duże użycie procesora

[mody]

Mam problem otóz od ok. 2 dni zużycie mojego procesora wynosi 100% po kilkunastu minutach komputer sie wylacza. Patrzylem juz w Menadżerze zadań ale jest wszystko tak jak zawsze. Bardzo bym prosil o sprawdzenie loga byc moze cos podlapalem

Logfile of HijackThis v1.99.1
Scan saved at 12:41:31, on 2008-01-15
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Marcin\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {51248DEA-04B5-4AD8-AC08-547371D86740} - C:\WINDOWS\System32\ljjgdcb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Startup: SBCL v1.lnk = C:\Documents and Settings\Marcin\Pulpit\SBCL_all_version\SBCL_all_version\SBCL v1.0g.exe
O4 - Startup: MSWin-1631868753.exe
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonlreg/component/INGOnl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {11010101-1001-1111-1000-110112345678} - ms-its:mhtml:file://C:\foo.mht!http://85.255.113.242//adv//115//targ.chm::/win32.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_8.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_22.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab
O20 - Winlogon Notify: ljjgdcb - C:\WINDOWS\SYSTEM32\ljjgdcb.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)

[Avenger]

Usuń pogrubione pliki/foldery ręcznie z dysku w trybie awaryjnym i wyłączonym przywracanie systemu, wpisy kasujesz hijackiem

O2 - BHO: (no name) - {51248DEA-04B5-4AD8-AC08-547371D86740} - C:\WINDOWS\System32\ljjgdcb.dll
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Startup: MSWin-1631868753.exe
O16 - DPF: {11010101-1001-1111-1000-110112345678} - ms-its:mhtml:file://C:\foo.mht!http://85.255.113.242//adv//115//targ.chm::/win32.exe
O20 - Winlogon Notify: ljjgdcb - C:\WINDOWS\SYSTEM32\ljjgdcb.dll

Zastosuj VundoFix FixVundo VirtmundoBeGone

Po zabiegach dajesz nowy log z hijacka i log z Combofix

[mody]

Dzieki za Pomoc. Jest juz duzo lepiej. Po sprawdzeniu komputera programem VundoFix znalazlo mi kilkanascie plików zarazonych ale na szczescie wszystko usunelo. Został maly problem. Nadal zuzycie procka jest zbyd duze gdy przegladam strony internetowe przez co mozilla niekiedy strasznie sie zacina, albo gdy skoncze przegladac strony i zamkne mozille to nadal w menadzerze zadan widac ze jest uzywana przez co zuzycie procka wynosi 100% i musze zamykac recznie. Byc moze jeszcze cos siedzi.


Hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 19:21:35, on 2008-01-15
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\devldr32.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Documents and Settings\Marcin\Pulpit\SBCL_all_version\SBCL_all_version\SBCL v1.0g.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Documents and Settings\Marcin\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Startup: SBCL v1.lnk = C:\Documents and Settings\Marcin\Pulpit\SBCL_all_version\SBCL_all_version\SBCL v1.0g.exe
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\f\fsps\program\fslsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonlreg/component/INGOnl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_8.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_22.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_35.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)

ComboFix

ComboFix 08-01-15.4 - Marcin 2008-01-15 19:06:22.2 - FAT32x86
Running from: C:\Documents and Settings\Marcin\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Program Files\Common Files\{3C61F~1
C:\Program Files\Common Files\{6C61F~1

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_GB




((((((((((((((((((((((((( Files Created from 2007-12-15 to 2008-01-15 )))))))))))))))))))))))))))))))
.

2008-01-15 18:57 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-15 17:58 . 2008-01-15 17:58 <DIR> d-------- C:\VundoFix Backups
2008-01-15 09:31 . 2008-01-15 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2007-12-30 20:08 . 2007-12-30 20:09 <DIR> d-------- C:\Program Files\Common Files\InterVideo
2007-12-30 20:08 . 2007-12-30 20:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InterVideo
2007-12-30 20:08 . 2007-03-27 19:56 210,456 --a------ C:\WINDOWS\system32\IVIresizeW7.dll
2007-12-30 20:08 . 2007-03-27 19:56 206,360 --a------ C:\WINDOWS\system32\IVIresizeA6.dll
2007-12-30 20:08 . 2007-03-27 19:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeP6.dll
2007-12-30 20:08 . 2007-03-27 19:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeM6.dll
2007-12-30 20:08 . 2007-03-27 19:56 194,072 --a------ C:\WINDOWS\system32\IVIresizePX.dll
2007-12-30 20:08 . 2007-03-27 19:56 26,136 --a------ C:\WINDOWS\system32\IVIresize.dll
2007-12-30 17:44 . 2008-01-14 15:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-30 17:44 . 2007-12-30 17:44 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-30 17:40 . 2007-12-30 17:40 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems
2007-12-28 22:58 . 2007-12-28 22:58 <DIR> d-------- C:\Program Files\Virgin Media Games
2007-12-23 17:13 . 2008-01-15 09:23 1,897 --a------ C:\WINDOWS\mozver.dat
2007-12-23 16:39 . 2007-12-23 16:39 0 --a------ C:\WINDOWS\nsreg.dat
2007-12-21 22:15 . 2007-12-21 22:15 <DIR> dr-h----- C:\$VAULT$.AVG
2007-12-21 22:01 . 2007-12-21 22:01 <DIR> d-------- C:\Documents and Settings\Marcin\Dane aplikacji\AVG7
2007-12-21 22:01 . 2007-12-21 22:01 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2007-12-21 22:00 . 2007-12-21 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2007-12-21 22:00 . 2007-12-21 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-15 17:29 57,867 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-10-18 19:39 8,192 --sha-w C:\Program Files\Thumbs.db
2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-08 16:25 1397760]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-04 12:13 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-21 22:00 219136]

C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart\
SBCL v1.lnk - C:\Documents and Settings\Marcin\Pulpit\SBCL_all_version\SBCL_all_version\SBCL v1.0g.exe [2006-10-18 18:58:34]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{6C61F1E5-07CF-1045-0212-040311030030}"= "C:\Program Files\Common Files\{6C61F1E5-07CF-1045-0212-040311030030}\Update.exe" te-110-12-0000073

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Digimax Viewer 2.1.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Digimax Viewer 2.1.lnk
backup=C:\WINDOWS\pss\Digimax Viewer 2.1.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioHQ]
--a------ 2000-05-11 01:00 205312 C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2007-12-22 10:25 579072 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
--a------ 2006-08-01 17:04 3313664 E:\Program Files\BearShare\BearShare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blah S]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
--a------ 2007-02-10 17:32 172081 D:\F\Common\FSM32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
--a------ 2007-02-10 17:33 724992 D:\F\FSGUI\TNBUtil.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InvisibleBrowsing]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2005-10-18 11:58 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2005-05-28 16:25 1081344 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2003-10-06 14:16 49152 C:\WINDOWS\System32\NVMCTRAY.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-11-04 12:13 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spzoolxkxd]
C:\WINDOWS\gg\f1ght.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--a------ 2000-05-11 01:00 90112 C:\WINDOWS\Updreg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
--a------ 2007-09-12 12:17 340136 D:\Ulead Systems\Ulead VideoStudio 11\uvPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows DHCP Server]
C:\WINDOWS\System32\windhcp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows NetStart Service2]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"F-Secure Gatekeeper Handler Starter"=2 (0x2)
"FSMA"=2 (0x2)
"FSAUA"=3 (0x3)
"FSDFWD"=3 (0x3)

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\System32\drivers\fsdfw.sys [2007-02-10 17:33]
R1 eusk2par;EUTRON SmartKey Parallel Driver;C:\WINDOWS\System32\Drivers\eusk2par.sys [2004-11-18 12:49]
R1 F-Secure HIPS;F-Secure HIPS;D:\F\HIPS\fshs.sys [2007-02-10 17:33]
R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2007-02-20 13:34]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2007-02-20 13:34]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\System32\drivers\ShldDrv.sys [2005-08-29 13:23]
R2 F-Secure Filter;F-Secure File System Filter;D:\F\Anti-Virus\Win2K\FSfilter.sys [2007-02-10 17:32]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\F\Anti-Virus\win2k\fsgk.sys [2007-02-10 17:32]
R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\F\Anti-Virus\Win2K\FSrec.sys [2007-02-10 17:32]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\System32\DRIVERS\PavProc.sys [2004-01-08 07:54]
S3 eusk3usb;SmartKey 3 USB;C:\WINDOWS\System32\Drivers\eusk3usb.sys [2005-07-26 14:42]

*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-15 19:10:48
Windows 5.1.2600 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-15 19:13:18
ComboFix-quarantined-files.txt 2008-01-15 18:13:12

[wojtas]

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{6C61F1E5-07CF-1045-0212-040311030030}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spzoolxkxd]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows DHCP Server]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows NetStart Service2]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

jakiego antywirusa uzywasz bo widze ze masz AVG resztki po pandzie oraz f secure...

Autor postu otrzymał pochwałę

[Avenger]

Dodatkowo proponuję usunąć folder VundoFix Backups

C:\VundoFix Backups

Autor postu otrzymał pochwałę

[mody]

Przepraszam ze tak dlugo nie odpisywalem ale mialem duzo rzeczy na glowie. Chciałbym wam podziekowac za pomoc, komputer nie zamula nie wylacza sie. Chodzi normalnie tak jak powinien
~wojtas aktualnie uzywam AVG free edition natomiast F secure zainstalowalem kiedys ale mi sie nie spodobal strasznie zamulal kompa wiec postanowilem go usunac nie wiem dlaczego pozostaly jeszcze jakies resztki po nim

[wojtas]

Włącz LSP Fix zaznacz "I know what I'm doing" następnie w okienku Keep zaznacz tylko fslsp.dll i z pomocą strzałki >> .Przenies go do okienka Remove i kliknij Finish. Restartujemy system.

wklej do notatnika

File::
C:\WINDOWS\System32\drivers\ShldDrv.sys

Folder::
d:\f\fsps
D:\F\Anti-Virus
C:\Program Files\Common Files\Panda Software

Driver::
PavPrSrv
FSFW
F-Secure HIPS
Panda File Shield Driver
F-Secure File System Filter
F-Secure Gatekeeper
F-Secure File System Recognizer

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania