST Ultimate Edition 2007 v3.80.918 PL\everest.exe [2007-10-08 14:17:23 1698304] G6FTPSrv.lnk - C:\Program Files\G6 FTP Server\G6FTPSrv.exe [2008-01-29 16:36:27 463360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-01-15 16:14 147456 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "NMIndexingService"=3 (0x3) "MDM"=2 (0x2) R1 VD_FileDisk;VD_FileDisk;C:\WINDOWS\system32\drivers\VD_FileDisk.sys [2006-01-13 14:00] R3 EverestDriver;Lavalys EVEREST Kernel Driver;E:\Instalki\Użytkowe\EVEREST Ultimate Edition 2007 v3.80.918 PL\kerneld.wnt [2006-12-14 22:42] R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys [2003-11-07 10:50] R3 NPDriver;Norton Unerase Protection Driver;C:\WINDOWS\system32\Drivers\NPDRIVER.SYS [2004-08-30 23:38] S3 SDdriver;SDdriver;C:\WINDOWS\system32\Drivers\sddriver.sys [2004-08-30 23:23] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9be21910-ce6f-11dc-93e3-806d6172696f}] \Shell\AutoRun\command - F:\setup.exe *Newly Created Service* - EVERESTDRIVER *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder "2008-01-29 16:19:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-01-29 17:23:06 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Maverick.job" - C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exef/task: "2008-01-29 17:25:29 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job" - C:\Program Files\Norton SystemWorks\OBC.exe "2008-01-29 14:49:57 C:\WINDOWS\Tasks\Symantec Drmc.job" - C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-29 20:43:44 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-29 20:44:04

a tutaj z sdfix:

Kod: Zaznacz wszystko: SDFix: Version 1.133 Run by Maverick on 2008-01-29 at 20:37 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-29 20:38:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:043da103 "s2"=dword:536bede4 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:ed,7f,e1,b9,bd,a7,8e,67,b1,52,e1,a4,21,e2,82,8d,63,32,5d,37,e7,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,33,5c,4c,b1,18,43,9e,6f,2f,d0,ea,15,85,ef,e0,66,f5,.. "khjeh"=hex:2f,54,3a,0f,6f,44,5b,70,9f,2b,7c,08,3e,3b,92,68,16,98,53,08,b3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:1b,78,b0,05,62,ca,88,88,65,f3,94,2f,45,b9,43,70,81,83,db,ea,d2,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager\Memory Management\PrefetchParameters] "VideoInitTime"=dword:000002fd [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Watchdog\Display] "ShutdownCount"=dword:00000012 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\PNPA000\4&4cafbea7&0] "Service"="ae6018a1" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_EVERESTDRIVER\0000] "Service"="EverestDriver" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000000 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="Lavalys EVEREST Kernel Driver" "Capabilities"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ERSvc] "Start"=dword:00000004 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\EverestDriver] "ImagePath"=str(2):"\??\C:\DOCUME~1\Maverick\USTAWI~1\Temp\EverestDriver.sys" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess] "Start"=dword:00000004 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SPBBCDrv] "Start"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:ed,7f,e1,b9,bd,a7,8e,67,b1,52,e1,a4,21,e2,82,8d,63,32,5d,37,e7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,33,5c,4c,b1,18,43,9e,6f,2f,d0,ea,15,85,ef,e0,66,f5,.. "khjeh"=hex:2f,54,3a,0f,6f,44,5b,70,9f,2b,7c,08,3e,3b,92,68,16,98,53,08,b3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:1b,78,b0,05,62,ca,88,88,65,f3,94,2f,45,b9,43,70,81,83,db,ea,d2,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{025E1558-88B7-40B0-976C-C38C9C852967}] "LeaseObtainedTime"=dword:479f7e1b "T1"=dword:479fedf7 "T2"=dword:47a0479d "LeaseTerminatesTime"=dword:47a06d2b "DhcpRetryTime"=dword:00006fdc [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\wscsvc] "Start"=dword:00000004 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\wuauserv] "Start"=dword:00000004 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{025E1558-88B7-40B0-976C-C38C9C852967}\Parameters\Tcpip] "LeaseObtainedTime"=dword:479f7e1b "T1"=dword:479fedf7 "T2"=dword:47a0479d "LeaseTerminatesTime"=dword:47a06d2b scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19] "RefCount"=dword:00000002 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"="C:\\Program Files\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"="C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- Files with Hidden Attributes: Tue 29 Jan 2008 103,894 ..SHR --- "C:\WINDOWS\system32\amvo.exe" Tue 29 Jan 2008 54,784 ..SHR --- "C:\WINDOWS\system32\amvo0.dll" Finished!

HiJack jest w pierwszym poscie.

PS
- zauwazylem ze to jednak nie sa momenty w ktorych system.exe skacze do 13%.
- usunalem pliki, ktore sdfix wykazal z atrybutem ukrytym - nie pomoglo
- wykorzystanie procesora nie skacze na maxa
- podejrzewam problem ze sterami (nForce4 + Gigabyte Realtek - jedyna zmiana jakiej ostatnio dokonalem)
- wejsc zewnetrznych nie zatrzymuje (lineIn z drugiego kompa)

Specyfikacja:
K8NF-9 + AMD3000+ (str. j/w)
2x512mB Kingston 400
GeForce 7600 GST (str. org.)

Prosze o pomoc

**Posty:** 18165 · przez **wojtas** 30 Sty 2008, 15:43

skasuj:

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

w jakiej lokalizacji masz pliki system.exe ?? u mnie w menadzerze zadan tez usluga system zabiera ok 10 % procka

wykonaj:

http://forum.programosy.pl/optymalizacja-windowsa-xp-vt89133.html

**Posty:** 4 · przez **Maverick69** 30 Sty 2008, 16:38

Sorki to nie system.exe tylko poprostu usluga System
Normalnie zajmuje mi ok. 2-4%
Tak wyglada obecnie praca procesora skoki sa regularne i do ok 17-20%

Natomiast same zawieszenia systemu sa rzadziej i nie sa regularne

PS w msconfigu wywalilem wszystko co niepotrzebne
ten plik amvo juz usunalem

**Posty:** 18165 · przez **wojtas** 30 Sty 2008, 17:13

logi masz czyste wiec to nie wina wirusow

**Posty:** 4 · przez **Maverick69** 30 Sty 2008, 17:32

Przeprowadzilem mu 3 rozne testy dyskow, procesora i pamieci - wszystko ok

Skonczy sie chyba reinstalka

Jak ja kocham Winde

(system stoi od 2 dni)

ALe dzieki za pomoc

skoki usługi system.exe

Skoki usługi system.exe

Kto jest na forum