Komp się zawiesza i wolno chodzi - proszę o sprawdzenie loga

Jimy · 6 Grudzień 2007 21:42

Wklejam loga i proszę o pomoc

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\BetterShare\BetterShare.exe

D:\instalki\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Gutek · 6 Grudzień 2007 21:54

odinstaluj

Daj log z ComboFix

Jimy · 6 Grudzień 2007 22:15

Kurcze wiesz co jak wchodze w Moj komputer->Panel sterowania->dodaj usun to nie mam tam tego, a jak wejde w start i wszystkie programy to tam mam ale tylko ikone do otwarcia tego programu nie mam nigdzie ikony odinstalowujacej.

Gutek · 7 Grudzień 2007 15:37

C:\Program Files\BetterShare\BetterShare.exe usuń folder w trybie awaryjnym.

gdzie jest log

Jimy · 7 Grudzień 2007 17:45

Sory szefunio ze tak pozno ale czasu nie bylo.

ComboFix 07-12-07.5 - Luj 2007-12-07 18:32:38.1 - NTFSx86

Gutek · 8 Grudzień 2007 01:56

Pobierz program SDFix

Jimy · 8 Grudzień 2007 15:42

Zrobione szefo oto report:

SDFix: Version 1.117 Run by Administrator on 2007-12-08 at 16:33 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-08 16:37:27 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … IPC error: 2 Nie można odnaleźć określonego pliku. scanning hidden services & system hive … scanning hidden registry entries … [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… scanning hidden files … C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temp\asd3.tmp 191 bytes scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 1 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “C:\Program Files\Skype\Phone\Skype.exe”=“C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Sun 14 Oct 2007 56 …SHR — “C:\WINDOWS\system32\CF355EDE6B.sys” Sun 14 Oct 2007 10,126 A.SH. — “C:\WINDOWS\system32\KGyGaAvL.sys” Mon 1 Oct 2007 4,348 …SH. — “C:\Documents and Settings\All Users\DRM\DRMv1.bak” Finished!

Gutek · 8 Grudzień 2007 17:06

Wklej do Notatnika:

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

Jimy · 9 Grudzień 2007 18:10

ComboFix 07-12-07.5 - Luj 2007-12-09 18:59:03.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.132 [GMT 1:00] Running from: C:\Documents and Settings\Luj.LUJ-B254CA46951\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-09 to 2007-12-09 ))))))))))))))))))))))))))))))) . 2007-12-09 15:12 . 2007-12-09 15:12 2007-12-08 16:32 . 2007-12-08 16:32 2007-12-07 18:38 . 2007-12-07 18:38 2007-12-07 18:38 . 2007-12-07 18:41 2007-12-07 18:38 . 2007-12-07 18:38 2007-12-06 15:33 . 2005-02-27 21:48 356,352 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax 2007-11-21 21:38 . 2007-12-04 17:32 2007-11-21 14:53 . 2007-12-08 16:30 576 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-11-20 18:55 . 2007-11-20 18:55 2007-11-20 17:13 . 2007-11-20 17:13 2007-11-20 16:11 . 2007-11-20 16:11 2007-11-20 16:11 . 2003-03-18 22:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-11-20 16:11 . 2007-09-06 12:09 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-20 16:11 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-11-20 16:11 . 2007-09-06 12:00 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-11-20 16:11 . 2007-09-06 12:05 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-11-20 16:11 . 2007-09-06 12:05 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-11-20 16:11 . 2007-09-06 12:02 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-11-20 16:11 . 2007-09-06 12:00 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-20 16:11 . 2007-09-06 12:03 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-11-19 15:01 . 2007-11-19 15:01 2007-11-12 13:36 . 2004-08-04 01:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-11-12 13:30 . 2007-11-14 17:45 995 --a------ C:\WINDOWS\VPlayer.INI 2007-11-12 13:30 . 2007-11-14 17:45 128 --a------ C:\WINDOWS\VplayerINI.vpl 2007-11-10 10:39 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-11-10 10:38 . 2007-11-10 10:39 2007-11-09 23:13 . 2007-12-06 21:36 116 --a------ C:\WINDOWS\NeroDigital.ini 2007-11-09 19:49 . 2007-11-09 19:49 2007-11-09 19:46 . 2007-11-10 16:26 2007-11-09 19:44 . 2007-11-09 19:44 2007-11-09 19:44 . 2007-11-09 19:44 2007-11-09 19:44 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-11-09 19:44 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-11-09 19:44 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-11-09 19:44 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-11-09 19:44 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-11-09 19:44 . 2006-01-12 16:40 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-11-09 19:44 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-09 16:37 --------- d-----w C:\Documents and Settings\Luj.LUJ-B254CA46951\Dane aplikacji\Skype 2007-12-09 16:35 196 ----a-w C:\WINDOWS\system32\drivers\ALCICH.DAT 2007-12-09 14:14 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-06 14:33 --------- d-----w C:\Program Files\Real Alternative 2007-11-23 22:26 --------- d-----w C:\Program Files\Google 2007-11-19 16:25 --------- d-----w C:\Program Files\TransRus 2007-11-03 14:41 --------- d-----w C:\Program Files\Common Files\snpstd3 2007-11-03 14:39 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-03 14:39 --------- d-----w C:\Program Files\WebEye 2007-10-31 23:07 --------- d-----w C:\Program Files\SubEdit-Player 2007-10-31 22:52 --------- d-----w C:\Program Files\Crystal Player 2007-10-29 17:41 --------- d-----w C:\Program Files\AvRack 2007-10-27 11:21 --------- d-----w C:\Program Files\ffdshow 2007-10-22 14:47 --------- d-----w C:\Program Files\AVIcodec 2007-10-21 18:51 14,712 ----a-w C:\Documents and Settings\Luj.LUJ-B254CA46951\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-10-21 15:36 --------- d-----w C:\Documents and Settings\Luj.LUJ-B254CA46951\Dane aplikacji\Media Player Classic 2007-10-21 15:16 --------- d-----w C:\Program Files\Lavalys 2007-10-20 11:05 --------- d-----w C:\Program Files\Winamp 2007-10-20 10:10 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-19 20:48 --------- d-----w C:\Program Files\Skype 2007-10-15 17:05 394,016 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-15 16:57 11,635,488 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-15 16:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-10-15 15:05 44,180 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-15 15:05 169,220 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-14 13:45 10,126 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-10-13 21:39 --------- d-----w C:\Documents and Settings\Luj\Dane aplikacji\Skype 2007-10-11 19:57 --------- d-----w C:\Program Files\Common Files\Java . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2006-11-14 10:12] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] 2007-09-06 12:06 79224 --a------ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CameraFixer] 2005-10-03 11:23 20480 --------- C:\WINDOWS\CameraFixer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2004-08-04 01:44 15360 --a------ C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] C:\Program Files\Konnekt\konnekt.exe /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2006-01-12 16:40 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3] 2005-09-05 15:55 339968 --a------ C:\WINDOWS\vsnpstd3.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-09-25 01:11 132496 --a------ C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnpstd3] 2005-11-04 15:05 90112 --a------ C:\WINDOWS\tsnpstd3.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2006-06-21 18:14 35328 --a------ C:\Program Files\Winamp\winampa.exe R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys S2 SPF4;Sunbelt Personal Firewall 4;“C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe” S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS . ------------------ PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156] -> C:\DOCUME~1\LUJ~1.LUJ\USTAWI~1\Temp\bvuijwxxCA46951.dll . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-09 19:04:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-09 19:08:28 C:\ComboFix2.txt … 2007-12-08 18:28 . — E O F —

Gutek · 9 Grudzień 2007 23:16

Użyj ATF-Cleaner - http://www.atribune.org/ccount/click.php?id=1 i oczyść TEMP