Komp się przycina proszę o sprawdzenie logów

macko44 · 22 Wrzesień 2007 17:19

Witam

Od jakiegoś czasu komp mi się zawiesza i albo sam wraca do normy lub muszę go resetowac, a pozatym coś w jego pracy jest nie tak.

Proszę o sprawdzenie logów:

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “DW4” = ““C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe”” [“The Weather Channel Interactive”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “WinPatrol” = “C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe” [“BillP Studios”] “SpywareTerminator” = ““C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe”” [“Crawler.com”] “COMODO Firewall Pro” = ““C:\Program Files\Comodo\Firewall\CPF.exe” /background” [“COMODO”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] “VTPreset” = “VTPreset.exe” [“S3 Graphics, Inc.”] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD}(Default) = (no title provided) -> {HKLM…CLSID} = “TwcToolbarBhoApp Class” \InProcServer32(Default) = “C:\WINDOWS\system32\TwcToolbarBho.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Display Panning CPL Extension” -> {HKLM…CLSID} = “Display Panning CPL Extension” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “HyperTerminal Icon Ext” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Outlook File Icon Extension” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}” = “PhoneBrowser” -> {HKLM…CLSID} = “Nokia Phone Browser” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”] “{C0C4375A-5B72-4efe-929D-3B848C3A1E91}” = “Message View” -> {HKLM…CLSID} = “Message View” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll” [“Nokia”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{BB7DF450-F119-11CD-8465-00AA00425D90}” = “Microsoft Access Custom Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office\soa800.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{8e9d6600-f84a-11ce-8daa-00aa004a5691}” = “Shell extensions for NetWare” -> {HKLM…CLSID} = “NetWare Objects” \InProcServer32(Default) = “nwprovau.dll” [MS] “{e3f2bac0-099f-11cf-8daa-00aa004a5691}” = “Shell extensions for NetWare” -> {HKLM…CLSID} = “NetWare UNC Folder Menu” \InProcServer32(Default) = “nwprovau.dll” [MS] “{52c68510-09a0-11cf-8daa-00aa004a5691}” = “Shell extensions for NetWare” -> {HKLM…CLSID} = “NetWare Hood Verbs” \InProcServer32(Default) = “nwprovau.dll” [MS] “{BD88A479-9623-4897-8546-BC62B9628F44}” = “SPTHandler” -> {HKLM…CLSID} = “SPTHandler” \InProcServer32(Default) = “C:\Program Files\Spyware Terminator\sptcontmenu.dll” [“Crawler.com”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] SPTContMenu(Default) = “{BD88A479-9623-4897-8546-BC62B9628F44}” -> {HKLM…CLSID} = “SPTHandler” \InProcServer32(Default) = “C:\Program Files\Spyware Terminator\sptcontmenu.dll” [“Crawler.com”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] NetWareUNCMenu(Default) = “{e3f2bac0-099f-11cf-8daa-00aa004a5691}” -> {HKLM…CLSID} = “NetWare UNC Folder Menu” \InProcServer32(Default) = “nwprovau.dll” [MS] SPTContMenu(Default) = “{BD88A479-9623-4897-8546-BC62B9628F44}” -> {HKLM…CLSID} = “SPTHandler” \InProcServer32(Default) = “C:\Program Files\Spyware Terminator\sptcontmenu.dll” [“Crawler.com”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ SPTContMenu(Default) = “{BD88A479-9623-4897-8546-BC62B9628F44}” -> {HKLM…CLSID} = “SPTHandler” \InProcServer32(Default) = “C:\Program Files\Spyware Terminator\sptcontmenu.dll” [“Crawler.com”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoCDBurning” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be enabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\maciek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\maciek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp” Active Desktop web content (hidden if disabled): HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\1\ “FriendlyName” = “” “Source” = “file:///C:/DOCUME~1/maciek/LOCALS~1/Temp/msohtml1/01/clip_image002.gif” “SubscribedURL” = “file:///C:/DOCUME~1/maciek/LOCALS~1/Temp/msohtml1/01/clip_image002.gif” DESKTOP.INI DLL launch in local fixed drive directories: -------------------------------------------------------- WARNING! D: is an unreadable partition! Enabled Scheduled Tasks: ------------------------ “Uniblue SpeedUpMyPC Nag” -> launches: “C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s” [file not found] “Uniblue SpeedUpMyPC” -> launches: “C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s” [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\nwprovau.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 22 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” -> {HKLM…CLSID} = “Yahoo! Toolbar” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll” [“Yahoo! Inc.”] “{2E5E800E-6AC0-411E-940A-369530A35E43}” = (no title provided) -> {HKLM…CLSID} = “The Weather Channel Toolbar” \InProcServer32(Default) = “C:\WINDOWS\system32\TwcToolbarIe7.dll” [null data] Explorer Bars HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\ {137E6E5E-A205-4657-A49F-1AB865787089}(Default) = (no title provided) -> {HKLM…CLSID} = “SmartShopper” \InProcServer32(Default) = “C:\Program Files\SmartShopper\Bin\2.0.20\SmrtShpr.dll” [“SmartShopper Networks”] HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{2E5E800E-6AC0-411E-940A-369530A35E43}(Default) = “The Weather Channel Toolbar” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\WINDOWS\system32\TwcToolbarIe7.dll” [null data] HKLM\Software\Classes\CLSID{2E5E800E-6AC0-411E-940A-369530A35E43}(Default) = “The Weather Channel Toolbar” Implemented Categories{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32(Default) = “C:\WINDOWS\system32\TwcToolbarIe7.dll” [null data] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {2E5E800E-6AC0-411E-940A-369530A35E43}\ “ButtonText” = “The Weather Channel” “MenuText” = “The Weather Channel” {85D1F590-48F4-11D9-9669-0800200C9A66}\ “MenuText” = “Uninstall BitDefender Online Scanner v8” “Exec” = “%windir%\bdoscandel.exe” [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] Client Service for NetWare, NWCWorkstation, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\nwwks.dll” [MS]} Comodo Application Agent, CmdAgent, “C:\Program Files\Comodo\Firewall\cmdagent.exe” [“COMODO”] Diskeeper, Diskeeper, ““C:\Program Files\Executive Software\DiskeeperLite\DKService.exe”” [“Executive Software International, Inc.”] LightScribeService Direct Disc Labeling Service, LightScribeService, ““C:\Program Files\Common Files\LightScribe\LSSrvc.exe”” [“Hewlett-Packard Company”] Spyware Terminator Realtime Shield Service, sp_rssrv, ““C:\Program Files\Spyware Terminator\sp_rsser.exe”” [“Crawler.com”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 104 seconds. ---------- (total run time: 876 seconds)

Logfile of HijackThis v1.99.1 Scan saved at 19:12:09, on 2007-09-21 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\setup\avast.setup C:\Documents and Settings\maciek\My Documents\Moje listy odtwarzania\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://resultsmaster.com/SmartOffers/Se … ftPane.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.wp.pl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1; O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: TwcToolbarBhoApp Class - {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\WINDOWS\system32\TwcToolbarBho.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll O4 - HKLM…\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe O4 - HKLM…\Run: [spywareTerminator] “C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe” O4 - HKLM…\Run: [COMODO Firewall Pro] “C:\Program Files\Comodo\Firewall\CPF.exe” /background O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [VTPreset] VTPreset.exe O4 - HKCU…\Run: [DW4] “C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe” O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file) O9 - Extra ‘Tools’ menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file) O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar … vSniff.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.co.uk/scan_uk/scan8/oscan8.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar … /cabsa.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Spyware Terminator Clam Service (sp_clamsrv) - Crawler.com - C:\Program Files\WinClamAVShield\sp_clamsrv.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Z góry wielkie dzięki za pomoc. :mrgreen:

jessica · 22 Wrzesień 2007 17:46

Ja nie widzę tych logach nic podejrzanego.

Możesz dać jeszcze log z ComboFix (na dole tej strony z linku) -

Log wklej na http://wklej.org/, a w poście daj tylko link.(czyli skopiuj adres z paska adresów) .

jessi

Agaton · 22 Wrzesień 2007 17:51

macko44

Na Forum używamy polskich znaków.

Proszę poprawić pisownię zarówno w temacie, jak i w opisie problemu.

W celu edycji swojego posta proszę skorzystać z przycisku

Zignorowanie prośby będzie skutkowało usunięciem tematu do Kosza.

macko44 · 23 Wrzesień 2007 18:22

ComboFix 07-09-21.2 - “maciek” 2007-09-22 19:16:40.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1033.18.92 [GMT 1:00] * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\DOCUME~1\maciek\APPLIC~1\HbTools_Icons C:\DOCUME~1\maciek\APPLIC~1\HbTools_Icons\games2.ico C:\DOCUME~1\maciek\APPLIC~1\HbTools_Icons\Registryrepair.ico C:\DOCUME~1\maciek\APPLIC~1\HbTools_Icons\wallpapere1.ico . ((((((((((((((((((((((((( Files Created from 2007-08-22 to 2007-09-22 ))))))))))))))))))))))))))))))) . 2007-09-22 19:1551,200–a------C:\WINDOWS\NirCmd.exe 2007-09-09 17:35 2007-09-02 20:42 2007-09-01 23:08499,712–a------C:\WINDOWS\system32\msvcp71.dll 2007-09-01 23:08348,160–a------C:\WINDOWS\system32\msvcr71.dll 2007-09-01 23:081,060,864–a------C:\WINDOWS\system32\MFC71.dll 2007-09-01 23:081,056,768–a------C:\WINDOWS\system32\ROBOEX32.DLL 2007-09-01 23:0613,952---------C:\WINDOWS\system32\drivers\UBHelper.sys 2007-09-01 23:06 2007-09-01 23:04 2007-09-01 23:04 2007-09-01 23:04 2007-09-01 23:021,024-r-h-----C:\WINDOWS\system32\NTIMPEG2.dll 2007-09-01 23:021,024-r-h-----C:\WINDOWS\system32\NTIMP3.dll 2007-09-01 23:021,024-r-h-----C:\WINDOWS\system32\NTIFCD3.dll 2007-09-01 23:021,024-r-h-----C:\WINDOWS\system32\NTICDMK7.dll 2007-09-01 22:436,144–a------C:\WINDOWS\system32\drivers\NTIDrvr.sys 2007-08-26 13:43 2007-08-26 13:43 2007-08-26 13:41 2007-08-26 11:47 2007-08-26 11:42 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-22 18:10---------d--------C:\Program Files\NAPI-PROJEKT 2007-09-22 17:37---------d--------C:\DOCUME~1\maciek\APPLIC~1\uTorrent 2007-09-22 17:34---------d--------C:\Program Files\Spyware Terminator 2007-09-22 17:34---------d--------C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator 2007-09-22 11:00---------d--------C:\DOCUME~1\maciek\APPLIC~1\Spyware Terminator 2007-09-20 21:29---------d--------C:\DOCUME~1\maciek\APPLIC~1\Skype 2007-09-06 11:09801144–a------C:\WINDOWS\system32\aswBoot.exe 2007-09-06 11:0594416–a------C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 11:0592848–a------C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 11:0323152–a------C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 11:0242912–a------C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 11:0095608–a------C:\WINDOWS\system32\AvastSS.scr 2007-09-06 11:0026624–a------C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-02 20:46138624–a------C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2007-09-01 23:08---------d–h-----C:\Program Files\InstallShield Installation Information 2007-08-26 09:45---------d--------C:\Program Files\WinClamAVShield 2007-08-12 21:13---------d-a------C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-08-09 20:47---------d--------C:\Program Files\AusLogics Registry Defrag 2007-08-09 08:48---------d--------C:\Program Files\RegCleaner 2007-08-04 10:02---------d--------C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion 2007-08-04 10:00---------d--------C:\Program Files\Yahoo! 2007-08-04 10:00---------d--------C:\Program Files\SmartShopper 2007-08-04 10:00---------d--------C:\Program Files\Pogoda 2007-08-04 09:59---------d--------C:\Program Files\The Weather Channel Toolbar 2007-08-04 09:59---------d--------C:\DOCUME~1\maciek\APPLIC~1\SmartShopper 2007-08-04 09:56---------d--------C:\Program Files\The Weather Channel FW 2007-08-02 20:57---------d--------C:\Program Files\The Playa 2007-08-02 20:57---------d--------C:\Program Files\NimoCodec Pack 2007-08-02 20:57---------d--------C:\Program Files\DivXCodec 2007-08-02 20:54---------d--------C:\Program Files\Ligos 2007-08-02 00:00---------d--------C:\Program Files\Astonsoft 2007-08-01 22:57---------d--------C:\DOCUME~1\maciek\APPLIC~1\DeepBurner 2007-07-31 19:03---------d--------C:\Program Files\Skype 2007-07-31 19:03---------d--------C:\Program Files\Common Files\Skype 2007-07-31 19:03---------d--------C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype 2007-07-28 17:03---------d--------C:\DOCUME~1\maciek\APPLIC~1\VersionTracker Pro 2007-07-28 16:56---------d--------C:\Program Files\TechTracker 2007-03-30 18:493297744–a------C:\Program Files\WindowsXP-KB835935-SP2-PLK.exe 2007-01-29 22:35:4288–sh–rC:\WINDOWS\system32\75E30FA123.sys 2007-01-29 22:36:033,350–sha-wC:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “WinPatrol”=“C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe” [2007-02-12 10:17] “SpywareTerminator”=“C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe” [2007-09-02 20:44] “COMODO Firewall Pro”=“C:\Program Files\Comodo\Firewall\CPF.exe” [2007-04-29 22:10] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “VTPreset”=“VTPreset.exe” [2004-02-24 20:17 C:\WINDOWS\system32\VTPreset.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “DW4”=“C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe” [2007-03-16 07:51] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] “Authentication Packages”= msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] “C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe” -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start R0 UBHelper;UBHelper;C:\WINDOWS\System32\drivers\UBHelper.sys R1 sp_rsdrv2;Spyware Terminator Driver 2;??\C:\WINDOWS\System32\drivers\sp_rsdrv2.sys *Newly Created Service* - CATCHME . Contents of the ‘Scheduled Tasks’ folder “2007-08-03 21:44:21 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job” - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe “2007-08-03 21:40:03 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job” - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-22 19:19:46 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-22 19:20:34 C:\ComboFix-quarantined-files.txt … 2007-09-22 19:20 . — E O F —

Gutek · 23 Wrzesień 2007 19:47

Pobierz program SDFix

macko44 · 24 Wrzesień 2007 20:00

SDFix: Version 1.107


Run by maciek on 2007-09-24 at 20:35


Microsoft Windows XP [Version 5.1.2600]


Running From: C:\DOCUME~1\maciek\Desktop\SDFix\SDFix


Safe Mode:

Checking Services: 



Restoring Windows Registry Values

Restoring Windows Default Hosts File


Rebooting...



Normal Mode:

Checking Files: 


Trojan Files Found:


C:\WINDOWS\system32\TFTP1828 - Deleted




Removing Temp Files...


ADS Check:


C:\WINDOWS

No streams found. 


C:\WINDOWS\system32

No streams found. 


C:\WINDOWS\system32\svchost.exe

No streams found.


C:\WINDOWS\system32\ntoskrnl.exe

No streams found.




                                 Final Check:


Remaining Services:

------------------





Authorized Application Key Export:


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


Remaining Files:

---------------


File Backups: - C:\DOCUME~1\maciek\Desktop\SDFix\SDFix\backups\backups.zip


Files with Hidden Attributes:


Mon 29 Jan 2007 88 ..SHR --- "C:\WINDOWS\system32\75E30FA123.sys"

Mon 29 Jan 2007 3,350 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"

Fri 21 Sep 2007 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"

Sat 1 Sep 2007 1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll"

Sat 1 Sep 2007 1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll"

Sat 1 Sep 2007 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"

Wed 20 Dec 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"


Finished!

Gutek · 24 Wrzesień 2007 20:37

Nowy log z Combo