Długie uruchamianie systemu

[crooliq]

Witam, system odpala mi się grubo ponad 2 minuty. W logu mam m.in dużo usług, a nie wiem co wywalić. Oto log. Z góry dzięki za pomoc.

Logfile of HijackThis v1.99.1 Scan saved at 11:03:01, on 2007-11-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\windows\Explorer.EXE C:\windows\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\windows\mHotkey.exe C:\windows\CNYHKey.exe C:\windows\StopHid.exe C:\windows\V0230Mon.exe C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\windows\system32\cisvc.exe C:\Program Files\Borland\InterBase\bin\ibguard.exe C:\Program Files\MSI\Core Center\CoreCenter.exe C:\Program Files\Konnekt\konnekt.exe C:\windows\system32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Borland\InterBase\bin\ibserver.exe C:\windows\system32\wuauclt.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Winamp\winamp.exe D:\Download\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {6743d0bc-d63e-4e88-a398-ca64aa069c4c} - C:\windows\system32\chcesh.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\windows\system32\tmpBC.tmp.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [CHotkey] mHotkey.exe O4 - HKLM…\Run: [CNYHKey] CNYHKey.exe O4 - HKLM…\Run: [stopHid] StopHid.exe O4 - HKLM…\Run: [CreativeMouse] C:\Program Files\Creative\Desktop Wireless\mouse_2k.exe O4 - HKLM…\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM…\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe O4 - HKLM…\Run: [blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe O4 - HKLM…\Run: [V0230Mon.exe] C:\windows\V0230Mon.exe O4 - HKLM…\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions O4 - HKLM…\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe O4 - HKCU…\Run: [RocketDock] “C:\Program Files\RocketDock\RocketDock.exe” O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe” O4 - HKCU…\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - Startup: Konnekt.lnk = C:\Program Files\Konnekt\konnekt.exe O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CS2\Services\Tcpip…{46A1E2CF-CCFA-4965-B1D0-2D68BE9384B3}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: chcesh - chcesh.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibguard.exe O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibserver.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: Visibroker Activation Daemon (oad) - Unknown owner - C:\PROGRA~1\Borland\vbroker\bin\oad.exe O23 - Service: VisiBroker Smart Agent (osagent) - Unknown owner - C:\PROGRA~1\Borland\vbroker\bin\osagent.exe

[adam9870]

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jeżeli któryś z nich będzie na żółto to go zostaw). Po użyciu narzędzia wymagany jest restart.

O2 - BHO: (no name) - {6743d0bc-d63e-4e88-a398-ca64aa069c4c} - C:\windows\system32\chcesh.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\windows\system32\tmpBC.tmp.dll O20 - Winlogon Notify: chcesh - chcesh.dll (file missing)

Użyj narzędzi VundoFix + SmitFraudFix z opcji numer 2 w trybie awaryjnym.

C:\windows\StopHid.exe

1. Masz coś od Creative w komputerze?

2. Przeskanuj ten plik na stronie http://www.virustotal.com/pl/ bądź http://virusscan.jotti.org/ i wklej tu raport ze skanowania.

Po wykonaniu powyżej przedstawionych czynności wklej log z ComboFix.

[crooliq]

Ok, wyczyściłem, Jeszcze powyłączałem usługi wszystkie nie Microsoftu to widać różnicę. StopHid.exe mam od Creative’a. Log:

ComboFix 07-11-19.3 - Tomek 2007-11-22 16:04:16.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.211 [GMT 1:00] Running from: D:\Download\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Tomek\Dane aplikacji\tmp13.tmp.exe C:\Documents and Settings\Tomek\Dane aplikacji\tmp14.tmp.exe C:\Documents and Settings\Tomek\Dane aplikacji\tmp15.tmp.exe C:\Documents and Settings\Tomek\Dane aplikacji\tmp4.tmp.exe C:\Documents and Settings\Tomek\Dane aplikacji\tmpBB.tmp.exe C:\Documents and Settings\Tomek\Dane aplikacji\tmpBC.tmp.exe C:\Documents and Settings\Tomek\Dane aplikacji\tmpBE.tmp.exe C:\windows\cookies.ini C:\WINDOWS\hjjijl.ini C:\windows\ljijjh.dll C:\windows\system32\Cfx32.lic C:\windows\system32\cfx32.ocx C:\windows\system32\dncc33f40e.dat C:\windows\system32\tmp14.tmp.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-10-22 to 2007-11-22 ))))))))))))))))))))))))))))))) . 2007-11-22 15:52 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-22 15:37 2007-11-22 10:55 2,560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-11-10 13:08 2007-11-05 08:36 2007-11-05 08:36 2007-11-03 14:06 2007-11-03 14:01 7,850 --a------ C:\WINDOWS\system32\winupsvc.exe 2007-11-03 14:01 7,850 --a------ C:\WINDOWS\system32\winsvcup.exe 2007-11-03 13:51 6,852 --a------ C:\WINDOWS\system32\drivers\Vcs.sys 2007-11-03 13:51 16 --a------ C:\WINDOWS\system32\DataRnvx.dat 2007-11-01 16:43 2007-11-01 16:39 2007-10-31 23:43 156,773 -ra------ C:\WINDOWS\system32\vredir.vxd 2007-10-31 23:43 36,352 -ra------ C:\WINDOWS\qfecheck.exe 2007-10-31 23:43 17,595 -ra------ C:\WINDOWS\system32\vnetsup.vxd 2007-10-28 12:24 2007-10-28 11:36 2007-10-28 11:20 2007-10-28 11:20 2007-10-27 12:31 2007-10-27 12:25 2007-10-27 12:25 2007-10-27 12:25 2007-10-27 12:25 2007-10-27 12:23 2007-10-27 12:23 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-22 14:36 --------- d-----w C:\Program Files\Blaero Start Orb 2007-11-22 14:35 --------- d-----w C:\Program Files\VisualTooltip 2007-11-22 14:35 --------- d-----w C:\Program Files\LClock 2007-11-22 10:51 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-11-22 10:02 16 ----a-w C:\maile.dat 2007-11-22 10:01 2,800 ----a-w C:\firmy.dat 2007-11-22 09:56 --------- d-----w C:\Program Files\AlienGUIse 2007-11-19 14:32 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Skype 2007-11-18 11:01 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\uTorrent 2007-11-12 19:43 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\LimeWire 2007-11-01 11:24 --------- d-----w C:\Program Files\Owoc 2007-11-01 09:13 --------- d-----w C:\Program Files\RocketDock 2007-10-27 11:33 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Apple Computer 2007-10-19 07:46 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-19 07:46 --------- d-----w C:\Program Files\Creative 2007-10-19 07:46 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Creative 2007-10-18 15:23 --------- d-----w C:\Program Files\Winamp 2007-10-18 10:17 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Trevoli 2007-10-18 10:16 --------- d-----w C:\Program Files\Photo Finale 2007-10-12 14:57 --------- d-----w C:\Program Files\Inno Setup 5 2007-10-12 14:04 --------- d-----w C:\Program Files\Borland 2007-10-11 12:55 --------- d-----w C:\Program Files\LimeWire 2007-10-09 17:48 --------- d-----w C:\Program Files\Microsoft.NET 2007-10-09 17:48 --------- d-----w C:\Program Files\Microsoft SQL Server 2007-10-06 11:01 --------- d-----w C:\Program Files\Common Files\Borland Shared 2007-10-05 06:35 --------- d-----w C:\Program Files\TechSmith 2007-10-05 06:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TechSmith 2007-10-01 10:04 --------- d-----w C:\Program Files\Codemasters 2007-09-30 21:12 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Watchtower 2007-02-12 11:56 0 ----a-w C:\Program Files\dxva_sig.txt . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “RocketDock”=“C:\Program Files\RocketDock\RocketDock.exe” [2007-01-28 03:55] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe” [2005-10-28 15:25] “StartCCC”=“C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” [2006-11-10 11:35] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 09:50] “CHotkey”=“mHotkey.exe” [2004-02-23 13:41 C:\WINDOWS\mHotkey.exe] “CNYHKey”=“CNYHKey.exe” [2004-02-23 13:40 C:\WINDOWS\CNYHKey.exe] “StopHid”=“StopHid.exe” [2004-02-23 13:41 C:\WINDOWS\StopHid.exe] "CreativeMouse "=“C:\Program Files\Creative\Desktop Wireless\mouse_2k.exe” [2003-07-31 20:03] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] “nlsf”=“cmd.exe” [2004-08-03 23:44 C:\WINDOWS\system32\cmd.exe] “nlhr”=“RunDll32.exe” [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe] “tscuninstall”=“C:\windows\system32\tscupgrd.exe” [2004-08-03 23:33] C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\ Konnekt.lnk - C:\Program Files\Konnekt\konnekt.exe [2005-05-24 22:41:09] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “ForceClassicControlPanel”= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSharedDocuments”= 1 (0x1) “NoSMMyDocs”= 1 (0x1) “NoUserNameInStartMenu”= 1 (0x1) [HKEY_USERS.default\software\microsoft\windows\currentversion\policies\explorer] “NoSharedDocuments”= 1 (0x1) “NoSMMyDocs”= 1 (0x1) “NoUserNameInStartMenu”= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tomek^Menu Start^Programy^Autostart^Y’z Toolbar.lnk] path=C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\Y’z Toolbar.lnk backup=C:\WINDOWS\pss\Y’z Toolbar.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntiLostCD] C:\Program Files\Anti-Lost CD\antilostlite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] 2007-09-06 11:06 79224 --a------ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVFX Engine] 2006-10-19 18:44 20480 --------- C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CNYHKey] CNYHKey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2004-08-03 23:44 15360 --a------ C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DC1300 Monitor] 2002-08-08 17:13 45056 --------- C:\Program Files\DC1300\DCMnt1_0\DC1300mi.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2007-06-28 08:14 270648 --a------ C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] C:\WINDOWS\themeupd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] C:\Program Files\MSN Messenger\msnmsgr.exe /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] 2001-07-09 09:50 163840 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OCAudioIni] 2005-03-29 18:54 57344 --a------ C:\Program Files\One-click Audio Converter\OCAudioIni.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2003-10-31 18:42 32768 --a------ C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe /icon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StopHid] StopHid.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] 2006-05-03 09:48 307200 --a------ C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2006-12-15 03:23 75520 --a------ C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer] rundll32.exe C:\windows\ljijjh.dll,forkonce [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V0230Mon.exe] 2006-09-07 00:01 32768 --a------ C:\windows\V0230Mon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar] 2006-12-25 07:14 6083072 --a------ C:\Program Files\Vista Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2007-10-10 06:28 36352 --a------ C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “BlueSoleil Hid Service”=2 (0x2) “avast! Web Scanner”=3 (0x3) “avast! Mail Scanner”=3 (0x3) “avast! Antivirus”=2 (0x2) “aswUpdSv”=2 (0x2) “StarWindService”=2 (0x2) “ScsiAccess”=2 (0x2) “ose”=3 (0x3) “IDriverT”=3 (0x3) “ewido anti-spyware 4.0 guard”=2 (0x2) “ATI Smart”=2 (0x2) “Ati HotKey Poller”=2 (0x2) “WMPNetworkSvc”=3 (0x3) “usnjsvc”=3 (0x3) “SQLWriter”=3 (0x3) “osagent”=3 (0x3) “oad”=3 (0x3) “MSSQL$SQLEXPRESS”=2 (0x2) “iPod Service”=3 (0x3) “InterBaseServer”=3 (0x3) “InterBaseGuardian”=2 (0x2) “Apple Mobile Device”=2 (0x2) R2 Vcs;Vcs support;??\C:\windows\system32\Drivers\Vcs.sys R3 PCAlertDriver;PCAlertDriver;??\C:\Program Files\MSI\Core Center\NTGLM7X.sys R3 RushTopDevice;RushTopDevice;??\C:\Program Files\MSI\Core Center\RushTop.sys R3 V0230Vfx;V0230Vfx;C:\windows\system32\DRIVERS\V0230Vfx.sys R3 V0230VID;Live! Cam Video IM Pro;C:\windows\system32\DRIVERS\V0230VID.sys S3 DC1300;DC 1300 WDM Video Capture;C:\windows\system32\Drivers\BSC504AV.SYS S3 GVCplDrv;GVCplDrv;C:\windows\system32\drivers\GVCplDrv.sys S3 s116bus;Sony Ericsson Device 116 driver (WDM);C:\windows\system32\DRIVERS\s116bus.sys S3 s116mdfl;Sony Ericsson Device 116 USB WMC Modem Filter;C:\windows\system32\DRIVERS\s116mdfl.sys S3 s116mdm;Sony Ericsson Device 116 USB WMC Modem Driver;C:\windows\system32\DRIVERS\s116mdm.sys S3 s116mgmt;Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM);C:\windows\system32\DRIVERS\s116mgmt.sys S3 s116nd5;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS);C:\windows\system32\DRIVERS\s116nd5.sys S3 s116obex;Sony Ericsson Device 116 USB WMC OBEX Interface;C:\windows\system32\DRIVERS\s116obex.sys S3 s116unic;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM);C:\windows\system32\DRIVERS\s116unic.sys S3 USBCamera;DC 1300 Still Image Capture;C:\windows\system32\Drivers\BscBulk.sys S3 usbscan;Sterownik skanera USB;C:\windows\system32\DRIVERS\usbscan.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\windows\system32\DRIVERS\USBSTOR.SYS S4 InterBaseGuardian;InterBase Guardian;C:\Program Files\Borland\InterBase\bin\ibguard.exe S4 InterBaseServer;InterBase Server;C:\Program Files\Borland\InterBase\bin\ibserver.exe S4 oad;Visibroker Activation Daemon;C:\PROGRA~1\Borland\vbroker\bin\oad.exe S4 osagent;VisiBroker Smart Agent;C:\PROGRA~1\Borland\vbroker\bin\osagent.exe S4 SQLWriter;SQL Server VSS Writer;“c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{3837e785-5a15-11db-97bd-806d6172696f}] \Shell\AutoRun\command - E:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{4bd12c8e-5a2a-11db-8140-000e507067dc}] \Shell\AutoRun\command - F:\launcher.exe . Contents of the ‘Scheduled Tasks’ folder “2007-11-17 19:59:02 C:\windows\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe “2007-11-22 15:07:34 C:\windows\Tasks\neo.job” - C:\Documents and Settings\Tomek\Pulpit\neo.lnk . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-22 16:07:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-22 16:09:34 - machine was rebooted . — E O F —

Trochę syfu znalazło, dzięki za pomoc. Pzdr

[Gutek]

C:\WINDOWS\system32\winupsvc.exe

plik do usunięcia

Pobierz program SDFix

[crooliq]

SDFix: Version 1.119 Run by Tomek on 2007-12-23 at 14:05 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\windows\system32\mswinup.exe - Deleted C:\windows\system32\winsvcup.exe - Deleted C:\windows\system32\winupsvc.exe - Deleted Removing Temp Files… ADS Check: C:\windows No streams found. C:\windows\system32 No streams found. C:\windows\system32\svchost.exe No streams found. C:\windows\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-23 14:08:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:c2186a35 “s2”=dword:81a94672 “h0”=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “p0”=“C:\Program Files\Alcohol Soft\Alcohol 120” “h0”=dword:00000001 “ujdew”=hex:ad,31,db,d5,1b,c1,22,e7,59,bb,de,e8,db,7f,46,71,47,d1,63,61,df,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “h0”=dword:00000000 “khjeh”=hex:70,08,a4,38,03,c3,ff,62,76,a1,e7,08,e5,b8,54,09,f1,2f,2f,d6,f8,… “p0”=“C:\Program Files\DAEMON Tools” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,20,4c,f4,d2,31,c9,e0,80,18,e2,b8,77,74,ca,bb,52,b6,… “khjeh”=hex:80,bd,12,0b,e6,de,d4,06,17,b5,2e,31,cf,78,d7,5c,a7,5d,99,b6,5a,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:2f,1a,03,a4,40,55,59,40,f1,03,28,56,b8,de,6b,07,50,1e,35,cf,3e,… [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces{8A8A7934-3226-40F6-A306-457796F0FBB9}] “DhcpRetryTime”=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “p0”=“C:\Program Files\Alcohol Soft\Alcohol 120” “h0”=dword:00000001 “ujdew”=hex:ad,31,db,d5,1b,c1,22,e7,59,bb,de,e8,db,7f,46,71,47,d1,63,61,df,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] “h0”=dword:00000000 “khjeh”=hex:70,08,a4,38,03,c3,ff,62,76,a1,e7,08,e5,b8,54,09,f1,2f,2f,d6,f8,… “p0”=“C:\Program Files\DAEMON Tools” [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] “a0”=hex:20,01,00,00,20,4c,f4,d2,31,c9,e0,80,18,e2,b8,77,74,ca,bb,52,b6,… “khjeh”=hex:80,bd,12,0b,e6,de,d4,06,17,b5,2e,31,cf,78,d7,5c,a7,5d,99,b6,5a,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] “khjeh”=hex:2f,1a,03,a4,40,55,59,40,f1,03,28,56,b8,de,6b,07,50,1e,35,cf,3e,… scanning hidden registry entries … [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “C:\Program Files\uTorrent\utorrent.exe”=“C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent” “C:\Program Files\NAPI-PROJEKT\napisy.exe”=“C:\Program Files\NAPI-PROJEKT\napisy.exe:*:Enabled:www.napiprojekt.pl” “C:\Program Files\Konnekt\konnekt.exe”=“C:\Program Files\Konnekt\konnekt.exe:*:Enabled:Konnekt - Core” “C:\Program Files\Gadu-Gadu\gg.exe”=“C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny” “C:\Program Files\MSN Messenger\msnmsgr.exe”=“C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Messenger” “C:\Program Files\Mozilla Firefox\firefox.exe”=“C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox” “C:\Program Files\WapSter\AQQ\AQQ.exe”=“C:\Program Files\WapSter\AQQ\AQQ.exe:*:Enabled:P2P AQQ” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Fri 27 May 2005 33 A…H. — “C:\Program Files\Serials 2005\Crypt.dll” Fri 17 Nov 2006 4,348 A.SH. — “C:\Documents and Settings\All Users\DRM\DRMv1.bak” Sat 7 Apr 2007 0 A.SH. — “C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp” Mon 16 Apr 2007 1,714 …HR — “C:\Documents and Settings\Tomek\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak” Finished!

Chyba usunęło, dzięki

[Monczkin]

crooliq , popraw błędy i zacznij używać polskiej pisowni na forum. W przeciwnym razie zostaną wyciągnięte konsekwencje. Poprawiono tytuł.

[Gutek]

Na koniec - Skan AVG Anti-Spyware 7.5 po update