Bardzo wolny komp skype sie wiesza - log

chomik_na_usb · 1 Czerwiec 2007 08:53

Logfile of HijackThis v1.99.1 Scan saved at 10:36:24, on 2007-06-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Softwin\BitDefender8\bdmcon.exe C:\WINDOWS\svchost.exe C:\Program Files\Softwin\BitDefender8\bdnagent.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\Yahoo!\Common\unyt.exe C:\PROGRA~1\Yahoo!\Common\unyt.exe C:\Documents and Settings\Administrator\Pulpit\stronka\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM…\Run: [bDMCon] “C:\Program Files\Softwin\BitDefender8\bdmcon.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [install.exe] C:\WINDOWS\svchost.exe O4 - HKLM…\Run: [bDNewsAgent] “C:\Program Files\Softwin\BitDefender8\bdnagent.exe” O4 - HKLM…\Run: [MSConfig] C:\WINDOWS\system32\msconfig.exe /auto O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [NBJ] “C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” O4 - Startup: Adobe Gamma.lnk.disabled O4 - Global Startup: DSLMON .lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} (GWebInstallControl Object) - http://megapanel.gem.pl/WebInstaller.dll O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://argis.les.ar.krakow.pl/ecwplugins/ncs.cab O17 - HKLM\System\CCS\Services\Tcpip…{065FF269-1CE8-4687-A31E-4D3254FFCFAF}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip…{0D29567D-7961-4D01-A0BC-C34D1612081F}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip…{DE56E1A2-C8E0-4C75-8FBE-7A89A6F77D16}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\perfc000.dat O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

pozdrawiam i prosze o pomoc Bart

Gutek · 1 Czerwiec 2007 11:37

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\svchost.exe

C:\WINDOWS\System32\perfc000.dat

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Daj log z Combofix

chomik_na_usb · 2 Czerwiec 2007 13:32

“Administrator” - 2007-06-02 14:59:10 Dodatek Service Pack 2 ComboFix 07-05.27.BV - Running from: “C:\Documents and Settings\Administrator\Pulpit” (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) “C:\DOCUME~1\ADMINI~1\Pulpit.\internet explorer.lnk” ((((((((((((((((((((((((((((((( Files Created from 2007-05-02 to 2007-06-02 )))))))))))))))))))))))))))))))))) 2007-06-01 17:37 2007-06-01 09:54 2007-06-01 09:45 2007-06-01 09:44 2007-05-31 22:40 1,077,248 --a------ C:\WINDOWS\system32\NMSDVDX.dll 2007-05-31 22:40 2007-05-31 19:15 2007-05-28 17:41 22,169 --a------ C:\WINDOWS\zzzx.exe 2007-05-26 11:34 90,112 --a------ C:\WINDOWS\unvise32.exe 2007-05-26 11:28 2007-05-25 23:19 64,000 --a------ C:\WINDOWS\system32\drivers\e4ldr.sys 2007-05-25 23:19 50,007 --a------ C:\WINDOWS\system32\drivers\adildr.sys 2007-05-25 23:19 46,892 --a------ C:\WINDOWS\system32\ADADIX16.DLL 2007-05-25 23:19 4,981 --a------ C:\WINDOWS\system32\ADADIX2K.DLL 2007-05-25 23:19 24,576 --a------ C:\WINDOWS\enddisk32.exe 2007-05-25 23:19 22,395 --a------ C:\WINDOWS\system32\drivers\fpga.bin 2007-05-25 23:19 155,648 --a------ C:\WINDOWS\system32\adadix32.dll 2007-05-25 23:19 152,220 --a------ C:\WINDOWS\system32\drivers\L1E4I2.BIN 2007-05-25 23:19 152,220 --a------ C:\WINDOWS\system32\drivers\L1E4I1.BIN 2007-05-25 23:19 152,220 --a------ C:\WINDOWS\system32\drivers\L1E4I0.BIN 2007-05-25 23:19 152,132 --a------ C:\WINDOWS\system32\drivers\L1E4P2.BIN 2007-05-25 23:19 152,132 --a------ C:\WINDOWS\system32\drivers\L1E4P1.BIN 2007-05-25 23:19 152,132 --a------ C:\WINDOWS\system32\drivers\L1E4P0.BIN 2007-05-25 23:19 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9P2.BIN 2007-05-25 23:19 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9P1.BIN 2007-05-25 23:19 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9P0.BIN 2007-05-25 23:19 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9I2.BIN 2007-05-25 23:19 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9I1.BIN 2007-05-25 23:19 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9I0.BIN 2007-05-25 23:19 152,036 --a------ C:\WINDOWS\system32\drivers\L1E4D2.BIN 2007-05-25 23:19 152,034 --a------ C:\WINDOWS\system32\drivers\L1E4D1.BIN 2007-05-25 23:19 152,034 --a------ C:\WINDOWS\system32\drivers\L1E4D0.BIN 2007-05-25 23:19 135,168 --a------ C:\WINDOWS\system32\unaddrv.exe 2007-05-25 23:19 127,456 --a------ C:\WINDOWS\system32\IPDETECT.EXE 2007-05-25 23:19 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll 2007-05-25 23:19 126,489 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys 2007-05-25 23:19 116,992 --a------ C:\WINDOWS\system32\drivers\e4usbaw.sys 2007-05-25 23:19 2007-05-25 23:18 2007-05-25 23:17 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe 2007-05-25 23:17 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll 2007-05-25 12:56 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll 2007-05-25 12:55 94,208 --a------ C:\WINDOWS\system32\W32n50.dll 2007-05-25 12:55 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS 2007-05-25 12:54 2007-05-25 12:53 2007-05-25 12:52 2007-05-25 09:11 2007-05-25 09:08 2007-05-25 09:08 2007-05-25 09:07 2007-05-09 13:06 2007-05-08 23:42 2007-05-08 15:43 2007-05-06 21:31 2007-05-06 21:30 2007-05-06 20:32 2007-05-06 20:29 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-02 12:57:21 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Skype 2007-05-31 17:16:17 -------- d-----w C:\Program Files\Skype 2007-05-31 17:11:29 -------- d-----w C:\Program Files\eMule 2007-05-26 09:55:04 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-05-25 21:19:06 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-25 07:12:57 61,962 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-25 07:12:57 412,278 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-30 09:16:12 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Gadu-Gadu 2007-04-30 09:15:13 -------- d-----w C:\Program Files\Gadu-Gadu 2007-04-28 14:54:54 -------- d-----w C:\Program Files\Mobile Phone Manager 2007-04-28 14:52:56 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-26 21:24:15 -------- d-----w C:\Program Files\Earth Resource Mapping 2007-04-26 17:53:51 -------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2007-04-26 09:53:09 -------- d-----w C:\Program Files\IrfanView 2007-04-26 09:52:52 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Google 2007-04-18 17:15:47 -------- d-----w C:\Program Files\Microsoft Games 2007-04-16 11:58:27 -------- d-----w C:\Program Files\Bus Driver 2007-04-16 10:02:12 -------- d-----w C:\Program Files\Common Files\DirectX 2007-04-16 09:49:57 -------- d-----w C:\Program Files\Google 2007-04-16 06:43:08 -------- d-----w C:\Program Files\SpyRemover 2007-04-07 21:44:07 -------- d-----w C:\Program Files\Yahoo! 2007-04-07 10:44:44 -------- d-----w C:\Program Files\Common Files\DriveCleaner Free 2007-04-07 08:16:53 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Lavasoft 2007-04-07 08:14:56 -------- d-----w C:\Program Files\Lavasoft 2007-04-07 08:12:40 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-04-06 14:52:39 -------- d-----w C:\Program Files\MadOnion.com 2007-03-21 05:00:00 545 ----a-w C:\WINDOWS\UC.PIF 2007-03-21 05:00:00 545 ----a-w C:\WINDOWS\RAR.PIF 2007-03-21 05:00:00 545 ----a-w C:\WINDOWS\PKZIP.PIF 2007-03-21 05:00:00 545 ----a-w C:\WINDOWS\PKUNZIP.PIF 2007-03-21 05:00:00 545 ----a-w C:\WINDOWS\NOCLOSE.PIF 2007-03-21 05:00:00 545 ----a-w C:\WINDOWS\LHA.PIF 2007-03-21 05:00:00 545 ----a-w C:\WINDOWS\ARJ.PIF (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 10:28] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 07:12] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL [2006-10-27 01:48] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar1.dll [2007-04-16 11:49] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “BDMCon”=“C:\Program Files\Softwin\BitDefender8\bdmcon.exe” [2005-06-20 13:10] “BDNewsAgent”=“C:\Program Files\Softwin\BitDefender8\bdnagent.exe” [2005-05-09 13:19] “RemoteControl”=“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [2004-11-02 21:24] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-05-28 14:52] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 16:36] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe” [2007-04-16 11:49] “NBJ”=“C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” [2006-02-10 22:40] [HKEY_USERS.default\software\microsoft\windows\currentversion\runonce] “nlsf”=cmd.exe /C move /Y “%SystemRoot%\System32\syssetub.dll” “%SystemRoot%\System32\syssetup.dll” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “DisableStatusMessages”=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoDesktopCleanupWizard”=1 (0x1) “ForceClassicControlPanel”=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSMHelp”=1 (0x1) “NoSharedDocuments”=1 (0x1) “ClearRecentDocsOnExit”=1 (0x1) “NoRecentDocsMenu”=1 (0x1) “NoRecentDocsHistory”=1 (0x1) “NoWindowsUpdate”=1 (0x1) “NoResolveTrack”=1 (0x1) "LinkResolveIgnoreLinkInfo "=1 (0x1) “NoLowDiskSpaceChecks”=1 (0x1) “NoInstrumentation”=1 (0x1) “NoSMMyDocs”=1 (0x1) “NoSMConfigurePrograms”=1 (0x1) [HKEY_USERS.default\software\microsoft\windows\currentversion\policies\explorer] “NoSMHelp”=1 (0x1) “NoSharedDocuments”=1 (0x1) “ClearRecentDocsOnExit”=1 (0x1) “NoRecentDocsMenu”=1 (0x1) “NoRecentDocsHistory”=1 (0x1) “NoWindowsUpdate”=1 (0x1) “NoResolveTrack”=1 (0x1) "LinkResolveIgnoreLinkInfo "=1 (0x1) “NoLowDiskSpaceChecks”=1 (0x1) “NoInstrumentation”=1 (0x1) “NoSMMyDocs”=1 (0x1) “NoSMConfigurePrograms”=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}”=“C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL” [2006-10-27 01:48] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] “WOOTASKBARICON”=C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe “WOOWATCH”=C:\PROGRA~1\NEOSTR~1\Watch.exe “GrooveMonitor”=“C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService LmHosts SSDPSRV DcomLaunch DcomLaunch HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* ******************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-02 15:03:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-06-02 15:05:25 - machine was rebooted C:\ComboFix-quarantined-files.txt … 2007-06-02 15:05 — E O F —

wskazane sciezki usunalem i jak by teraz lepiej sie komp sie czul

pozdrawiam

Gutek · 2 Czerwiec 2007 15:40

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\zzzx.exe

C:\WINDOWS\unvise32.exe

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509