Prosba o sprawdzenie, problem zwiazany z siecia lan

**Posty:** 9 · przez **patrykxes** 12 Sie 2009, 20:25

Witam,
Prosze o nakierowanie mnie po sprawdzeniu logow do wykonania kolejnych czynnosci. Dzieki.

Oto log z Combofix:

Kod: Zaznacz wszystko: ComboFix 09-08-10.06 - przemek 12-08-2009 19:27.4.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.48.1033.18.1022.637 [GMT 2:00] Uruchomiony z: c:\combofix2009\ComboFix.exe AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0} FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0} UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((( Pliki utworzone od 2009-07-12 do 2009-08-12 ))))))))))))))))))))))))))))))) . 2009-08-09 17:58 . 2009-08-09 17:58 -------- d-----w- c:\program files\ElcomSoft 2009-08-08 11:05 . 2009-08-08 11:05 -------- d-----w- c:\documents and settings\przemek\Application Data\HEXelon 2009-08-07 19:10 . 2009-08-07 19:11 -------- d-----w- c:\program files\Plus500 2009-08-06 19:04 . 2009-08-06 19:04 -------- d-----w- c:\documents and settings\przemek\.ispagpro . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-12 17:38 . 2008-03-01 21:12 150630176 --sha-w- c:\windows\system32\drivers\fidbox.dat 2009-08-12 17:37 . 2008-03-01 21:12 8725792 --sha-w- c:\windows\system32\drivers\fidbox2.dat 2009-08-12 14:27 . 2008-03-01 21:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab 2009-08-12 14:25 . 2008-11-21 22:15 -------- d-----w- c:\documents and settings\LocalService\Application Data\VMware 2009-08-12 14:25 . 2008-11-21 22:09 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware 2009-08-12 14:24 . 2008-03-01 21:12 829124 --sha-w- c:\windows\system32\drivers\fidbox2.idx 2009-08-12 14:24 . 2008-03-01 21:12 2038004 --sha-w- c:\windows\system32\drivers\fidbox.idx 2009-08-12 10:42 . 2008-11-21 22:23 -------- d-----w- c:\documents and settings\przemek\Application Data\VMware 2009-08-12 08:38 . 2008-10-26 10:18 1 ----a-w- c:\documents and settings\przemek\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2009-08-08 11:30 . 2008-11-02 22:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-08-05 05:38 . 2009-02-21 18:51 -------- d-----w- c:\program files\Gadu-Gadu 2009-08-03 15:42 . 2009-04-19 19:49 -------- d-----w- c:\program files\ePortfel 2009-08-01 12:42 . 2008-02-21 19:53 -------- d-----w- c:\documents and settings\przemek\Application Data\Vidalia 2009-08-01 12:41 . 2008-02-21 19:52 -------- d-----w- c:\documents and settings\przemek\Application Data\Tor 2009-07-31 12:20 . 2009-06-24 07:42 -------- d-----w- c:\program files\PuTTY Connection Manager 2009-07-30 20:13 . 2008-02-21 19:21 -------- d-----w- c:\documents and settings\przemek\Application Data\Skype 2009-07-30 20:11 . 2008-03-01 13:38 -------- d-----w- c:\documents and settings\przemek\Application Data\skypePM 2009-07-19 13:24 . 2008-07-08 22:10 -------- d-----w- c:\program files\Combined Community Codec Pack 2009-07-11 20:32 . 2009-07-11 13:54 -------- d-----w- c:\program files\Winamp 2009-07-11 20:06 . 2009-07-11 18:29 -------- d-----w- c:\documents and settings\All Users\Application Data\DFX 2009-07-11 18:29 . 2009-07-11 18:29 -------- d-----w- c:\documents and settings\postgres\Application Data\Winamp 2009-07-11 18:29 . 2009-07-11 18:29 -------- d-----w- c:\program files\Common Files\DFX 2009-07-11 18:28 . 2009-07-11 13:54 -------- d-----w- c:\documents and settings\przemek\Application Data\Winamp 2009-07-08 08:45 . 2009-07-08 08:45 -------- d-----w- c:\documents and settings\przemek\Application Data\IBM 2009-07-08 06:41 . 2009-07-08 06:19 -------- d-----w- c:\documents and settings\przemek\Application Data\JGsoft 2009-07-08 06:41 . 2009-07-08 06:41 -------- d-----w- c:\program files\JGsoft 2009-07-08 06:05 . 2008-03-14 14:09 -------- d-----w- c:\documents and settings\przemek\Application Data\Gzegzolka XP 2009-06-30 07:58 . 2009-06-30 07:58 -------- d-----w- c:\program files\Common Files\Real 2009-06-30 07:58 . 2008-02-21 18:01 -------- d-----w- c:\program files\Common Files\Adobe 2009-06-18 18:01 . 2009-02-20 22:35 -------- d-----w- c:\documents and settings\przemek\Application Data\ipla 2009-05-28 19:42 . 2008-02-14 19:50 87520 ----a-w- c:\documents and settings\przemek\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-23 09:20 . 2009-05-23 09:16 125951 ----a-w- c:\windows\HPHins12.dat 2008-12-20 15:53 . 2008-02-21 18:22 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2008-12-20 15:53 . 2008-02-21 18:22 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-20 15:53 . 2008-02-21 18:22 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2008-12-20 15:53 . 2008-02-21 18:22 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2008-12-20 15:53 . 2008-02-21 18:22 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] "Gadu-Gadu"="c:\program files\Gadu-Gadu\StrongGG.exe" [2008-05-16 21504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024] "Communicator"="c:\program files\Microsoft Office Communicator\communicator.exe" [2008-12-16 5730144] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\przemek\Start Menu\Programs\Startup\ Info.lnk - c:\windows\system32\taskmgr.exe [2004-8-4 135680] Przypominacz.lnk - c:\documents and settings\przemek\My Documents\przypom\Przypominacz.exe [2008-6-30 214528] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Monitor Apache Servers.lnk - c:\webserv\bin\ApacheMonitor.exe [2008-1-18 41041] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PAStates] 2007-01-11 14:51 98304 ----a-w- c:\windows\system32\PAStates.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Monitor Apache Servers.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Monitor Apache Servers.lnk backup=c:\windows\pss\Monitor Apache Servers.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Nokia Nseries PC Suite.lnk backup=c:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^przemek^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk] path=c:\documents and settings\przemek\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^przemek^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk] path=c:\documents and settings\przemek\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Java\\jre1.6.0_04\\bin\\java.exe"= "c:\\Program Files\\Java\\jdk1.6.0_04\\bin\\java.exe"= "c:\\Program Files\\Java\\jdk1.6.0_04\\jre\\bin\\java.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\\Program Files\\VoipStunt.com\\VoipStunt\\VoipStunt.exe"= "c:\\Program Files\\Cisco Systems\\CiscoTrustAgent\\CtaEoU.exe"= "f:\\Microsoft_Office_2007\\Office12\\OUTLOOK.EXE"= "f:\\Microsoft_Office_2007\\Office12\\GROOVE.EXE"= "f:\\Microsoft_Office_2007\\Office12\\ONENOTE.EXE"= "f:\\VMware_instalacja\\VMware Workstation\\vmware-authd.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service "3306:TCP"= 3306:TCP:MySQL Server "21862:UDP"= 21862:UDP:SDNCTA "5353:TCP"= 5353:TCP:Adobe CSI CS4 R2 CtaEoU;Cisco Trust Agent EOU Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\CtaEoU.exe [11-01-2007 16:49 356416] R2 ctalogd;Cisco Trust Agent Logger Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\ctalogd.exe [11-01-2007 16:50 98304] R2 ctapsd;Cisco Posture Server Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\ctapsd.exe [11-01-2007 16:50 327680] R2 ctatransapt;Cisco Systems, Inc. CTA Posture State Daemon;c:\program files\Cisco Systems\CiscoTrustAgent\ctatransapt.exe [11-01-2007 16:50 172032] R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [19-09-2008 00:12 54960] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13-12-2007 14:28 24592] S3 Apache2.2;Apache2.2;c:\webserv\bin\httpd.exe [18-01-2008 01:37 24635] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [06-11-2007 22:22 34064] S4 OpenSSHd;OpenSSH Server;c:\program files\OpenSSH\bin\cygrunsrv.exe [18-04-2004 13:11 36864] S4 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [01-02-2008 05:02 65536] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.pl/ uInternet Settings,ProxyServer = hxxp://proxy.tepenet/tp.pac uInternet Settings,ProxyOverride = *.local IE: Dodaj do blokowanych banerów - c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm IE: E&xport to Microsoft Excel - f:\micros~1\Office12\EXCEL.EXE/3000 IE: {{B46B0919-62BA-4D99-A5C4-916B57A6805C} - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - c:\program files\Techland\Common\InternetTranslator\InternetTranslator.dll LSP: f:\vmware_instalacja\VMware Workstation\vsocklib.dll DPF: {B2FC031D-8C74-46AE-8042-BCF4FC03C1EF} - hxxp://126.51.9.62/qcbin/Spider91.cab FF - ProfilePath - c:\documents and settings\przemek\Application Data\Mozilla\Firefox\Profiles\ekyq390z.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-12 19:37 Windows 5.1.2600 Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL] "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1296) c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\klogon.dll c:\windows\system32\PAStates.dll - - - - - - - > 'lsass.exe'(1352) c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll - - - - - - - > 'explorer.exe'(2848) c:\program files\TortoiseSVN\bin\tortoisesvn.dll c:\program files\TortoiseSVN\bin\intl3_svn.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\msi.dll . Czas ukończenia: 2009-08-12 19:41 ComboFix-quarantined-files.txt 2009-08-12 17:41 ComboFix2.txt 2009-03-29 14:08 Przed: 2 142 806 016 bytes free Po: 2 289 930 240 bytes free 189 --- E O F --- 2008-09-12 06:01

oraz log z Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:11:33, on 12-08-2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\ctalogd.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\ctapsd.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\CtaEoU.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\PROGRA~1\MICROS~2\rapimgr.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WebServ\bin\ApacheMonitor.exe C:\Program Files\Cisco Systems\CiscoTrustAgent\ctatransapt.exe C:\WINDOWS\system32\taskmgr.exe C:\Documents and Settings\przemek\My Documents\przypom\Przypominacz.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\vmnat.exe C:\WINDOWS\system32\vmnetdhcp.exe F:\VMware_instalacja\VMware Workstation\vmware-authd.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Nokia\Nokia PC Suite 7\OneTouchAccess.exe C:\Program Files\notepad2_pl\Notepad2.exe C:\HijackThis\HiJackThis_20090811\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\communicator.exe" /fromrunkey O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\StrongGG.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Info.lnk = C:\WINDOWS\system32\taskmgr.exe O4 - Startup: Przypominacz.lnk = C:\Documents and Settings\przemek\My Documents\przypom\Przypominacz.exe O4 - Global Startup: Monitor Apache Servers.lnk = C:\WebServ\bin\ApacheMonitor.exe O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: f:\vmware_instalacja\vmware workstation\vsocklib.dll O10 - Unknown file in Winsock LSP: f:\vmware_instalacja\vmware workstation\vsocklib.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {3605B612-C3CF-4AB4-A426-2D853391DB2E} (Certificates Class) - http://126.51.9.62/qcbin/capicom.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {B2FC031D-8C74-46AE-8042-BCF4FC03C1EF} (Loader Class v4) - http://126.51.9.62/qcbin/Spider91.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: PAStates - C:\WINDOWS\SYSTEM32\PAStates.dll O23 - Service: Apache2.2 - Apache Software Foundation - C:\WebServ\bin\httpd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Cisco Trust Agent EOU Daemon (CtaEoU) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\CtaEoU.exe O23 - Service: Cisco Trust Agent Logger Daemon (ctalogd) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctalogd.exe O23 - Service: Cisco Posture Server Daemon (ctapsd) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctapsd.exe O23 - Service: Cisco Systems, Inc. CTA Posture State Daemon (ctatransapt) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctatransapt.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing) O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - F:\VMware_instalacja\VMware Workstation\vmware-ufad.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - F:\VMware_instalacja\VMware Workstation\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe O23 - Service: VNC Server (winvnc) - TightVNC Group - C:\Program Files\TightVNC\WinVNC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 10453 bytes

Przed wczoraj udalo mi sie usunac problem z Generic Win32, zablkowalem wskazane porty za pomoca Wwdc i komunikat nie pojawia sie na Win XP Home SP2, ale zjawisko z zawieszaniem sie polaczen w sieci LAN nadal trwa. Mamy ok 40 laptopow podlaczonych do tej samej LAN i tylko ja mam z tym problem. Dzialam na konsoli i nagle zamraza sie konsola a po chwili dziala i tak sie powtarza

Napewno jest jakis robak powoduje te problemy.

**Posty:** 18165 · przez **wojtas** 13 Sie 2009, 11:38

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.