Mam taki otóż problem, że kiedy włączam kompa to gdy już ładuje się windows i jest napisane: Zapraszamy to muszę czekać z 2min aż się wszystko załaduje, na początku załadowuje się ale nie ma ikon na pulpicie ani nic i muszę czekać, a jeszcze kilka dni temu było normalnie, nie wiem czym to jest spowodowane…proszę o pomoc 
:x 
ComboFix 09-05-14.07 - Grzesiek 2009-05-15 18:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.2047.1634 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Grzesiek\Pulpit\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_OREANS32
-------\Service_oreans32
((((((((((((((((((((((((( Pliki utworzone od 2009-04-15 do 2009-05-15 )))))))))))))))))))))))))))))))
.
2009-05-13 20:55 . 2009-05-13 20:56 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-05-13 20:40 . 2009-05-13 20:55 26588 ----a-w c:\windows\DIIUnin.dat
2009-05-13 20:40 . 2009-05-13 20:40 2829 ----a-w c:\windows\DIIUnin.pif
2009-05-13 20:40 . 2009-05-13 20:40 106496 ----a-w c:\windows\DIIUnin.exe
2009-05-12 20:50 . 2006-10-26 17:56 32592 ----a-w c:\windows\system32\msonpmon.dll
2009-05-12 20:47 . 2009-05-12 20:47 -------- d-----w c:\program files\Microsoft Works
2009-05-12 20:46 . 2009-05-12 20:46 -------- d-----w c:\program files\MSBuild
2009-05-12 20:45 . 2009-05-12 20:45 -------- d-----w c:\program files\Microsoft.NET
2009-05-12 20:43 . 2009-05-12 20:43 -------- d-----w c:\program files\Microsoft Visual Studio 8
2009-05-12 20:43 . 2009-05-12 20:43 -------- d-----w c:\documents and settings\Grzesiek\Ustawienia lokalne\Dane aplikacji\Microsoft Help
2009-05-12 20:42 . 2009-05-12 20:56 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2009-05-12 20:42 . 2009-05-12 20:42 -------- d–h--r C:\MSOCache
2009-05-12 16:17 . 2009-05-12 16:17 18304 ----a-w c:\documents and settings\Grzesiek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-11 20:02 . 1998-10-07 10:54 327168 ----a-w c:\windows\IsUn0415.exe
2009-05-11 19:27 . 2009-05-11 19:27 -------- d–h--w c:\windows\PIF
2009-05-10 20:25 . 2009-05-13 16:53 -------- d-----w c:\documents and settings\Grzesiek\Dane aplikacji\HPAppData
2009-05-10 19:53 . 2009-05-10 19:53 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\WEBREG
2009-05-10 19:52 . 2008-01-24 21:22 309760 ----a-r c:\windows\system32\difxapi.dll
2009-05-10 19:52 . 2008-01-24 21:22 372736 ----a-r c:\windows\system32\hppldcoi.dll
2009-05-10 19:52 . 2008-01-24 21:22 303104 ----a-r c:\windows\system32\hpovst15.dll
2009-05-10 19:52 . 2008-01-24 21:22 581632 ----a-r c:\windows\system32\hpotscl6.dll
2009-05-10 19:52 . 2008-01-24 21:22 729088 ----a-r c:\windows\system32\hpowiax7.dll
2009-05-10 19:47 . 2009-05-10 19:47 -------- d-----w c:\documents and settings\Grzesiek\Ustawienia lokalne\Dane aplikacji\HP
2009-05-10 19:43 . 2009-05-10 19:43 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant
2009-05-10 19:41 . 2009-05-10 19:53 178279 ----a-w c:\windows\hpoins28.dat
2009-05-10 19:41 . 2008-07-01 04:02 796 ------w c:\windows\hpomdl28.dat
2009-05-10 19:23 . 2008-01-24 21:22 16496 ----a-r c:\windows\system32\drivers\HPZipr12.sys
2009-05-10 19:23 . 2008-01-24 21:22 49920 ----a-r c:\windows\system32\drivers\HPZid412.sys
2009-05-10 19:23 . 2009-05-10 19:23 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard
2009-05-10 19:23 . 2008-01-24 21:23 271704 ----a-r c:\windows\system32\hpzids01.dll
2009-05-10 19:23 . 2007-10-20 16:25 118272 ----a-w c:\windows\system32\hpz3l5mu.dll
2009-05-10 19:23 . 2008-01-24 21:22 21568 ----a-r c:\windows\system32\drivers\HPZius12.sys
2009-05-10 19:13 . 2009-05-10 19:13 -------- d-----w c:\documents and settings\Grzesiek\Dane aplikacji\Teleca
2009-05-10 19:09 . 2009-05-10 19:09 -------- d-----w c:\documents and settings\Grzesiek\Dane aplikacji\Sony Ericsson
2009-05-10 19:09 . 2009-05-10 19:09 -------- d-----w c:\program files\Common Files\Sony Ericsson Shared
2009-05-10 19:09 . 2009-05-10 19:10 -------- d-----w c:\program files\Common Files\Teleca Shared
2009-05-10 19:09 . 2009-05-10 19:09 -------- d-----w c:\program files\Sony Ericsson
2009-05-10 19:08 . 2009-05-10 19:09 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Teleca
2009-05-10 19:07 . 2009-05-10 19:07 -------- d-----w c:\documents and settings\Grzesiek\Dane aplikacji\HP
2009-05-10 19:02 . 2009-05-10 19:44 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP
2009-05-10 19:02 . 2009-05-10 19:02 -------- d-----w c:\program files\Common Files\HP
2009-05-10 19:02 . 2009-05-10 19:02 -------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-05-10 19:01 . 2004-08-03 21:01 25856 -c–a-w c:\windows\system32\dllcache\usbprint.sys
2009-05-10 19:01 . 2004-08-03 21:01 25856 ----a-w c:\windows\system32\drivers\usbprint.sys
2009-05-10 19:00 . 2009-05-10 19:53 -------- d-----w c:\program files\HP
2009-05-10 18:49 . 2009-05-10 18:49 -------- d-----w c:\documents and settings\LocalService\Menu Start
2009-05-10 18:49 . 2009-05-10 18:49 -------- d-s—w c:\windows\system32\Microsoft
2009-05-10 18:42 . 2009-05-10 18:42 -------- d-----w c:\windows\ServicePackFiles
2009-05-10 18:40 . 2004-08-03 20:43 15872 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-10 18:38 . 2009-05-10 18:43 -------- d-----w c:\windows\EHome
2009-05-10 18:28 . 2004-08-03 20:58 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-05-10 18:20 . 2004-08-03 21:08 31616 ----a-w c:\windows\system32\drivers\usbccgp.sys
2009-05-10 11:20 . 2009-05-10 11:20 -------- d-----w c:\documents and settings\Grzesiek\Dane aplikacji\U3
2009-05-10 08:45 . 2009-05-10 08:45 -------- d-----w c:\windows\system32\AGEIA
2009-05-10 08:45 . 2009-05-10 08:45 -------- d-----w c:\program files\AGEIA Technologies
2009-05-10 08:44 . 2009-05-10 08:44 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-08 12:48 . 2009-05-08 12:48 -------- d-----w c:\documents and settings\Grzesiek\Ustawienia lokalne\Dane aplikacji\Ahead
2009-05-06 21:37 . 2009-05-06 21:37 33824 ----a-w c:\windows\system32\drivers\oreans32.sys
2009-05-06 15:54 . 2009-05-06 15:54 -------- d-----w c:\windows\Logs
2009-05-06 15:49 . 2009-05-06 15:49 22328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-05-06 15:49 . 2009-05-06 15:49 22328 ----a-w c:\documents and settings\Grzesiek\Dane aplikacji\PnkBstrK.sys
2009-05-06 15:49 . 2009-05-06 15:49 107832 ----a-w c:\windows\system32\PnkBstrB.exe
2009-05-06 15:49 . 2009-05-06 15:49 66872 ----a-w c:\windows\system32\PnkBstrA.exe
2009-05-06 15:49 . 2009-05-06 15:49 682280 ----a-w c:\windows\system32\pbsvc.exe
2009-05-06 15:49 . 2009-05-06 15:49 -------- d-----w c:\windows\system32\LogFiles
2009-05-06 15:31 . 2009-05-06 15:31 -------- d-sh–w c:\windows\ftpcache
2009-05-06 15:29 . 2004-08-22 14:31 155136 ----a-w c:\windows\system32\drivers\d347bus.sys
2009-05-06 15:29 . 2004-08-22 14:31 5248 ----a-w c:\windows\system32\drivers\d347prt.sys
2009-05-06 15:29 . 2009-05-06 15:29 -------- d-----w c:\program files\D-Tools
2009-05-06 15:29 . 2009-05-06 15:29 -------- d-----w c:\windows\Downloaded Installations
2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\program files\A4Tech
2009-05-05 16:16 . 2009-05-05 16:16 -------- d-----w c:\program files\Common Files\INCA Shared
2009-05-05 16:15 . 2005-01-04 18:43 4682 ----a-w c:\windows\system32\npptNT2.sys
2009-05-05 14:31 . 2009-05-05 14:50 -------- d-----w c:\program files\Rapid Express
2009-05-04 15:01 . 2009-05-04 15:05 -------- d-----w c:\program files\The KMPlayer
2009-05-04 08:10 . 2009-05-10 19:09 -------- d-----w c:\documents and settings\Grzesiek\Ustawienia lokalne\Dane aplikacji\Sony Ericsson
2009-05-04 08:09 . 2009-05-10 19:42 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-04 08:09 . 2009-05-10 19:09 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson
2009-05-04 07:59 . 2009-05-04 07:59 -------- d-----w c:\program files\Usb to Serial Driver 1.12.28
2009-05-04 07:59 . 2007-06-09 14:22 -------- d-----w c:\program files\usb-uart tx line
2009-05-04 07:34 . 2004-08-03 22:44 192000 ----a-w c:\windows\system32\iuengine.dll
2009-05-04 05:24 . 2009-05-04 05:24 -------- d-----w c:\program files\Eurobarre
2009-05-04 05:24 . 2009-05-04 05:24 15872 ------w c:\windows\system32\winskfr.dll
2009-05-04 05:24 . 2009-05-04 05:24 119568 ------w c:\windows\system32\vb6fr.dll
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-15 15:55 . 2009-05-03 20:16 196608 ----a-w c:\windows\system32\drivers\aStandard.bin
2009-05-14 19:35 . 2009-05-03 20:34 -------- d-----w c:\program files\DC++
2009-05-13 10:38 . 2009-05-03 20:23 69680 ----a-w c:\documents and settings\Grzesiek\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-10 19:17 . 2001-10-26 16:15 74230 ----a-w c:\windows\system32\perfc015.dat
2009-05-10 19:17 . 2001-10-26 16:15 448004 ----a-w c:\windows\system32\perfh015.dat
2009-05-10 12:11 . 2009-05-03 20:09 -------- d–h--w c:\program files\InstallShield Installation Information
2009-05-04 16:26 . 2009-05-03 20:26 -------- d-----w c:\program files\Common Files\LightScribe
2009-05-04 15:03 . 2009-05-03 20:37 -------- d-----w c:\program files\ACE Mega CoDecS Pack
2009-05-03 21:20 . 2009-05-03 21:20 -------- d-----w c:\program files\Lavalys
2009-05-03 21:00 . 2009-05-03 21:00 -------- d-----w c:\program files\Winamp
2009-05-03 20:35 . 2009-05-03 20:35 -------- d-----w c:\program files\NAPI-PROJEKT
2009-05-03 20:35 . 2009-05-03 20:35 -------- d-----w c:\program files\ALLPlayer
2009-05-03 20:32 . 2009-05-03 20:32 0 ----a-w c:\windows\nsreg.dat
2009-05-03 20:27 . 2009-05-03 20:27 -------- d-----w c:\program files\Common Files\Adobe
2009-05-03 20:26 . 2009-05-03 20:25 -------- d-----w c:\program files\Ahead
2009-05-03 20:25 . 2009-05-03 20:25 -------- d-----w c:\program files\Common Files\Ahead
2009-05-03 20:25 . 2009-05-03 20:25 -------- d-----w c:\program files\CyberLink
2009-05-03 20:25 . 2009-05-03 20:25 -------- d-----w c:\program files\CyberLink DVD Solution
2009-05-03 20:18 . 2009-05-03 20:18 4608 ----a-w c:\windows\system32\w95inf32.dll
2009-05-03 20:18 . 2009-05-03 20:18 2272 ----a-w c:\windows\system32\w95inf16.dll
2009-05-03 20:18 . 2009-05-03 20:18 -------- d-----w c:\program files\PCI Audio Applications
2009-05-03 20:17 . 2009-05-03 20:17 -------- d-----w c:\program files\C-Media
2009-05-03 20:16 . 2009-05-03 20:16 -------- d-----w c:\program files\My Company Name
2009-05-03 20:16 . 2009-05-03 20:08 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-03 20:14 . 2009-05-03 20:09 -------- d-----w c:\program files\ATI Technologies
2009-05-03 20:14 . 2009-05-03 20:14 -------- d-----w c:\program files\Common Files\ATI Technologies
2009-05-03 20:05 . 2009-05-03 20:05 376 ----a-w c:\windows\mozregistry.dat
2009-05-03 20:05 . 2009-05-03 20:05 -------- d-----w c:\program files\hp deskjet 845c series
2009-05-03 20:05 . 2009-05-03 20:04 -------- d-----w c:\program files\Hewlett-Packard
2009-05-03 19:59 . 2009-05-03 19:59 -------- d-----w c:\program files\Gadu-Gadu
2009-05-03 19:20 . 2009-05-03 19:20 -------- d-----w c:\program files\microsoft frontpage
2009-05-03 19:18 . 2009-05-03 19:18 21856 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-03 19:17 . 2009-05-03 19:17 -------- d-----w c:\program files\Usługi online
2004-10-01 13:00 . 2009-05-03 20:25 40960 ----a-w c:\program files\Uninstall_CDS.exe
2008-12-18 00:26 . 2009-05-03 20:32 67688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-18 00:26 . 2009-05-03 20:32 54368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-18 00:26 . 2009-05-03 20:32 34944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-18 00:26 . 2009-05-03 20:32 46712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-18 00:26 . 2009-05-03 20:32 172136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Gadu-Gadu”=“c:\program files\Gadu-Gadu\gg.exe” [2007-04-17 2113536]
“ctfmon.exe”=“c:\windows\system32\ctfmon.exe” [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“iKeyWorks”=“c:\progra~1\A4Tech\Keyboard\Ikeymain.exe” [2006-04-09 61440]
“DAEMON Tools-1033”=“c:\program files\D-Tools\daemon.exe” [2004-08-22 81920]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE” [2004-08-03 15360]
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^Grzesiek^Menu Start^Programy^Autostart^Eurobarre.lnk]
path=c:\documents and settings\Grzesiek\Menu Start\Programy\Autostart\Eurobarre.lnk
backup=c:\windows\pss\Eurobarre.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
“LightScribeService”=2 (0x2)
“IDriverT”=3 (0x3)
“ATKKeyboardService”=2 (0x2)
“Ati HotKey Poller”=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“c:\Program Files\Gadu-Gadu\gg.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hposid01.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe”=
“c:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqpse.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe”=
“c:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe”=
“c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”=
“c:\Program Files\Microsoft Office\Office12\GROOVE.EXE”=
“c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”=
S3 npggsvc;nProtect GameGuard Service;c:\windows\System32\GameMon.des -service --> c:\windows\System32\GameMon.des -service [?]
S3 XDva259;XDva259;??\c:\windows\System32\XDva259.sys --> c:\windows\System32\XDva259.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
URLSearchHooks-{57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - c:\program files\Winamp Toolbar\winamptb.dll
.
------- Skan uzupełniający -------
.
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {93AF74C8-5420-49D2-811F-C78196B9AE72} = 212.85.112.32,193.110.121.20
FF - ProfilePath - c:\documents and settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\i6medp6e.default\
FF - prefs.js: browser.startup.homepage - hxxp://wp.pl/
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2\components\hpClipBook.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2\components\hpClipBookDB.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2\components\hpSmartSelect.dll
FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2\components\hpSmartWebPrinting.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-15 18:09
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
“ImagePath”=“c:\windows\System32\GameMon.des -service”
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
-
-
-
-
-
-
- > ‘winlogon.exe’(868)
-
-
-
-
-
c:\windows\system32\Ati2evxx.dll
-
-
-
-
-
-
- > ‘explorer.exe’(3276)
-
-
-
-
-
c:\windows\system32\msi.dll
c:\program files\Gadu-Gadu\ggwhook.dll
c:\windows\system32\browselc.dll
c:\program files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
c:\program files\Microsoft Office\Office12\1045\GrooveIntlResource.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-05-15 18:10 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-05-15 16:10
Przed: 10 925 133 824 bajtów wolnych
Po: 11 448 782 848 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /fastdetect /NoExecute=OptIn
255
– Dodane 15.05.2009 (Pt) 18:13 –
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:13:02, on 2009-05-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (file missing)
O4 - HKLM…\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
O4 - HKLM…\Run: [DAEMON Tools-1033] “C:\Program Files\D-Tools\daemon.exe” -lang 1033
O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray
O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip…{93AF74C8-5420-49D2-811F-C78196B9AE72}: NameServer = 212.85.112.32,193.110.121.20
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\System32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe
–
End of file - 4505 bytes
– Dodane 15.05.2009 (Pt) 18:18 –
To wszystko…sorki że nie screen czy coś ale jakoś wolałem to wkleić…trochę czytania jest^^ to są logi z combofix i HJT, o i dodam, że takie długie włączanie komputera mam co jakiś czas tak mniej więcej raz na dobę jak włączam to tak jest…nie wiem czemu…prosze o pomoc ![-o<
– Dodane 16.05.2009 (So) 16:04 –
odświeżam temat