10 procesów svchost, powolnie działający komputer

**Posty:** 53 · przez **pulhny16** 27 Mar 2010, 10:20

Jak napisałem wyżej z zwyczajnych kiedyś 6-7 procesów svchost zrobiło mi się 10 ostatnio po zauważeniu znacznego spowolnienia komputera i spowalniania muzyki np. przy przenoszeniu plików na dyskach, zmniejszyła się też szybkość przenoszenia plików po dysku. OTL wywala błąd, że pamięć nie może być read, nawet na koncie administratora systemowego dostępnego z opcji uruchom jako. Błąd otl:"Instrukcja spod "0x839b6534" odwołuje się do pamięci pod adresem "0x839b6534". Pamięć nie może być "read". Kliknij ok ...". Również SDFix pod trybem awaryjnym nie jest w stanie zakończyć sprawdzania, zatrzymuje się na 75% i przez 16h nie ruszył nic dalej(zostawiłem komputer na noc). ComboFix niby się skończył ale też nie powiem, żeby prędkością powalał.

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit quick scan 2010-03-27 09:04:15 Windows 5.1.2600 Dodatek Service Pack 3 Running: 8qmwddx3.exe; Driver: C:\DOCUME~1\AVAL@N~1\USTAWI~1\Temp\pxtdapob.sys ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Ip SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Tcp SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Udp SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\RawIp SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) ---- EOF - GMER 1.0.15 ----

Pozdrawiam i dziękuję za pomoc

**Posty:** 18165 · przez **wojtas** 27 Mar 2010, 14:43

masz raport z Combofix?

**Posty:** 53 · przez **pulhny16** 27 Mar 2010, 14:49

Kod: Zaznacz wszystko: ComboFix 10-03-08.01 - aVaL@NcHe 2010-03-08 19:52:14.3.2 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.511.364 [GMT 1:00] Uruchomiony z: g:\pobieranie\ComboFix.exe AV: avast! antivirus 4.8.1368 [VPS 100308-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\aVaL@NcHe\Moje dokumenty\cc_20091108_193650.reg c:\documents and settings\aVaL@NcHe\Moje dokumenty\cc_20091213_111908.reg . ((((((((((((((((((((((((( Pliki utworzone od 2010-02-08 do 2010-03-08 ))))))))))))))))))))))))))))))) . 2010-03-08 18:42 . 2010-03-08 18:43 -------- d-----w- c:\windows\LastGood 2010-03-07 14:26 . 2004-08-03 23:44 221184 ----a-w- c:\windows\system32\wmpns.dll 2010-03-07 14:13 . 2010-03-07 14:13 -------- d-----w- c:\windows\ServicePackFiles 2010-03-07 14:11 . 2010-03-07 14:11 -------- d-----w- c:\program files\MSXML 4.0 2010-03-07 13:43 . 2010-03-07 14:52 -------- d-----w- c:\windows\system32\CatRoot_bak 2010-03-07 13:39 . 2007-03-10 01:35 100352 -c----w- c:\windows\system32\dllcache\6to4svc.dll 2010-03-07 13:38 . 2008-06-14 18:01 273024 -c----w- c:\windows\system32\dllcache\bthport.sys 2010-03-07 13:38 . 2008-06-14 18:01 273024 ------w- c:\windows\system32\drivers\bthport.sys 2010-03-07 13:38 . 2009-12-31 15:06 352640 -c----w- c:\windows\system32\dllcache\srv.sys 2010-03-07 13:37 . 2009-11-21 16:46 470528 -c----w- c:\windows\system32\dllcache\aclayers.dll 2010-03-07 13:36 . 2009-10-15 16:57 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll 2010-03-07 13:36 . 2009-10-15 16:57 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll 2010-03-07 13:36 . 2005-07-26 04:36 60416 -c----w- c:\windows\system32\dllcache\colbact.dll 2010-03-07 13:36 . 2009-03-06 14:01 285696 -c----w- c:\windows\system32\dllcache\pdh.dll 2010-03-07 13:36 . 2009-02-06 09:41 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe 2010-03-07 13:36 . 2009-02-09 10:03 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll 2010-03-07 13:36 . 2009-02-09 10:03 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll 2010-03-07 13:36 . 2009-02-09 09:55 111104 -c----w- c:\windows\system32\dllcache\services.exe 2010-03-07 13:36 . 2009-02-06 09:54 35328 -c----w- c:\windows\system32\dllcache\sc.exe 2010-03-07 13:36 . 2009-02-09 10:03 687104 -c----w- c:\windows\system32\dllcache\advapi32.dll 2010-03-07 13:36 . 2009-02-09 10:03 723456 -c----w- c:\windows\system32\dllcache\ntdll.dll 2010-03-07 13:36 . 2009-06-21 22:07 153088 -c----w- c:\windows\system32\dllcache\triedit.dll 2010-03-07 13:35 . 2009-12-04 13:37 456832 -c----w- c:\windows\system32\dllcache\mrxsmb.sys 2010-03-07 13:33 . 2008-05-08 12:14 203008 -c----w- c:\windows\system32\dllcache\rmcast.sys 2010-03-07 13:33 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll 2010-03-07 13:33 . 2009-07-10 13:38 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2010-03-07 13:30 . 2008-04-11 18:41 683520 -c----w- c:\windows\system32\dllcache\inetcomm.dll 2010-03-07 13:29 . 2009-08-04 17:18 2144256 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe 2010-03-07 13:29 . 2009-08-04 17:18 2064256 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe 2010-03-07 13:29 . 2009-08-04 17:18 2187264 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe 2010-03-07 13:29 . 2009-08-04 17:18 2022400 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe 2010-03-07 13:28 . 2009-06-05 07:46 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll 2010-03-07 13:28 . 2008-10-15 16:55 339456 -c----w- c:\windows\system32\dllcache\netapi32.dll 2010-03-07 13:27 . 2008-04-21 21:28 218112 -c----w- c:\windows\system32\dllcache\wordpad.exe 2010-03-07 13:26 . 2010-03-08 18:43 -------- d--h--w- c:\windows\$hf_mig$ 2010-03-07 13:15 . 2008-11-06 01:03 -------- d-----w- C:\SDFix 2010-03-07 13:13 . 2010-03-08 09:03 1529241 ----a-w- C:\SDFix.exe 2010-03-07 10:14 . 2010-03-07 10:14 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll 2010-03-07 09:34 . 2010-03-07 09:34 -------- d-----w- c:\windows\ERUNT 2010-03-06 17:52 . 2010-03-06 17:53 -------- d-----w- c:\program files\DVDlabPro2 2010-02-27 11:15 . 2010-02-27 11:15 -------- d-----w- c:\program files\Common Files\Borland Shared 2010-02-27 11:11 . 2010-02-27 11:11 -------- d-----w- c:\program files\Borland 2010-02-22 19:51 . 2010-02-22 19:52 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-02-20 07:43 . 2009-06-08 14:33 8676883 ----a-w- c:\windows\system32\mp3Media2.dll 2010-02-20 07:43 . 2010-02-20 07:43 -------- d-----w- c:\program files\Smallvideosoft . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-08 18:46 . 2009-01-24 19:11 -------- d-----w- c:\documents and settings\aVaL@NcHe\Dane aplikacji\WTablet 2010-03-08 18:46 . 2009-01-24 20:57 -------- d-----w- c:\documents and settings\aVaL@NcHe\Dane aplikacji\foobar2000 2010-03-07 15:07 . 2001-10-26 17:15 490284 ----a-w- c:\windows\system32\perfh015.dat 2010-03-07 15:07 . 2001-10-26 17:15 83660 ----a-w- c:\windows\system32\perfc015.dat 2010-03-04 18:38 . 2009-02-01 11:40 -------- d-----w- c:\documents and settings\aVaL@NcHe\Dane aplikacji\uTorrent 2010-02-28 18:01 . 2009-02-01 11:40 -------- d-----w- c:\program files\uTorrent 2010-02-04 22:10 . 2010-02-04 22:10 -------- d-----w- c:\documents and settings\aVaL@NcHe\Dane aplikacji\Ambient Design 2010-02-04 22:05 . 2010-02-04 22:05 -------- d-----w- c:\program files\Ambient Design 2010-01-29 17:14 . 2010-01-29 16:53 -------- d-----w- c:\program files\PhotoScape 2010-01-29 14:56 . 2009-01-24 23:31 -------- d-----w- c:\program files\Common Files\Adobe 2010-01-29 10:37 . 2010-01-29 10:37 -------- d-----w- c:\program files\totalcmd 2010-01-27 18:17 . 2010-01-06 00:04 -------- d-----w- c:\documents and settings\aVaL@NcHe\Dane aplikacji\vlc 2010-01-25 20:08 . 2009-01-24 19:31 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-01-20 14:51 . 2009-01-24 19:31 -------- d-----w- c:\program files\Creative 2010-01-16 13:28 . 2010-01-16 13:28 -------- d-----w- c:\documents and settings\aVaL@NcHe\Dane aplikacji\TrekBuddy Atlas Creator 2010-01-14 09:11 . 2010-01-14 09:11 -------- d-----w- c:\documents and settings\aVaL@NcHe\Dane aplikacji\VitySoft 2010-01-14 09:00 . 2010-01-14 09:00 -------- d-----w- c:\program files\vSoft 2010-01-10 17:23 . 2010-01-10 17:23 -------- d-----w- c:\program files\Symantec 2009-12-31 15:06 . 2007-03-10 01:35 352640 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-25 23:59 . 2009-01-27 21:40 36376 ----a-w- c:\documents and settings\aVaL@NcHe\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-12-22 05:36 . 2007-01-04 13:05 671232 ----a-w- c:\windows\system32\wininet.dll 2009-12-22 05:36 . 2004-08-03 23:44 81920 ----a-w- c:\windows\system32\ieencode.dll 2009-12-17 08:00 . 2009-01-24 18:49 345088 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:37 . 2004-08-03 23:43 33280 ----a-w- c:\windows\system32\csrsrv.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2009-11-11 870400] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776] "nwiz"="nwiz.exe" [2007-12-05 1626112] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920] "SoundMan"="SOUNDMAN.EXE" [2006-03-01 577536] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] "SDFix"="c:\sdfix\RunThis.bat" [2008-11-05 964661] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\aVaL@NcHe\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-25 113664] Miranda IM.lnk - c:\program files\Miranda IM\miranda32.exe [2007-3-13 468547] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-25 113664] PC Alert 4.lnk - c:\program files\MSI\PC Alert 4\PCAlert4.exe [2009-1-24 552960] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 cfadisk;CompactFlash Filter Driver;c:\windows\system32\drivers\cfadisk.sys [2009-12-08 3712] R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2006-10-18 17920] R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2009-01-24 270888] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-01-24 717296] S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-24 114768] S1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [2009-01-25 123280] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [2009-01-25 41616] S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-24 20560] S2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528] S2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288] S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-01-24 3032360] S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2009-11-11 16512] S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [2009-11-01 6016] S3 jixueegga;{DFE1CB32-1573-42C1-8E98-2E93B87A422E};c:\program files\ophcrack\pwdump\servpw.exe --> c:\program files\ophcrack\pwdump\servpw.exe [?] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-11-01 18688] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-11-01 8320] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2009-11-01 42752] S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [2009-11-01 23296] S3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [2009-01-24 65576] S3 trmknqpc;{C756A2E1-3985-4B0A-B17E-4181D5819DDD};c:\program files\ophcrack\pwdump\servpw.exe --> c:\program files\ophcrack\pwdump\servpw.exe [?] S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [2009-06-30 100048] S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [2009-11-30 110992] S3 VBoxUSB;VirtualBox USB;c:\windows\system32\drivers\VBoxUSB.sys [2009-01-25 31824] S3 Vsp;Vsp;\??\c:\windows\system32\drivers\Vsp.sys --> c:\windows\system32\drivers\Vsp.sys [?] S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2009-01-24 15144] S3 ZD1211U(ZyXEL);ZyXEL G-220 802.11g Wireless USB Adapter Driver (USB)(ZyXEL);c:\windows\system32\drivers\ZD1211U.sys [2009-03-26 290816] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ FF - ProfilePath - c:\documents and settings\aVaL@NcHe\Dane aplikacji\Mozilla\Firefox\Profiles\4kq3enkl.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - plugin: c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\npquakezero.dll FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-08 20:04 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1202660629-823518204-1801674531-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_USERS\S-1-5-21-1202660629-823518204-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2E90EA3A-0686-9655-0E01-A7350DC16EAE}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "oaeiloonhkhehpdmfggombfikaadab"=hex:69,61,62,6a,64,66,66,6d,63,6f,70,69,65,6a, 6b,68,6f,6b,00,00 "naokdjaijjboajcchlodibjbghnh"=hex:6a,61,61,6a,61,66,64,6b,6f,64,6b,67,61,6c, 6a,64,6b,6d,63,6d,00,26 "gbmjlpmibcdnmfmoeknhmieegcbgeflnmoplbpnhkgggfk"=hex:61,61,00,77 "bbgjcjjlmnihaneegkklcifdnclhcmkliajn"=hex:61,61,00,77 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents] @Denied: (Full) (LocalSystem) "OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd . Czas ukończenia: 2010-03-08 20:12:23 ComboFix-quarantined-files.txt 2010-03-08 19:12 Przed: 1 321 201 664 bajtów wolnych Po: 2 009 858 048 bajtów wolnych - - End Of File - - D9F76A51F4FF1DA7E54B92DE618CE9E0

**Posty:** 18165 · przez **wojtas** 27 Mar 2010, 18:14

poczytaj programy emulujące napędy i się zastosuj dopiero potem odpal Combo

nie znam tego :

S3 jixueegga;{DFE1CB32-1573-42C1-8E98-2E93B87A422E};c:\program files\ophcrack\pwdump\servpw.exe --> c:\program files\ophcrack\pwdump\servpw.exe [?]
S3 trmknqpc;{C756A2E1-3985-4B0A-B17E-4181D5819DDD};c:\program files\ophcrack\pwdump\servpw.exe --> c:\program files\ophcrack\pwdump\servpw.exe [?]

lecz wydaje mi się że nie jest to problem z wirusami