Prosze o sprawdzenie logow, 100% uzycie procesora

**Posty:** 18 · przez **prokopek** 18 Sty 2009, 12:51

Witam. O toż ostatnio zauważyłem że ciągle mam 100% użycie procesora.. nawet jeżeli wszystko jest wyłączone. Proszę o sprawdzenie loga. Dziękuje z góry.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:50:39, on 2009-01-18 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint – Dodaj do listy drukowania - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint – Drukuj - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint – Drukuj z dużą szybkością - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint – Podgląd - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe -- End of file - 4986 bytes

Kod: Zaznacz wszystko: ComboFix 09-01-17.03 - Klop 2009-01-21 22:14:08.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.767.544 [GMT 1:00] Uruchomiony z: c:\documents and settings\Klop\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-21 do 2009-01-21 ))))))))))))))))))))))))))))))) . 2009-01-18 11:50 . 2009-01-18 11:50 <DIR> d-------- c:\program files\Trend Micro 2009-01-14 22:54 . 2009-01-18 13:55 <DIR> d-------- C:\do zrobienia 2009-01-09 22:56 . 2009-01-09 22:56 <DIR> d-------- c:\windows\system32\NtmsData 2009-01-03 23:05 . 2009-01-03 23:05 92 --a------ c:\windows\mp3wavcon.ini 2009-01-03 23:01 . 2009-01-03 23:01 <DIR> d-------- c:\program files\AudioToolsFactory 2009-01-03 23:01 . 2003-12-15 12:43 1,871,872 --a------ c:\windows\system32\NCTAudioFile2.dll 2009-01-03 23:01 . 2003-12-08 12:19 425,984 --a------ c:\windows\system32\NCTAudioTransform2.dll 2009-01-03 23:01 . 2002-01-05 14:37 344,064 --a------ c:\windows\system32\msvcr70.dll 2009-01-03 23:01 . 2003-08-07 14:01 237,568 --a------ c:\windows\system32\lame_enc.dll 2009-01-03 23:01 . 2003-12-15 12:24 196,608 --a------ c:\windows\system32\NCTWMAFile2.dll 2009-01-03 23:01 . 2003-12-08 12:49 116,304 --a------ c:\windows\system32\NCTWMAProfiles.prx 2009-01-03 23:01 . 2009-01-03 23:05 5 --a------ c:\windows\system32\SySmp3con.dat 2009-01-03 22:59 . 2009-01-03 22:59 <DIR> d-------- c:\program files\Audio Converter 2009-01-03 22:59 . 2009-01-03 23:01 <DIR> d-------- C:\My Music 2009-01-03 21:36 . 2004-01-14 02:10 163,840 --a------ c:\windows\BJPSUNST.EXE 2009-01-03 21:35 . 2003-09-18 14:32 1,060,864 --a------ c:\windows\system32\MFC71.dll 2009-01-03 21:35 . 2003-09-18 14:32 499,712 --a------ c:\windows\system32\msvcp71.dll 2009-01-03 21:35 . 2003-09-18 14:32 348,160 --a------ c:\windows\system32\msvcr71.dll 2009-01-03 21:35 . 1998-11-13 13:10 307,200 --a------ c:\windows\IsUn0415.exe 2009-01-03 21:34 . 2009-01-03 21:34 <DIR> d--h----- c:\windows\system32\CanonIJ Uninstaller Information 2009-01-03 21:34 . 2009-01-03 21:34 <DIR> d--h----- c:\program files\CanonBJ 2009-01-03 21:34 . 2009-01-03 21:34 <DIR> d--h----- c:\documents and settings\All Users\Dane aplikacji\CanonBJ 2009-01-03 21:34 . 2006-04-24 06:00 161,792 --a------ c:\windows\system32\CNMLM84.DLL 2009-01-03 21:33 . 2009-01-03 21:37 <DIR> d-------- c:\program files\Canon 2009-01-01 19:49 . 2009-01-01 19:49 <DIR> d-------- c:\program files\Ubisoft 2008-12-30 14:58 . 2008-12-30 14:58 <DIR> d-------- c:\program files\Settlers 2008-12-30 03:16 . 2009-01-17 02:57 226 --a------ c:\windows\AWS.ini 2008-12-30 02:16 . 2008-12-30 02:16 <DIR> d-------- c:\program files\SkaWit 2008-12-29 17:39 . 2008-12-29 17:39 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\ATI 2008-12-29 17:27 . 2008-12-29 17:27 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\ATI 2008-12-29 16:58 . 2008-12-29 16:58 <DIR> d-------- c:\program files\Intel 2008-12-29 16:41 . 2008-12-29 16:41 <DIR> d--h----- c:\windows\PIF 2008-12-28 19:41 . 2008-12-28 19:41 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-27 15:51 . 2008-12-27 15:51 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\Gadu-Gadu 2008-12-27 15:48 . 2009-01-02 14:29 <DIR> d-------- c:\documents and settings\Kuba i Mama\Gadu-Gadu 2008-12-27 00:27 . 2008-12-27 00:27 <DIR> d-------- c:\windows\system32\LogFiles 2008-12-26 23:08 . 2008-12-26 23:08 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\Winamp 2008-12-26 21:09 . 2008-12-26 23:33 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\uTorrent 2008-12-26 15:36 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2008-12-26 15:36 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys 2008-12-26 14:32 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\drivers\bthport.sys 2008-12-26 14:32 . 2008-06-14 18:36 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-12-26 14:26 . 2008-08-14 14:26 2,190,464 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-12-26 14:26 . 2008-08-14 14:26 2,146,816 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-12-26 14:26 . 2008-08-14 14:26 2,067,328 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-12-26 14:26 . 2008-08-14 14:26 2,025,472 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-12-26 14:25 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-12-26 13:25 . 2005-06-28 10:21 22,752 --a------ c:\windows\system32\spupdsvc.exe 2008-12-25 00:06 . 2008-12-25 00:10 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\Mount&Blade 2008-12-25 00:04 . 2008-12-25 00:09 <DIR> d-------- c:\program files\Mount&Blade 2008-12-24 13:29 . 2008-12-24 13:29 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\Foxit 2008-12-24 13:24 . 2009-01-21 22:25 <DIR> d--h----- c:\documents and settings\Kuba i Mama\Ustawienia lokalne 2008-12-24 13:24 . 2008-12-24 13:24 <DIR> dr------- c:\documents and settings\Kuba i Mama\Ulubione 2008-12-24 13:24 . 2008-12-23 16:29 <DIR> d--h----- c:\documents and settings\Kuba i Mama\Szablony 2008-12-24 13:24 . 2009-01-17 20:57 <DIR> d-------- c:\documents and settings\Kuba i Mama\Pulpit 2008-12-24 13:24 . 2009-01-01 19:55 <DIR> dr------- c:\documents and settings\Kuba i Mama\Moje dokumenty 2008-12-24 13:24 . 2008-12-23 17:22 <DIR> dr------- c:\documents and settings\Kuba i Mama\Menu Start 2008-12-24 13:24 . 2008-12-29 17:39 <DIR> dr-h----- c:\documents and settings\Kuba i Mama\Dane aplikacji 2008-12-24 13:24 . 2008-12-27 15:48 <DIR> d-------- c:\documents and settings\Kuba i Mama 2008-12-24 12:26 . 2008-12-24 12:26 <DIR> d-------- c:\program files\ahead 2008-12-23 20:12 . 2008-12-23 20:12 <DIR> d-------- c:\program files\Valve 2008-12-23 20:11 . 2008-12-23 20:11 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\Gadu-Gadu 2008-12-23 19:39 . 2008-12-23 20:08 69 --a------ c:\windows\NeroDigital.ini 2008-12-23 19:06 . 2008-04-14 00:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-12-23 18:56 . 2008-12-24 12:14 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-23 18:52 . 2008-12-23 18:52 <DIR> d-------- c:\program files\uTorrent 2008-12-23 18:52 . 2009-01-18 11:49 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\uTorrent 2008-12-23 18:51 . 2008-12-23 18:52 <DIR> d-------- c:\program files\Winamp 2008-12-23 18:51 . 2008-12-23 18:51 <DIR> d-------- c:\program files\Real Alternative 2008-12-23 18:51 . 2008-12-23 18:51 <DIR> d-------- c:\program files\Media Player Classic 2008-12-23 18:51 . 2008-12-23 19:27 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\Winamp 2008-12-23 18:50 . 2008-12-23 19:51 <DIR> d-------- c:\program files\SubEdit-Player 2008-12-23 18:47 . 2008-12-28 19:11 <DIR> d-------- c:\program files\NAPI-PROJEKT 2008-12-23 18:44 . 2008-12-23 18:44 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-23 18:44 . 2008-12-28 20:54 <DIR> d-------- c:\documents and settings\Klop\Gadu-Gadu 2008-12-23 18:42 . 2008-12-23 18:42 <DIR> d-------- c:\windows\Logs 2008-12-23 18:42 . 2008-12-23 18:42 <DIR> d-------- c:\program files\Combined Community Codec Pack 2008-12-23 18:42 . 2008-12-23 18:42 <DIR> d-------- c:\program files\AVIcodec 2008-12-23 18:41 . 2006-05-03 11:57 520,192 --------- c:\windows\system32\ati2sgag.exe 2008-12-23 18:40 . 2008-12-29 17:24 <DIR> d-------- c:\program files\ATI Technologies 2008-12-23 18:39 . 2008-12-29 17:03 <DIR> d-------- c:\program files\Common Files\InstallShield 2008-12-23 18:39 . 2008-12-23 18:39 <DIR> d-------- C:\ATI 2008-12-23 18:38 . 2003-06-19 01:31 17,920 --a------ c:\windows\system32\mdimon.dll 2008-12-23 18:38 . 2008-12-29 17:58 421 --a------ c:\windows\ODBC.INI 2008-12-23 18:37 . 2008-12-23 18:37 <DIR> d-------- c:\windows\SHELLNEW 2008-12-23 18:37 . 2008-12-23 18:37 <DIR> d-------- c:\program files\Microsoft.NET . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-01 18:49 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-23 16:19 278,728 ----a-w c:\windows\system32\drivers\atksgt.sys 2008-12-23 16:19 25,416 ----a-w c:\windows\system32\drivers\lirsgt.sys 2008-12-23 16:13 --------- d-----w c:\documents and settings\Klop\Dane aplikacji\DAEMON Tools Pro 2008-12-23 16:13 --------- d-----w c:\documents and settings\Klop\Dane aplikacji\DAEMON Tools Lite 2008-12-23 16:13 --------- d-----w c:\documents and settings\Klop\Dane aplikacji\DAEMON Tools 2008-12-23 16:12 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-12-23 16:12 --------- d-----w c:\program files\DAEMON Tools Lite 2008-12-23 16:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite 2008-12-23 16:10 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-23 15:34 --------- d-----w c:\program files\microsoft frontpage 2008-12-23 15:32 --------- d-----w c:\program files\Usługi online 2008-12-23 15:29 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll . ------- Sigcheck ------- 2008-05-08 19:02 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-06-12 151552] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "d:\\Settlers VI\\base\\bin\\Settlers6.exe"= "c:\\Program Files\\Valve\\hl.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V - Tribes of the East\\bin\\H5_Game.exe"= R3 NeroCd2k;NeroCd2k;c:\windows\system32\drivers\NeroCD2k.sys [2001-04-16 44227] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{848920ee-d137-11dd-b343-000b6a595b2c}] \Shell\AutoRun\command - xlu8a8sy.exe \Shell\explore\Command - xlu8a8sy.exe \Shell\open\Command - xlu8a8sy.exe . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint – Dodaj do listy drukowania - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html IE: Easy-WebPrint – Drukuj - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html IE: Easy-WebPrint – Drukuj z dużą szybkością - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html IE: Easy-WebPrint – Podgląd - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html FF - ProfilePath - c:\documents and settings\Klop\Dane aplikacji\Mozilla\Firefox\Profiles\ver8f4h4.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-21 22:26:11 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(528) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2009-01-21 22:32:56 ComboFix-quarantined-files.txt 2009-01-21 21:32:45 Przed: 23,167,795,200 bajtów wolnych Po: 23,177,342,976 bajtów wolnych 179 --- E O F --- 2008-12-28 19:29:36

**Posty:** 8001 · przez **Okocza** 18 Sty 2009, 13:24

prokopek, popraw nazwe tematu i wstaw log z combofixa i hijacka w tagi code

**Posty:** 18165 · przez **wojtas** 18 Sty 2009, 20:57

daj loga z combofixa,.. napisz jaki proces Ci zżera procka,

**Posty:** 18 · przez **prokopek** 21 Sty 2009, 23:38

W tym problem ze żaden proces nie zżera mi proca

**Posty:** 8001 · przez **Okocza** 22 Sty 2009, 09:37

prokopek, wstaw log z combofixa

**Posty:** 18 · przez **prokopek** 22 Sty 2009, 09:57

jest wstawiony w 1 poscie

**Posty:** 8001 · przez **Okocza** 22 Sty 2009, 09:59

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 18 · przez **prokopek** 22 Sty 2009, 16:58

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Klop on 2009-01-22 at 15:45 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-22 15:52:40 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:01,17,f4,28,35,d7,0b,c5,98,d7,84,44,d1,30,8b,a4,d6,e7,29,82,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,25,04,ae,d2,f2,f4,6c,ad,25,4f,18,69,e3,ad,87,54,db,.. "khjeh"=hex:2d,dd,10,9f,63,d0,d2,a8,3a,19,4e,8e,63,6b,a1,b0,56,1e,0b,ff,71,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:7f,78,b3,fc,d3,92,5d,ae,6d,86,e1,95,75,10,9a,c9,b2,04,3c,b4,35,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:01,17,f4,28,35,d7,0b,c5,98,d7,84,44,d1,30,8b,a4,d6,e7,29,82,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,25,04,ae,d2,f2,f4,6c,ad,25,4f,18,69,e3,ad,87,54,db,.. "khjeh"=hex:2d,dd,10,9f,63,d0,d2,a8,3a,19,4e,8e,63,6b,a1,b0,56,1e,0b,ff,71,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:7f,78,b3,fc,d3,92,5d,ae,6d,86,e1,95,75,10,9a,c9,b2,04,3c,b4,35,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\Settlers VI\\base\\bin\\Settlers6.exe"="D:\\Settlers VI\\base\\bin\\Settlers6.exe:*:Enabled:THE SETTLERS - Rise of an Empire" "C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\Valve\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console" "C:\\Program Files\\Ubisoft\\Heroes of Might and Magic V - Tribes of the East\\bin\\H5_Game.exe"="C:\\Program Files\\Ubisoft\\Heroes of Might and Magic V - Tribes of the East\\bin\\H5_Game.exe:*:Disabled:Heroes of Might and Magic V" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 4 Oct 2004 417,792 A..H. --- "C:\Program Files\Canon\Canon Setup Utility 2.3\Maint.exe" Tue 11 May 2004 61,440 A..H. --- "C:\Program Files\Canon\Canon Setup Utility 2.3\uinstrsc.dll" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:57:55, on 2009-01-22 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint – Dodaj do listy drukowania - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint – Drukuj - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint – Drukuj z dużą szybkością - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint – Podgląd - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe -- End of file - 4315 bytes

Kod: Zaznacz wszystko: ComboFix 09-01-17.03 - Klop 2009-01-22 16:02:13.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.767.517 [GMT 1:00] Uruchomiony z: c:\documents and settings\Klop\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-22 do 2009-01-22 ))))))))))))))))))))))))))))))) . 2009-01-22 15:43 . 2009-01-22 15:43 <DIR> d-------- c:\windows\ERUNT 2009-01-22 15:34 . 2009-01-22 15:54 <DIR> d-------- C:\SDFix 2009-01-18 11:50 . 2009-01-18 11:50 <DIR> d-------- c:\program files\Trend Micro 2009-01-14 22:54 . 2009-01-18 13:55 <DIR> d-------- C:\do zrobienia 2009-01-09 22:56 . 2009-01-09 22:56 <DIR> d-------- c:\windows\system32\NtmsData 2009-01-03 23:05 . 2009-01-03 23:05 92 --a------ c:\windows\mp3wavcon.ini 2009-01-03 23:01 . 2009-01-03 23:01 <DIR> d-------- c:\program files\AudioToolsFactory 2009-01-03 23:01 . 2003-12-15 12:43 1,871,872 --a------ c:\windows\system32\NCTAudioFile2.dll 2009-01-03 23:01 . 2003-12-08 12:19 425,984 --a------ c:\windows\system32\NCTAudioTransform2.dll 2009-01-03 23:01 . 2002-01-05 14:37 344,064 --a------ c:\windows\system32\msvcr70.dll 2009-01-03 23:01 . 2003-08-07 14:01 237,568 --a------ c:\windows\system32\lame_enc.dll 2009-01-03 23:01 . 2003-12-15 12:24 196,608 --a------ c:\windows\system32\NCTWMAFile2.dll 2009-01-03 23:01 . 2003-12-08 12:49 116,304 --a------ c:\windows\system32\NCTWMAProfiles.prx 2009-01-03 23:01 . 2009-01-03 23:05 5 --a------ c:\windows\system32\SySmp3con.dat 2009-01-03 22:59 . 2009-01-03 22:59 <DIR> d-------- c:\program files\Audio Converter 2009-01-03 22:59 . 2009-01-03 23:01 <DIR> d-------- C:\My Music 2009-01-03 21:36 . 2004-01-14 02:10 163,840 --a------ c:\windows\BJPSUNST.EXE 2009-01-03 21:35 . 2003-09-18 14:32 1,060,864 --a------ c:\windows\system32\MFC71.dll 2009-01-03 21:35 . 2003-09-18 14:32 499,712 --a------ c:\windows\system32\msvcp71.dll 2009-01-03 21:35 . 2003-09-18 14:32 348,160 --a------ c:\windows\system32\msvcr71.dll 2009-01-03 21:35 . 1998-11-13 13:10 307,200 --a------ c:\windows\IsUn0415.exe 2009-01-03 21:34 . 2009-01-03 21:34 <DIR> d--h----- c:\windows\system32\CanonIJ Uninstaller Information 2009-01-03 21:34 . 2009-01-03 21:34 <DIR> d--h----- c:\program files\CanonBJ 2009-01-03 21:34 . 2009-01-03 21:34 <DIR> d--h----- c:\documents and settings\All Users\Dane aplikacji\CanonBJ 2009-01-03 21:34 . 2006-04-24 06:00 161,792 --a------ c:\windows\system32\CNMLM84.DLL 2009-01-03 21:33 . 2009-01-03 21:37 <DIR> d-------- c:\program files\Canon 2009-01-01 19:49 . 2009-01-01 19:49 <DIR> d-------- c:\program files\Ubisoft 2008-12-30 14:58 . 2008-12-30 14:58 <DIR> d-------- c:\program files\Settlers 2008-12-30 03:16 . 2009-01-22 01:16 226 --a------ c:\windows\AWS.ini 2008-12-30 02:16 . 2008-12-30 02:16 <DIR> d-------- c:\program files\SkaWit 2008-12-29 17:39 . 2008-12-29 17:39 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\ATI 2008-12-29 17:27 . 2008-12-29 17:27 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\ATI 2008-12-29 16:58 . 2008-12-29 16:58 <DIR> d-------- c:\program files\Intel 2008-12-29 16:41 . 2008-12-29 16:41 <DIR> d--h----- c:\windows\PIF 2008-12-28 19:41 . 2008-12-28 19:41 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-27 15:51 . 2008-12-27 15:51 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\Gadu-Gadu 2008-12-27 15:48 . 2009-01-02 14:29 <DIR> d-------- c:\documents and settings\Kuba i Mama\Gadu-Gadu 2008-12-27 00:27 . 2008-12-27 00:27 <DIR> d-------- c:\windows\system32\LogFiles 2008-12-26 23:08 . 2008-12-26 23:08 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\Winamp 2008-12-26 21:09 . 2008-12-26 23:33 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\uTorrent 2008-12-26 15:36 . 2008-04-14 00:17 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2008-12-26 15:36 . 2008-04-14 00:17 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys 2008-12-26 14:32 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\drivers\bthport.sys 2008-12-26 14:32 . 2008-06-14 18:36 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-12-26 14:26 . 2008-08-14 14:26 2,190,464 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-12-26 14:26 . 2008-08-14 14:26 2,146,816 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-12-26 14:26 . 2008-08-14 14:26 2,067,328 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-12-26 14:26 . 2008-08-14 14:26 2,025,472 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-12-26 14:25 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-12-26 13:25 . 2005-06-28 10:21 22,752 --a------ c:\windows\system32\spupdsvc.exe 2008-12-25 00:06 . 2008-12-25 00:10 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\Mount&Blade 2008-12-25 00:04 . 2008-12-25 00:09 <DIR> d-------- c:\program files\Mount&Blade 2008-12-24 13:29 . 2008-12-24 13:29 <DIR> d-------- c:\documents and settings\Kuba i Mama\Dane aplikacji\Foxit 2008-12-24 13:24 . 2009-01-22 16:08 <DIR> d--h----- c:\documents and settings\Kuba i Mama\Ustawienia lokalne 2008-12-24 13:24 . 2008-12-24 13:24 <DIR> dr------- c:\documents and settings\Kuba i Mama\Ulubione 2008-12-24 13:24 . 2008-12-23 16:29 <DIR> d--h----- c:\documents and settings\Kuba i Mama\Szablony 2008-12-24 13:24 . 2009-01-17 20:57 <DIR> d-------- c:\documents and settings\Kuba i Mama\Pulpit 2008-12-24 13:24 . 2009-01-01 19:55 <DIR> dr------- c:\documents and settings\Kuba i Mama\Moje dokumenty 2008-12-24 13:24 . 2008-12-23 17:22 <DIR> dr------- c:\documents and settings\Kuba i Mama\Menu Start 2008-12-24 13:24 . 2008-12-29 17:39 <DIR> dr-h----- c:\documents and settings\Kuba i Mama\Dane aplikacji 2008-12-24 13:24 . 2008-12-27 15:48 <DIR> d-------- c:\documents and settings\Kuba i Mama 2008-12-24 12:26 . 2008-12-24 12:26 <DIR> d-------- c:\program files\ahead 2008-12-23 20:12 . 2008-12-23 20:12 <DIR> d-------- c:\program files\Valve 2008-12-23 20:11 . 2008-12-23 20:11 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\Gadu-Gadu 2008-12-23 19:39 . 2008-12-23 20:08 69 --a------ c:\windows\NeroDigital.ini 2008-12-23 19:06 . 2008-04-14 00:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-12-23 18:56 . 2008-12-24 12:14 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-23 18:52 . 2008-12-23 18:52 <DIR> d-------- c:\program files\uTorrent 2008-12-23 18:52 . 2009-01-18 11:49 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\uTorrent 2008-12-23 18:51 . 2008-12-23 18:52 <DIR> d-------- c:\program files\Winamp 2008-12-23 18:51 . 2008-12-23 18:51 <DIR> d-------- c:\program files\Real Alternative 2008-12-23 18:51 . 2008-12-23 18:51 <DIR> d-------- c:\program files\Media Player Classic 2008-12-23 18:51 . 2008-12-23 19:27 <DIR> d-------- c:\documents and settings\Klop\Dane aplikacji\Winamp 2008-12-23 18:50 . 2008-12-23 19:51 <DIR> d-------- c:\program files\SubEdit-Player 2008-12-23 18:47 . 2008-12-28 19:11 <DIR> d-------- c:\program files\NAPI-PROJEKT 2008-12-23 18:44 . 2008-12-23 18:44 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-23 18:44 . 2008-12-28 20:54 <DIR> d-------- c:\documents and settings\Klop\Gadu-Gadu 2008-12-23 18:42 . 2008-12-23 18:42 <DIR> d-------- c:\windows\Logs 2008-12-23 18:42 . 2008-12-23 18:42 <DIR> d-------- c:\program files\Combined Community Codec Pack 2008-12-23 18:42 . 2008-12-23 18:42 <DIR> d-------- c:\program files\AVIcodec 2008-12-23 18:41 . 2006-05-03 11:57 520,192 --------- c:\windows\system32\ati2sgag.exe 2008-12-23 18:40 . 2008-12-29 17:24 <DIR> d-------- c:\program files\ATI Technologies 2008-12-23 18:39 . 2008-12-29 17:03 <DIR> d-------- c:\program files\Common Files\InstallShield 2008-12-23 18:39 . 2008-12-23 18:39 <DIR> d-------- C:\ATI 2008-12-23 18:38 . 2003-06-19 01:31 17,920 --a------ c:\windows\system32\mdimon.dll 2008-12-23 18:38 . 2008-12-29 17:58 421 --a------ c:\windows\ODBC.INI 2008-12-23 18:37 . 2008-12-23 18:37 <DIR> d-------- c:\windows\SHELLNEW 2008-12-23 18:37 . 2008-12-23 18:37 <DIR> d-------- c:\program files\Microsoft.NET . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-01 18:49 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-23 16:19 278,728 ----a-w c:\windows\system32\drivers\atksgt.sys 2008-12-23 16:19 25,416 ----a-w c:\windows\system32\drivers\lirsgt.sys 2008-12-23 16:13 --------- d-----w c:\documents and settings\Klop\Dane aplikacji\DAEMON Tools Pro 2008-12-23 16:13 --------- d-----w c:\documents and settings\Klop\Dane aplikacji\DAEMON Tools Lite 2008-12-23 16:13 --------- d-----w c:\documents and settings\Klop\Dane aplikacji\DAEMON Tools 2008-12-23 16:12 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-12-23 16:12 --------- d-----w c:\program files\DAEMON Tools Lite 2008-12-23 16:12 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite 2008-12-23 16:10 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-12-23 15:34 --------- d-----w c:\program files\microsoft frontpage 2008-12-23 15:32 --------- d-----w c:\program files\Usługi online 2008-12-23 15:29 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll . ------- Sigcheck ------- 2008-05-08 19:02 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot@2009-01-21_22.28.49.48 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2009-01-22 14:43:32 2,322,432 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2009-01-22 14:43:32 20,480 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2009-01-22 14:43:25 2,322,432 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2009-01-22 14:43:25 20,480 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-06-12 151552] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "d:\\Settlers VI\\base\\bin\\Settlers6.exe"= "c:\\Program Files\\Valve\\hl.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= "c:\\Program Files\\Ubisoft\\Heroes of Might and Magic V - Tribes of the East\\bin\\H5_Game.exe"= R3 NeroCd2k;NeroCd2k;c:\windows\system32\drivers\NeroCD2k.sys [2001-04-16 44227] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{848920ee-d137-11dd-b343-000b6a595b2c}] \Shell\AutoRun\command - xlu8a8sy.exe \Shell\explore\Command - xlu8a8sy.exe \Shell\open\Command - xlu8a8sy.exe . . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint – Dodaj do listy drukowania - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html IE: Easy-WebPrint – Drukuj - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html IE: Easy-WebPrint – Drukuj z dużą szybkością - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html IE: Easy-WebPrint – Podgląd - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html FF - ProfilePath - c:\documents and settings\Klop\Dane aplikacji\Mozilla\Firefox\Profiles\ver8f4h4.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-22 16:08:59 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(524) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2009-01-22 16:13:06 ComboFix-quarantined-files.txt 2009-01-22 15:12:28 ComboFix2.txt 2009-01-21 21:33:02 Przed: 22 443 335 680 bajtów wolnych Po: 22,434,643,968 bajtów wolnych 187 --- E O F --- 2008-12-28 19:29:36

**Posty:** 18165 · przez **wojtas** 22 Sty 2009, 17:10

wstaw screena z menadzera zadan .. bo nic nie widać

**Posty:** 18 · przez **prokopek** 22 Sty 2009, 17:22

http://img530.imageshack.us/my.php?image=beztytuuzd5.png

**Posty:** 8001 · przez **Okocza** 22 Sty 2009, 17:24

przeinstaluj sterowniki. a później:

start - uruchom - msconfig - odznacz WSZYSTKO co będzie z ATI

Autor postu otrzymał pochwałę

**Posty:** 18165 · przez **wojtas** 22 Sty 2009, 17:25

wejdz do konsoli odzyskiwania i wpisz

expand X:\i386\spoolsv.ex_ C:\WINDOWS\system32

a jak nie działa

expand X:\i386\spoolsv.ex_ C:\WINDOWS\system32\explorer.exe

X - literka Twojego napedu..

i reset kompa

Autor postu otrzymał pochwałę

**Posty:** 18 · przez **prokopek** 22 Sty 2009, 23:45

Panowie, nic z tych rzeczy nie pomogło. Sformatowałem cały dysk i już jest normalnie. Dziękuje za wszystko.