z zamykaniem systemu windows

**Posty:** 97 · przez **pejson** 27 Lut 2008, 21:18

problem polega na tym ze od pewnego czasu praktycznie przy kazdym zamykaniu systemu windows wyskakuje mi komunikat czy napewno chce zakonczyc jakis program, czasami nawet kilka, niekiedy pokazuje sie pasek postepu zamykania tego programu choc w umie sam sie rzadko zamyka i trzeba nacisna przycisk zeby sie zamknal i dopiero wtedy komputer sie wylacza.jest to bardzo uciazliwe.prosze o pomoc.

**Posty:** 18165 · przez **wojtas** 27 Lut 2008, 21:29

daj loga z hijacka w tagach:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 97 · przez **pejson** 27 Lut 2008, 22:11

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:10:34, on 2008-02-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ASUS\Ai Nap\AiNap.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Opera\Opera.exe
C:\Pest Exterminator\pe.exe
C:\Documents and Settings\Pejson\Pulpit\hijack\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sygate.com/swat/support/spf50_reg.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: ADSTechnology module - {831CBAC0-8283-4653-9D81-FEB9F3F6E47C} - C:\Program Files\ADSTechnology\ADSTechnology.dll
O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [Launch Ai Booster] "C:\Program Files\ASUS\Ai Booster\OverClk.exe"
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Nap\AiNap.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Wyszukiwanie z pulpitu systemu Windows.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

--
End of file - 8529 bytes

**Posty:** 18165 · przez **wojtas** 27 Lut 2008, 22:19

O2 - BHO: ADSTechnology module - {831CBAC0-8283-4653-9D81-FEB9F3F6E47C} - C:\Program Files\ADSTechnology\ADSTechnology.dll
O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll

skasuj te wpisy w hijacku i daj loga z combofixa

**Posty:** 97 · przez **pejson** 27 Lut 2008, 22:53

ComboFix 08-02-25.3 - Pejson 2008-02-27 21:51:13.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.455 [GMT 1:00]
Running from: C:\Documents and Settings\Pejson\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Menu Start\Programy\ADSTechnology
C:\Documents and Settings\All Users\Menu Start\Programy\ADSTechnology\ADSTechnology.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\ADSTechnology\Uninstall.lnk
C:\Program Files\ActivationManager
C:\Program Files\ActivationManager\Uninstall.exe
C:\Program Files\ADSTechnology
C:\Program Files\ADSTechnology\ADSTechnology.exe
C:\Program Files\ADSTechnology\Uninstall.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 )))))))))))))))))))))))))))))))
.

2008-02-27 21:41 . 2008-02-04 20:31 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-02-27 21:41 . 2008-02-04 20:31 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione
2008-02-27 21:41 . 2008-02-04 19:36 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2008-02-27 21:41 . 2008-02-04 20:31 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2008-02-27 21:41 . 2008-02-04 20:31 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty
2008-02-27 21:41 . 2008-02-04 20:31 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-02-27 21:41 . 2008-02-04 20:31 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2008-02-27 21:14 . 2008-02-27 21:14 6,538 --a------ C:\peautostart.html
2008-02-27 21:02 . 2008-02-27 21:02 <DIR> d-------- C:\Pest Exterminator
2008-02-27 21:02 . 2001-08-23 12:00 18,432 --a------ C:\WINDOWS\cacls1.exe
2008-02-27 20:59 . 2008-02-27 20:59 <DIR> d---s---- C:\Documents and Settings\Pejson\UserData
2008-02-27 18:53 . 2008-02-27 18:53 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2008-02-25 12:24 . 2008-02-25 12:24 <DIR> d-------- C:\Program Files\Lavalys
2008-02-23 22:06 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-02-17 18:12 . 2008-02-17 18:12 <DIR> d-------- C:\Program Files\Dziobas Rar Player
2008-02-17 18:08 . 2008-02-17 18:08 25 --a------ C:\WINDOWS\cdplayer.ini
2008-02-17 18:07 . 2008-02-17 18:07 <DIR> d-------- C:\Program Files\Real
2008-02-17 18:07 . 2008-02-17 18:07 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-17 18:07 . 2008-02-17 18:07 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-14 21:00 . 2008-02-18 00:08 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\AdobeUM
2008-02-10 22:35 . 2008-02-10 22:35 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\Windows Desktop Search
2008-02-10 22:34 . 2008-02-10 22:34 <DIR> d-------- C:\WINDOWS\system32\pl-PL
2008-02-10 22:34 . 2008-02-27 01:44 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-10 22:34 . 2008-02-10 22:34 <DIR> d-------- C:\Program Files\Windows Desktop Search
2008-02-10 20:24 . 2008-02-10 20:24 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\vlc
2008-02-10 20:23 . 2008-02-10 20:23 <DIR> d-------- C:\Program Files\VideoLAN
2008-02-10 15:02 . 2008-02-10 15:02 <DIR> d-------- C:\Program Files\Hamachi
2008-02-10 15:02 . 2008-02-27 21:49 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\Hamachi
2008-02-10 15:02 . 2008-02-10 15:02 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-02-09 22:44 . 2008-02-09 22:44 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\Media Player Classic
2008-02-09 22:42 . 2008-02-09 22:42 <DIR> d-------- C:\Program Files\MarBit
2008-02-09 22:40 . 2008-02-09 22:40 <DIR> d-------- C:\Program Files\SubEdit-Player
2008-02-09 18:45 . 2008-02-09 18:45 <DIR> d-------- C:\Program Files\GameShadow
2008-02-09 18:18 . 2008-02-09 18:18 <DIR> d-------- C:\Program Files\Ubisoft
2008-02-08 14:44 . 2008-02-08 14:44 <DIR> d-------- C:\Program Files\Ares
2008-02-07 20:11 . 2008-02-07 20:11 <DIR> d-------- C:\games
2008-02-05 20:32 . 2008-02-05 20:32 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-02-05 20:32 . 2008-02-05 20:32 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-02-05 10:58 . 2008-02-05 10:58 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\Gadu-Gadu
2008-02-04 23:34 . 2008-02-09 18:45 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-04 23:34 . 2008-02-04 23:34 <DIR> d-------- C:\Program Files\HDD Regenerator
2008-02-04 23:31 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-02-04 23:30 . 2008-02-04 23:30 <DIR> d-------- C:\Program Files\MSBuild
2008-02-04 23:30 . 2008-02-04 23:31 <DIR> d-------- C:\Program Files\Microsoft Works
2008-02-04 23:29 . 2008-02-04 23:29 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-04 23:28 . 2008-02-04 23:28 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-02-04 23:27 . 2008-02-04 23:30 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-02-04 23:27 . 2008-02-04 23:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-02-04 23:26 . 2008-02-04 23:26 <DIR> dr-h----- C:\MSOCache
2008-02-04 23:24 . 2008-02-04 23:24 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-04 23:24 . 2008-02-24 13:56 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\DAEMON Tools
2008-02-04 22:56 . 2008-02-04 22:56 <DIR> d-------- C:\Program Files\XP Codec Pack
2008-02-04 22:56 . 2007-08-18 08:54 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm
2008-02-04 22:49 . 2008-02-04 22:49 715,248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-04 22:42 . 2008-02-04 22:42 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\CyberLink
2008-02-04 22:42 . 2008-02-04 22:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-02-04 22:39 . 2008-02-04 22:39 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-02-04 22:39 . 2008-02-08 23:17 <DIR> d-------- C:\Documents and Settings\Pejson\Gadu-Gadu
2008-02-04 22:35 . 2008-02-04 22:35 <DIR> d-------- C:\Program Files\Opera
2008-02-04 22:32 . 2008-02-16 12:58 <DIR> d-------- C:\Program Files\Winamp
2008-02-04 22:31 . 2008-02-04 22:31 <DIR> dr------- C:\Documents and Settings\NetworkService\Ulubione
2008-02-04 21:39 . 2008-02-04 21:39 <DIR> d-------- C:\Program Files\Sygate
2008-02-04 21:39 . 2004-10-15 18:32 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2008-02-04 21:39 . 2004-10-15 18:17 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2008-02-04 21:39 . 2004-10-15 18:18 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-02-04 21:39 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2008-02-04 21:39 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2008-02-04 21:39 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2008-02-04 21:39 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2008-02-04 21:38 . 2008-02-04 21:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-04 21:38 . 2008-02-04 21:38 <DIR> d-------- C:\Program Files\Alwil Software
2008-02-04 21:36 . 2008-02-27 17:06 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-04 21:33 . 2008-02-04 23:43 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-02-04 21:32 . 2008-02-04 23:43 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\Ahead
2008-02-04 21:30 . 2008-02-04 21:30 <DIR> d-------- C:\Program Files\Nero
2008-02-04 21:30 . 2008-02-04 21:32 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-04 21:30 . 2008-02-04 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero
2008-02-04 21:23 . 2008-02-04 21:24 <DIR> d-------- C:\Program Files\CyberLink
2008-02-04 21:23 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-02-04 21:21 . 2008-02-04 21:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ATI
2008-02-04 21:21 . 2008-02-04 21:21 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-02-04 21:14 . 2008-02-04 21:14 <DIR> d-------- C:\Documents and Settings\Pejson\Dane aplikacji\ATI
2008-02-04 21:09 . 2008-02-04 21:09 <DIR> d-------- C:\Program Files\Common Files\ATI Technologies
2008-02-04 21:07 . 2007-03-15 02:29 3,107,788 -ra------ C:\WINDOWS\system32\ativvaxx.dat
2008-02-04 21:07 . 2007-12-20 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-02-04 21:07 . 2007-12-21 04:09 368,640 --a------ C:\WINDOWS\system32\ATIDEMGX.dll
2008-02-04 21:07 . 2007-12-21 04:02 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2008-02-04 21:07 . 2007-11-27 20:34 160,289 --a------ C:\WINDOWS\system32\atiicdxx.dat
2008-02-04 21:07 . 2007-08-31 15:20 7,167 --a------ C:\WINDOWS\system32\atifglpf.xml
2008-02-04 21:06 . 2008-02-04 21:18 <DIR> d-------- C:\Program Files\ATI Technologies
2008-02-04 21:06 . 2007-01-10 18:32 655,842 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.cpa
2008-02-04 21:06 . 2007-03-15 03:32 41,136 -ra------ C:\WINDOWS\system32\drivers\ativvpxx.vp
2008-02-04 21:06 . 2006-08-23 22:26 2,096 -ra------ C:\WINDOWS\system32\drivers\ativdkxx.vp
2008-02-04 21:06 . 2006-08-23 22:26 2,096 -ra------ C:\WINDOWS\system32\drivers\ativckxx.vp
2008-02-04 21:06 . 2007-01-10 18:32 929 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.vp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-20 11:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-04 19:55 606,848 ----a-w C:\WINDOWS\flashax.exe
2008-02-04 19:55 194,560 ----a-w C:\WINDOWS\ASUS_Ai_Proactive_Screensaver (E).scr
2008-02-04 19:55 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-02-04 19:55 --------- d-----w C:\Program Files\ASUS
2008-02-04 19:53 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-04 19:52 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-04 19:41 --------- d-----w C:\Program Files\Analog Devices
2008-02-04 19:33 --------- d-----w C:\Program Files\AMD
2008-02-04 19:25 --------- d-----w C:\Program Files\NVIDIA Corporation
2008-02-04 18:40 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-04 18:39 --------- d-----w C:\Program Files\Usługi online
2007-12-21 03:08 272,384 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-21 02:59 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-21 02:59 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-21 02:59 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-21 02:59 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-21 02:58 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-21 02:57 512,000 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-21 02:56 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-21 02:53 9,826,304 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-21 02:47 3,120,640 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-21 02:36 1,661,696 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-21 02:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2007-12-21 02:20 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-21 02:20 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-21 02:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-21 02:15 159,744 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-21 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-12-07 01:08 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39 2119104]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-03 14:54 486856]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 22:54 961536]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 03:07 843776]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19 729088]
"Launch Ai Booster"="C:\Program Files\ASUS\Ai Booster\OverClk.exe" [2006-05-05 16:49 3680256]
"Ai Nap"="C:\Program Files\ASUS\Ai Nap\AiNap.exe" [2006-05-10 19:28 1090560]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40 2577632]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 23:54 37376]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-17 18:07 180269]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

C:\Documents and Settings\Pejson\Menu Start\Programy\Autostart\
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2008-02-10 15:02:06 624416]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Wyszukiwanie z pulpitu systemu Windows.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"D:\\Gry\\Battle2\\BF2.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"D:\\Gry\\fifa\\FIFA08.exe"=

R0 mv614x;mv614x;C:\WINDOWS\system32\DRIVERS\mv614x.sys [2006-02-16 09:21]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 21:52:15
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-27 21:52:35
ComboFix-quarantined-files.txt 2008-02-27 20:52:33
.
2008-02-27 00:44:28 --- E O F ---

**Posty:** 18165 · przez **wojtas** 27 Lut 2008, 22:58

zastosuj sie do tego tematu:

http://forum.programosy.pl/optymalizacja-windowsa-xp-vt89133.html

nic w logach wiecej nie widac

**Posty:** 97 · przez **pejson** 27 Lut 2008, 23:00

ok dzieki za pomoc.a mozesz jeszcze powiedziec prostym jezykiem na czym polega moj problem i czym jest spowodowany??

**Posty:** 18165 · przez **wojtas** 27 Lut 2008, 23:03

zrob reset kompa i napisz jakie programy chce zamknac przy wyłaczeniu systemu

**Posty:** 97 · przez **pejson** 27 Lut 2008, 23:09

przy wylaczaniu wyskakuje komunikat:
"kończenie pracy programu WMS Idle"
i program prubuje zamknac sie sam ale nie udaje mu sie to i wyskakuje komunikat
"program nie odpowiada"
wtedy mozna zamknac go "zakoncz teraz " lub anulowac

**Posty:** 18165 · przez **wojtas** 27 Lut 2008, 23:16

Usuń z autostartu NMBgMonitor.exe( start -> uruchom -> msconfig -> uruchamianie) i tam znajdz NMBgMonitor.exe i odznacz i reset kompa i sprawdz czy jest ok

Autor postu otrzymał pochwałę

**Posty:** 97 · przez **pejson** 27 Lut 2008, 23:32

jest ok wielkie dzieki

z zamykaniem systemu windows

z zamykaniem systemu windows

Kto jest na forum