'mulenie' komputera, duże zużycie processora..

[at]

przychodząc sobie ze szkoły włączyłem komputer... czekam, czekam aż pasek windowsa sie zaladuje, ale trwało to tak długo, że zresetowalem komputer. Za drugim razem udało się! komputer się włączył, ale tak się zwieszał jak nigdy. Włączyłem foobara a tam zamiast leciec muzyka, to to loopoje kawałki, w ogole sluchac sie nie da. Duże zużycie processora.

log RSIT

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Ferson at 2009-10-08 13:54:59
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive G: has 444 MB (3%) free of 15 GB
Total RAM: 1023 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:55:12, on 2009-10-08
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Java\jre6\bin\jusched.exe
G:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
G:\WINDOWS\regx32.exe
G:\WINDOWS\RTHDCPL.EXE
G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
G:\Program Files\Winamp\winampa.exe
G:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
G:\Program Files\Cyberlink\Shared Files\brs.exe
G:\Program Files\DialNet\winpppoverethernet.exe
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Gadu-Gadu\gg.exe
G:\Program Files\DAEMON Tools Lite\daemon.exe
G:\Program Files\DNA\btdna.exe
G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
G:\Program Files\Java\jre6\bin\jqs.exe
G:\WINDOWS\system32\PnkBstrA.exe
G:\Program Files\DialNet\WrOS.EXE
G:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
G:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe
G:\WINDOWS\system32\NOTEPAD.EXE
D:\programosy\RSIT.exe
G:\Program Files\Trend Micro\HijackThis\Ferson.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - G:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "G:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrialReset] G:\WINDOWS\regx32.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OutpostMonitor] G:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "G:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [RemoteControl8] "G:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "G:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] G:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [a-winpoet-service] "G:\Program Files\DialNet\winpppoverethernet.exe"
O4 - HKLM\..\Run: [] "G:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT"
O4 - HKLM\..\Run: [z-WrDialer] "G:\Program Files\DialNet\wrdialer.exe"
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "G:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "G:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BitTorrent DNA] "G:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://G:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Ustawienia Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - G:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC5508A1-6804-478C-AD40-EBDF2EB217C4}: NameServer = 217.30.129.149 217.30.137.200
O20 - AppInit_DLLs: g:\progra~1\agnitum\outpos~1\wl_hook.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - G:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - G:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - G:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - G:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PnkBstrA - Unknown owner - G:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - G:\Program Files\DialNet\WrOS.EXE

--
End of file - 7700 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - G:\Program Files\Java\jre6\bin\ssv.dll [2009-01-18 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - G:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-18 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - G:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-18 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=G:\Program Files\Java\jre6\bin\jusched.exe [2009-01-18 136600]
"Adobe Reader Speed Launcher"=G:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"egui"=G:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2008-08-18 1447168]
"TrialReset"=G:\WINDOWS\regx32.exe [2008-07-03 285327]
"RTHDCPL"=G:\WINDOWS\RTHDCPL.EXE [2005-05-25 14477312]
"Alcmtr"=G:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"StartCCC"=G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"NeroFilterCheck"=G:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"OutpostMonitor"=G:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe [2008-08-22 1157448]
"OutpostFeedBack"=G:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe [2008-08-05 435528]
"WinampAgent"=G:\Program Files\Winamp\winampa.exe [2008-08-04 36352]
"RemoteControl8"=G:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [2008-03-20 83240]
"PDVD8LanguageShortcut"=G:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [2007-12-14 50472]
"BDRegion"=G:\Program Files\Cyberlink\Shared Files\brs.exe [2008-03-21 91432]
"KernelFaultCheck"=G:\WINDOWS\system32\dumprep 0 -k []
"a-winpoet-service"=G:\Program Files\DialNet\winpppoverethernet.exe [2007-07-06 405504]
""=G:\PROGRA~1\DialNet\FPLICE~1.EXE [2007-07-04 110592]
"z-WrDialer"=G:\Program Files\DialNet\wrdialer.exe [2007-07-11 561152]
"TkBellExe"=G:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-09-23 198160]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=G:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]
"Gadu-Gadu"=G:\Program Files\Gadu-Gadu\gg.exe [2008-10-12 2127296]
"DAEMON Tools Lite"=G:\Program Files\DAEMON Tools Lite\daemon.exe [2008-03-21 486856]
"BitTorrent DNA"=G:\Program Files\DNA\btdna.exe [2009-01-26 342848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="g:\progra~1\agnitum\outpos~1\wl_hook.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
G:\WINDOWS\system32\Ati2evxx.dll [2007-12-18 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
G:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - G:\WINDOWS\system32\wpdshserviceobj.dll [2008-11-20 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"G:\Program Files\uTorrent\utorrent.exe"="G:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"G:\Program Files\Winamp Remote\bin\Orb.exe"="G:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"G:\Program Files\Winamp Remote\bin\OrbTray.exe"="G:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"G:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="G:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"G:\Program Files\DNA\btdna.exe"="G:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"G:\Program Files\BitTorrent\bittorrent.exe"="G:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"G:\WINDOWS\system32\PnkBstrA.exe"="G:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"G:\WINDOWS\system32\PnkBstrB.exe"="G:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.reg - open - "regedit.exe" "%1"

======List of files/folders created in the last 1 months======

2009-10-08 13:54:59 ----D---- G:\rsit
2009-10-06 18:55:16 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\gtk-2.0
2009-10-06 18:52:00 ----D---- G:\Program Files\GIMP-2.7
2009-10-05 00:02:30 ----D---- G:\WINDOWS\system32\Adobe
2009-10-01 14:47:03 ----D---- G:\Program Files\AMR to MP3 Converter
2009-10-01 14:44:39 ----AD---- G:\Documents and Settings\All Users\Dane aplikacji\TEMP
2009-09-30 01:25:02 ----D---- G:\Program Files\SHOUTcast
2009-09-23 21:03:14 ----A---- G:\WINDOWS\cdplayer.ini
2009-09-17 21:02:43 ----D---- G:\Program Files\DialNet
2009-09-17 21:02:22 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\InstallShield
2009-09-13 15:13:57 ----D---- G:\WINDOWS\Easy CD-DA Extractor
2009-09-13 15:13:57 ----D---- G:\Program Files\Easy CD-DA Extractor 10
2009-09-12 09:00:56 ----D---- G:\Program Files\Magic Audio Converter
2009-09-10 06:42:36 ----HDC---- G:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-10 06:42:28 ----HDC---- G:\WINDOWS\$NtUninstallKB956844$
2009-09-10 06:42:17 ----HDC---- G:\WINDOWS\$NtUninstallKB971961$

======List of files/folders modified in the last 1 months======

2009-10-08 13:55:04 ----D---- G:\WINDOWS\Prefetch
2009-10-08 13:54:44 ----D---- G:\WINDOWS\Temp
2009-10-08 13:50:32 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\DNA
2009-10-08 13:42:05 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\foobar2000
2009-10-08 13:40:33 ----D---- G:\WINDOWS\system32\Lang
2009-10-08 13:40:30 ----D---- G:\Program Files\DNA
2009-10-08 13:40:30 ----A---- G:\WINDOWS\WinPoET_Runtime.txt
2009-10-08 13:34:54 ----A---- G:\WINDOWS\win.ini
2009-10-08 13:34:52 ----A---- G:\WINDOWS\SchedLgU.Txt
2009-10-08 07:10:41 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\uTorrent
2009-10-08 04:48:37 ----A---- G:\WINDOWS\NeroDigital.ini
2009-10-07 23:32:28 ----D---- G:\WINDOWS\system32\Filt
2009-10-07 16:49:43 ----SD---- G:\Documents and Settings\Ferson\Dane aplikacji\Microsoft
2009-10-06 18:52:00 ----RD---- G:\Program Files
2009-10-06 14:14:55 ----A---- G:\WINDOWS\system.ini
2009-10-05 00:09:04 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\Adobe
2009-10-05 00:02:35 ----SD---- G:\WINDOWS\Downloaded Program Files
2009-10-05 00:02:34 ----D---- G:\WINDOWS\system32\CatRoot2
2009-10-05 00:02:30 ----D---- G:\WINDOWS\system32
2009-10-01 22:45:18 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\mIRC
2009-10-01 17:55:58 ----D---- G:\Program Files\mIRC
2009-10-01 14:45:15 ----D---- G:\WINDOWS
2009-09-30 01:25:23 ----D---- G:\Program Files\Winamp
2009-09-23 20:53:52 ----D---- G:\Documents and Settings\All Users\Dane aplikacji\Real
2009-09-23 20:49:29 ----D---- G:\Program Files\Common Files\Real
2009-09-23 20:49:26 ----A---- G:\WINDOWS\system32\rmoc3260.dll
2009-09-23 20:49:19 ----A---- G:\WINDOWS\system32\pndx5032.dll
2009-09-23 20:49:19 ----A---- G:\WINDOWS\system32\pndx5016.dll
2009-09-23 20:49:15 ----D---- G:\Documents and Settings\Ferson\Dane aplikacji\Real
2009-09-23 20:49:04 ----A---- G:\WINDOWS\system32\pncrt.dll
2009-09-23 20:49:04 ----A---- G:\WINDOWS\system32\msvcp71.dll
2009-09-19 22:56:55 ----D---- G:\Program Files\Mozilla Firefox
2009-09-18 18:24:05 ----D---- G:\WINDOWS\system32\config
2009-09-17 21:03:24 ----A---- G:\WINDOWS\winpoet_postinstallation.txt
2009-09-17 21:03:22 ----D---- G:\WINDOWS\system32\drivers
2009-09-17 21:02:41 ----HD---- G:\Program Files\InstallShield Installation Information
2009-09-17 21:02:27 ----A---- G:\WINDOWS\winpoet_preinstallation.txt
2009-09-15 19:48:34 ----HD---- G:\WINDOWS\inf
2009-09-15 19:47:12 ----D---- G:\WINDOWS\Minidump
2009-09-10 06:42:39 ----D---- G:\WINDOWS\system32\dllcache
2009-09-10 06:42:32 ----A---- G:\WINDOWS\imsins.BAK
2009-09-10 06:42:27 ----HD---- G:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; G:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-08-18 53256]
R1 epfwtdir;epfwtdir; G:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-08-18 34312]
R1 intelppm;Sterownik procesora Intel; G:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-15 40448]
R1 SandBox;SandBox; G:\WINDOWS\system32\DRIVERS\SandBox.sys [2008-07-11 673920]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\G:\Program Files\CyberLink\PowerDVD8\000.fcl []
R2 eamon;EAMON; G:\WINDOWS\system32\DRIVERS\eamon.sys [2008-08-18 39944]
R2 TopWinPoETDriver;WinPoET PPPoE Optimized Driver; G:\WINDOWS\system32\DRIVERS\WrKPoET2000.sys [2007-07-04 52214]
R3 afw;Agnitum firewall driver; G:\WINDOWS\system32\DRIVERS\afw.sys [2008-06-30 30864]
R3 afwcore;afwcore; G:\WINDOWS\system32\drivers\afwcore.sys [2008-06-30 234640]
R3 ati2mtag;ati2mtag; G:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-12-18 2849280]
R3 FPD;Fine Point Packet Service; \??\G:\WINDOWS\system32\drivers\fpd.sys []
R3 HdAudAddService;ATI Function Driver for High Definition Audio Service; G:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
R3 HDAudBus;Sterownik magistrali Microsoft UAA dla High Definition Audio; G:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-15 144384]
R3 HidUsb;Sterownik Microsoft klasy HID; G:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); G:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-05-25 3134976]
R3 MTsensor;ATK0110 ACPI UTILITY; G:\WINDOWS\system32\DRIVERS\ASACPI.sys [2008-11-20 5810]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; G:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Koncentrator z obsługą USB2; G:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; G:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 WrKPoET2000;WrKPoET2000; \??\G:\Program Files\DialNet\WrKPoET2000.sys []
R3 WRSWanDD;WinPoET PPPoE Adapter; G:\WINDOWS\system32\DRIVERS\WrKPoETNic2000.sys [2007-07-04 65604]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; G:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-05-06 232064]
S3 adn5h2ua;adn5h2ua; G:\WINDOWS\system32\drivers\adn5h2ua.sys []
S3 ASWFilt;ASWFilt; G:\WINDOWS\system32\Filt\ASWFilt.dll [2008-07-11 33408]
S3 USBSTOR;Sterownik magazynu masowego USB; G:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; G:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-11-20 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; G:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-11-20 82944]
S4 IntelIde;IntelIde; G:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 acssrv;Agnitum Client Security Service; G:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe [2008-08-05 1238344]
R2 Ati HotKey Poller;Ati HotKey Poller; G:\WINDOWS\system32\Ati2evxx.exe [2007-12-18 512000]
R2 ekrn;Eset Service; G:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
R2 JavaQuickStarterService;Java Quick Starter; G:\Program Files\Java\jre6\bin\jqs.exe [2009-01-18 152984]
R2 PnkBstrA;PnkBstrA; G:\WINDOWS\system32\PnkBstrA.exe [2009-03-04 70968]
R2 WinPPPoverEthernet;WinPPPoverEthernet; G:\Program Files\DialNet\WrOS.EXE [2007-07-04 135168]
S3 aspnet_state;ASP.NET State Service; G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; g:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;Eset HTTP Server; G:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2008-08-18 19200]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; g:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; g:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; G:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; G:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; G:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; G:\WINDOWS\system32\svchost.exe [2008-04-15 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; g:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------


[Okocza]

at, daj log z Combofixa

[Aselfer]

Niestety, ale możesz mieć zepsuty twardy dysk.
Ja tak samo miałem (za drugim razem się włączył, za trzecim itp, czekałem ponad godzine i nic).
Jeżeli masz zepsuty twardy dysk lepiej zgraj co ważne na płyty.

[tomj]

zainstaluj i uaktualnij AVZ ANTIVIRAL TOOLKIT

[at]

Kod: Zaznacz wszystko

ComboFix 09-10-07.05 - Ferson 2009-10-08 20:11.2.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.1023.555 [GMT 2:00]
Uruchomiony z: *:\documents and settings\Ferson\Pulpit\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Outpost Firewall Pro *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
* Rezydentny antywirus jest aktywny

.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

g:\windows\system32\drivers\ati0qaxx.sys
g:\windows\system32\drivers\ati2xhxx.sys
g:\windows\system32\drivers\ati4irxx.sys
g:\windows\system32\drivers\clbdriver.sys
g:\windows\system32\drivers\ctl_w32.sys
g:\windows\system32\drivers\grande48.sys
g:\windows\system32\drivers\lojlig.sys
g:\windows\system32\drivers\mgcscrd.sys
g:\windows\system32\drivers\mrxdavv.sys
g:\windows\system32\drivers\msliksurserv.sys
g:\windows\system32\drivers\msvtch.sys
g:\windows\system32\drivers\ntndis.sys
g:\windows\system32\drivers\parport32.sys
g:\windows\system32\drivers\qandr.sys
g:\windows\system32\drivers\resdr32.sys
g:\windows\system32\drivers\reveal32.sys
g:\windows\system32\drivers\seneka.sys
g:\windows\system32\drivers\SROUTE.SYS
g:\windows\system32\drivers\ss.sys
g:\windows\system32\drivers\str.sys
g:\windows\system32\drivers\symavc32.sys
g:\windows\system32\drivers\tdlserv.sys
g:\windows\system32\drivers\TPLinks.sys
g:\windows\system32\drivers\wsnpoem.sys

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-09-08 do 2009-10-08  )))))))))))))))))))))))))))))))
.

2009-10-08 17:56 . 2009-10-08 17:56   --------   d-----w-   g:\windows\system32\xircom
2009-10-08 17:56 . 2009-10-08 17:56   --------   d-----w-   g:\windows\system32\wbem\snmp
2009-10-08 17:56 . 2009-10-08 17:56   --------   d-----w-   g:\program files\microsoft frontpage
2009-10-08 17:52 . 2009-10-08 17:52   --------   d-----w-   G:\found.000
2009-10-08 11:54 . 2009-10-08 11:55   --------   d-----w-   G:\rsit
2009-10-06 16:55 . 2009-10-06 16:55   --------   d-----w-   g:\documents and settings\Ferson\Dane aplikacji\gtk-2.0
2009-10-06 16:52 . 2009-10-06 16:55   --------   d-----w-   g:\documents and settings\Ferson\.gimp-2.7
2009-10-06 16:52 . 2009-10-06 16:52   --------   d-----w-   g:\program files\GIMP-2.7
2009-10-04 22:02 . 2009-10-04 22:08   --------   d-----w-   g:\windows\system32\Adobe
2009-10-01 12:47 . 2009-10-01 12:47   --------   d-----w-   g:\program files\AMR to MP3 Converter
2009-10-01 12:44 . 2009-10-01 12:53   --------   d---a-w-   g:\documents and settings\All Users\Dane aplikacji\TEMP
2009-09-29 23:25 . 2009-09-30 00:35   --------   d-----w-   g:\program files\SHOUTcast
2009-09-17 19:03 . 2007-07-04 14:27   30336   ----a-w-   g:\windows\system32\drivers\fpd.sys
2009-09-17 19:02 . 2009-10-08 18:36   --------   d-----w-   g:\program files\DialNet
2009-09-17 19:02 . 2009-09-17 19:02   --------   d-----w-   g:\documents and settings\Ferson\Dane aplikacji\InstallShield
2009-09-13 13:13 . 2009-09-13 13:16   --------   d-----w-   g:\program files\Easy CD-DA Extractor 10
2009-09-13 13:13 . 2009-09-13 13:13   --------   d-----w-   g:\windows\Easy CD-DA Extractor
2009-09-12 07:00 . 2009-09-12 07:01   --------   d-----w-   g:\program files\Magic Audio Converter
2009-09-09 20:32 . 2009-06-21 21:48   153088   ------w-   g:\windows\system32\dllcache\triedit.dll
2009-09-09 20:32 . 2009-08-13 15:04   512000   ------w-   g:\windows\system32\dllcache\jscript.dll

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-08 20:45 . 2009-01-26 18:30   --------   d-----w-   g:\program files\DNA
2009-10-08 20:45 . 2009-01-26 18:30   --------   d-----w-   g:\documents and settings\Ferson\Dane aplikacji\DNA
2009-10-08 18:07 . 2009-01-18 22:02   --------   d-----w-   g:\documents and settings\Ferson\Dane aplikacji\foobar2000
2009-10-08 05:10 . 2009-01-18 22:11   --------   d-----w-   g:\documents and settings\Ferson\Dane aplikacji\uTorrent
2009-10-01 20:45 . 2009-01-18 22:56   --------   d-----w-   g:\documents and settings\Ferson\Dane aplikacji\mIRC
2009-10-01 15:55 . 2009-01-18 22:56   --------   d-----w-   g:\program files\mIRC
2009-09-29 23:25 . 2009-01-21 18:43   --------   d-----w-   g:\program files\Winamp
2009-09-23 18:49 . 2009-01-22 23:22   --------   d-----w-   g:\program files\Common Files\Real
2009-09-23 18:49 . 2009-01-24 03:25   499712   ----a-w-   g:\windows\system32\msvcp71.dll
2009-09-17 19:02 . 2009-01-18 21:34   --------   d--h--w-   g:\program files\InstallShield Installation Information
2009-09-05 23:27 . 2009-01-19 11:27   --------   d-----w-   g:\program files\Native Instruments
2009-09-05 23:27 . 2009-07-29 10:30   --------   d-----w-   g:\program files\Common Files\Native Instruments
2009-09-05 23:27 . 2009-07-02 07:39   --------   d-----w-   g:\program files\VstPlugins
2009-08-23 09:47 . 2009-08-10 18:05   --------   d-----w-   g:\documents and settings\All Users\Dane aplikacji\Skype
2009-08-23 09:47 . 2009-08-18 20:40   --------   d-----w-   g:\program files\Softick
2009-08-23 09:43 . 2009-08-10 18:07   --------   d-----w-   g:\documents and settings\Ferson\Dane aplikacji\skypePM
2009-08-14 14:07 . 2009-01-18 21:50   43752   ----a-w-   g:\documents and settings\Ferson\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-08-14 10:52 . 2008-04-15 11:00   88618   ----a-w-   g:\windows\system32\perfc015.dat
2009-08-14 10:52 . 2008-04-15 11:00   499958   ----a-w-   g:\windows\system32\perfh015.dat
2009-08-14 08:30 . 2009-01-20 14:11   --------   d-----w-   g:\program files\coolpro2
2009-08-10 18:07 . 2009-08-10 18:07   56   ---ha-w-   g:\windows\system32\ezsidmv.dat
2009-08-05 09:01 . 2008-04-15 11:00   205312   ----a-w-   g:\windows\system32\mswebdvd.dll
2009-07-17 19:04 . 2008-04-15 11:00   58880   ----a-w-   g:\windows\system32\atl.dll
2009-07-13 21:43 . 2008-11-20 21:07   286208   ----a-w-   g:\windows\system32\wmpdxm.dll
2009-02-24 19:34 . 2009-02-24 19:34   1044480   ----a-w-   g:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34   200704   ----a-w-   g:\program files\mozilla firefox\plugins\ssldivx.dll
2009-02-24 19:34 . 2009-02-24 19:34   1044480   ----a-w-   g:\program files\opera\program\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34   200704   ----a-w-   g:\program files\opera\program\plugins\ssldivx.dll
.

------- Sigcheck -------

[-] 2008-11-20 . 0940D662B2E96A46421BC7B46DE95905 . 361600 . . [5.1.2600.5625] . . g:\windows\system32\drivers\tcpip.sys

[-] 2008-08-17 . F042E3426D45D86D9BB55F6A79AB441A . 977408 . . [6.00.2900.5512] . . g:\windows\explorer.exe
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="g:\program files\Gadu-Gadu\gg.exe" [2008-10-12 2127296]
"DAEMON Tools Lite"="g:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-21 486856]
"BitTorrent DNA"="g:\program files\DNA\btdna.exe" [2009-01-26 342848]
"ctfmon.exe"="g:\windows\system32\ctfmon.exe" [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="g:\program files\Java\jre6\bin\jusched.exe" [2009-01-18 136600]
"Adobe Reader Speed Launcher"="g:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"egui"="g:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"TrialReset"="g:\windows\regx32.exe" [2008-07-03 285327]
"StartCCC"="g:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"NeroFilterCheck"="g:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"OutpostMonitor"="g:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2008-08-22 1157448]
"OutpostFeedBack"="g:\program files\Agnitum\Outpost Firewall Pro\feedback.exe" [2008-08-05 435528]
"WinampAgent"="g:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"RemoteControl8"="g:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="g:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="g:\program files\Cyberlink\Shared Files\brs.exe" [2008-03-21 91432]
"a-winpoet-service"="g:\program files\DialNet\winpppoverethernet.exe" [2007-07-06 405504]
"z-WrDialer"="g:\program files\DialNet\wrdialer.exe" [2007-07-11 561152]
"TkBellExe"="g:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-23 198160]
"RTHDCPL"="RTHDCPL.EXE" - g:\windows\RTHDCPL.EXE [2005-05-25 14477312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="g:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
"_nltide_3"="advpack.dll" - g:\windows\system32\advpack.dll [2009-06-29 124928]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"g:\\Program Files\\uTorrent\\utorrent.exe"=
"g:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"g:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"g:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"g:\\Program Files\\DNA\\btdna.exe"=
"g:\\WINDOWS\\system32\\PnkBstrA.exe"=
"g:\\WINDOWS\\system32\\PnkBstrB.exe"=

R1 epfwtdir;epfwtdir;g:\windows\system32\drivers\epfwtdir.sys [2008-08-18 34312]
R1 SandBox;SandBox;g:\windows\system32\drivers\SandBox.sys [2009-01-19 673920]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};g:\program files\CyberLink\PowerDVD8\000.fcl [2008-02-01 41456]
R2 acssrv;Agnitum Client Security Service;g:\progra~1\Agnitum\OUTPOS~1\acs.exe [2009-01-19 1238344]
R2 ekrn;Eset Service;g:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
R2 TopWinPoETDriver;WinPoET PPPoE Optimized Driver;g:\windows\system32\drivers\WrKPoET2000.sys [2009-02-09 52214]
R3 afw;Agnitum firewall driver;g:\windows\system32\drivers\afw.sys [2009-01-19 30864]
R3 afwcore;afwcore;g:\windows\system32\drivers\afwcore.sys [2009-01-19 234640]
R3 FPD;Fine Point Packet Service;g:\windows\system32\drivers\fpd.sys [2009-09-17 30336]
R3 WrKPoET2000;WrKPoET2000;g:\program files\DialNet\WrKPoET2000.sys [2009-09-17 52214]
R3 WRSWanDD;WinPoET PPPoE Adapter;g:\windows\system32\drivers\WrKPoETNic2000.sys [2009-02-09 65604]
S3 ASWFilt;ASWFilt;g:\windows\system32\Filt\ASWFilt.dll [2009-01-19 33408]
.
.
------- Skan uzupełniający -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: E&ksportuj do programu Microsoft Excel - g:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: {AC5508A1-6804-478C-AD40-EBDF2EB217C4} = 217.30.129.149 217.30.137.200
DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} - hxxp://www.eska.pl/streamplayers/OggX.ocx
FF - ProfilePath - g:\documents and settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\
FF - component: g:\documents and settings\Ferson\Dane aplikacji\Mozilla\Firefox\Profiles\rt3a685b.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - plugin: g:\documents and settings\Ferson\Dane aplikacji\Mozilla\plugins\npoctoshape.dll
FF - plugin: g:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: g:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: g:\program files\Opera\program\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - g:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-08 22:45
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\g:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(976)
g:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(672)
g:\windows\system32\WININET.dll
g:\windows\system32\wpdshserviceobj.dll
g:\windows\system32\portabledevicetypes.dll
g:\windows\system32\portabledeviceapi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
SystemRoot\System32\smss.exe [848]
??\g:\windows\system32\csrss.exe [932]
??\g:\windows\system32\winlogon.exe [976]
g:\windows\system32\services.exe [1020]
g:\windows\system32\lsass.exe [1032]
g:\windows\system32\Ati2evxx.exe [1188]
g:\windows\system32\svchost.exe [1200]
g:\windows\system32\svchost.exe [1308]
g:\windows\System32\svchost.exe [1360]
g:\windows\system32\svchost.exe [1412]
g:\windows\system32\svchost.exe [1584]
g:\windows\system32\Ati2evxx.exe [1676]
g:\windows\system32\spoolsv.exe [1812]
g:\windows\system32\svchost.exe [352]
g:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [460]
g:\program files\Java\jre6\bin\jqs.exe [624]
g:\windows\system32\PnkBstrA.exe [656]
g:\program files\DialNet\WrOS.EXE [704]
g:\windows\System32\alg.exe [1904]
g:\windows\system32\CF10915.exe [1732]
g:\program files\Java\jre6\bin\jusched.exe [488]
g:\program files\ESET\ESET NOD32 Antivirus\egui.exe [1620]
g:\windows\regx32.exe [1136]
g:\windows\RTHDCPL.EXE [356]
g:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE [316]
g:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe [2056]
g:\program files\Cyberlink\Shared Files\brs.exe [2096]
g:\program files\DialNet\winpppoverethernet.exe [2124]
g:\program files\Common Files\Real\Update_OB\realsched.exe [2224]
g:\program files\Gadu-Gadu\gg.exe [2360]
g:\program files\DAEMON Tools Lite\daemon.exe [2440]
g:\program files\DNA\btdna.exe [2612]
g:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe [2668]
g:\windows\system32\ctfmon.exe [2244]
g:\windows\explorer.exe [672]
g:\combofix\catchme.cfxxe [2684]
.
**************************************************************************
.
Czas ukończenia: 2009-10-08 22:56 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-10-08 20:52

Przed: 1 505 009 664 bajtów wolnych
Po: 1 407 692 800 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

239   --- E O F ---   2009-09-10 04:46