Powolny komp i "zżarło" 350mhz

[shamblerek (Shambler)]

To sa logi mojego kuzyna - nie moze sie zarejestrowac.

Komp ma 1.4 Ghz, a pokazuje 1 Ghz i chodzi słabo…

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:52:55, on 2007-09-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\DAEMON Tools SearchBar\Search.exe C:\Program Files\DAEMON Tools SearchBar\whse.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\WhenU\DTAdapter.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Tlen.pl\tlen.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\totalcmd\TOTALCMD.EXE C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\DAEMON Tools SearchBar\search.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM…\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKCU…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_01] cmd.exe /c md “%USERPROFILE%\Ustawienia lokalne\Temp” (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_03] cmd.exe /c md “%SystemRoot%\System32\dllcache” (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_04] cmd.exe /C move “%SystemRoot%\System32\syssetub.dll” “%SystemRoot%\System32\syssetup.dll” (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-20…\RunOnce: [nlpo_01] cmd.exe /c md “%USERPROFILE%\Ustawienia lokalne\Temp” (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe – End of file - 3558 bytes

Combofix

ComboFix 07-08-30.3 - “JJ” 2007-09-01 19:47:01.1 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.7 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\sisport.sys ((((((((((((((((((((((((( Files Created from 2007-08-01 to 2007-09-01 ))))))))))))))))))))))))))))))) 2007-09-01 19:44 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-29 16:39 0 --a------ C:\WINDOWS\PowerReg.dat 2007-08-28 20:44 2007-08-27 15:10 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-08-27 11:12 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe 2007-08-27 11:12 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll 2007-08-27 11:12 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll 2007-08-27 11:12 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll 2007-08-27 11:12 194,320 --a------ C:\WINDOWS\system32\qcut.dll 2007-08-27 11:12 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll 2007-08-27 11:12 10,240 --a------ C:\WINDOWS\system32\vidx16.dll 2007-08-22 17:22 4,096 --a------ C:\WINDOWS\d3dx.dat 2007-08-20 19:07 2007-08-20 18:57 2007-08-20 18:47 765,952 -ra------ C:\WINDOWS\system\crlds3d.dll 2007-08-20 18:47 712,704 -ra------ C:\WINDOWS\system32\Audio3D.dll 2007-08-20 18:47 712,704 -ra------ C:\WINDOWS\system32\a3d.dll 2007-08-20 18:47 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-08-20 18:47 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-08-20 18:47 389,135 -ra------ C:\WINDOWS\system32\drivers\cmuda.sys 2007-08-20 18:47 28,672 -ra------ C:\WINDOWS\system32\udaprop.dll 2007-08-20 18:47 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-08-20 18:47 2007-08-20 18:42 2007-08-20 20:05:21 troy (1217608) 18:39 32,768 -ra------ C:\WINDOWS\SIS_LIB.DLL 2007-08-20 18:39 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-20 18:39 102,400 -ra------ C:\WINDOWS\SiSUSBrg.exe 2007-08-20 18:39 2007-08-20 18:38 2007-08-20 18:31 2007-08-20 18:26 304,640 --a------ C:\WINDOWS\IsUn0415.exe 2007-08-20 18:26 2007-08-20 16:14 2007-08-20 16:14 2007-08-20 15:52 1,156 --a------ C:\WINDOWS\mozver.dat 2007-08-20 15:31 2007-08-20 15:30 2007-08-20 15:30 2007-08-20 15:29 2007-08-20 15:28 2007-08-20 15:26 2007-08-20 15:25 2007-08-20 15:13 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-08-20 15:10 2007-08-20 15:10 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-20 15:44 28400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 20:05:21 troy (1217608) 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2001-11-23 06:08 712704 -ra------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{BA2325ED-F9EB-4830-8FCE-0BC35B16969B}] 2006-08-17 17:30 242040 --a------ C:\Program Files\DAEMON Tools SearchBar\search.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SiSUSBRG”=“C:\WINDOWS\SiSUSBrg.exe” [2002-04-26 11:17] “Cmaudio”=“cmicnfg.cpl” [] “NvCplDaemon”=“NvQTwk” [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2007-08-16 13:24] R3 DC21x4;Sterownik karty sieciowej oparty na sterowniku DC21x4;C:\WINDOWS\system32\DRIVERS\dc21x4.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{6bf2f2c3-e52b-11db-9ad2-806d6172696f}] AutoRun\command- D:\menu.exe *Newly Created Service* - CATCHME *Newly Created Service* - HTTPFILTER ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-01 19:49:08 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-09-01 19:50:17 C:\ComboFix-quarantined-files.txt … 2007-09-01 19:50 — E O F —

Silent Runner

“Silent Runners.vbs”, revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “WhenUSearch” = ““C:\Program Files\DAEMON Tools SearchBar\Search.exe”” [“WhenU.com, Inc.”] “WhenUSearchWHSE” = ““C:\Program Files\DAEMON Tools SearchBar\whse.exe”” [“WhenU.com, Inc.”] “SiSUSBRG” = “C:\WINDOWS\SiSUSBrg.exe” [“Silicon Integrated Systems Corp.”] “Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS] “NvCplDaemon” = “RUNDLL32.EXE NvQTwk,NvCplDaemon initialize” [MS] “KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k” HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}(Default) = “Internet Explorer” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = “flashget urlcatch” -> {HKLM…CLSID} = “FGCatchUrl” \InProcServer32(Default) = “C:\Program Files\FlashGet\jccatch.dll” [“www.flashget.com”] {BA2325ED-F9EB-4830-8FCE-0BC35B16969B}(Default) = (no title provided) -> {HKLM…CLSID} = “WhenUSearch Helper” \InProcServer32(Default) = “C:\Program Files\DAEMON Tools SearchBar\search.dll” [“WhenU.com, Inc.”] {F156768E-81EF-470C-9057-481BA8380DBA}(Default) = (no title provided) -> {HKLM…CLSID} = “FlashGet GetFlash Class” \InProcServer32(Default) = “C:\Program Files\FlashGet\getflash.dll” [“www.flashget.com”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{3028902F-6374-48b2-8DC6-9725E775B926}” = “IE Microsoft AutoComplete” -> {HKLM…CLSID} = “IE Microsoft AutoComplete” \InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\shdocvw.dll” [MS] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Eksplorator pulpitów” -> {HKLM…CLSID} = “Eksplorator pulpitów” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\web\wallpaper\Idylla.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\web\wallpaper\Idylla.bmp”

Z gory dziekuje za pomoc!

[Leon1 (Leon$)]

O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\DAEMON Tools SearchBar\search.dll O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_01] cmd.exe /c md “%USERPROFILE%\Ustawienia lokalne\Temp” (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_03] cmd.exe /c md “%SystemRoot%\System32\dllcache” (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_04] cmd.exe /C move O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-19…\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\RunOnce: [nlpo_01] cmd.exe /c md “%USERPROFILE%\Ustawienia lokalne\Temp” (User ‘USŁUGA SIECIOWA’)

Usuń HijackThisem pogrubione usuń ręcznie z dysku

[Troy (Troyz)]

Dzięki wielkie, już chyba widać poprawę a wie ktoś co/jak zrobić, żeby te zagubione herce wróciły do mnie?