Prosze o sprawdzenie loga

Garrox · 14 Sierpień 2006 12:21

czesto musze wlaczac kompa kilka razy bo “cos” zapycha mi pamiec stronicowania

Logfile of HijackThis v1.99.1

Scan saved at 13:57:13, on 2006-08-14

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe

C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe

C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe

C:\Program Files\AntiVirenKit 2006\AVKService.exe

C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe

C:\Program Files\Executive Software\Diskeeper\DkService.exe

C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\explorer.exe

c:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Janek\Moje dokumenty\Jan\hijackthis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.digitalfan.com/search

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.digitalfan.com/search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.digitalfan.com/search

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F2 - REG:system.ini: Shell=explorer.exe                                                                                                    

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {196B9CB5-4C83-46F7-9B06-9672ECD9D99B} - C:\WINDOWS\system32\winbrume.dll (file missing)

O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)

O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D8274} - C:\WINDOWS\System32\spm8274.dll (file missing)

O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [fb661dd6.exe] C:\WINDOWS\System32\fb661dd6.exe

O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\AntiVirenKit 2006\AVKTray\AVKTray.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [Gadu-Gadu] "c:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [0mcamcap] C:\WINDOWS\System32\0mcamcap.exe

O4 - HKCU\..\Run: [fb661dd6.exe] C:\Documents and Settings\Janek\Ustawienia lokalne\Dane aplikacji\fb661dd6.exe

O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"

O4 - Startup: Screen Saver Control.lnk = C:\WINDOWS\FSScrCtl.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)

O21 - SSODL: DCOM Server 2237 - {2C1CD3D7-86AC-4068-93BC-A02304BB2237} - C:\WINDOWS\System32\2237_28.dll

O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe

O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe

O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\AntiVirenKit 2006\AVKService.exe

O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:\Program Files\AntiVirenKit 2006\AVKWCtl.exe

O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Unknown owner - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe (file missing)

O23 - Service: Usługa Norton Protection Center (NSCService) - Unknown owner - (no file)

O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton AntiVirus\SAVScan.exe (file missing)

adam9870 · 14 Sierpień 2006 13:32

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jezeli któryś z nich bedzie na żółto to go zostaw).

Usuń: (wszystko oczywiście robisz w trybie awaryjnym z wyłączonym przywracaniem systemu)

F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: (no name) - {196B9CB5-4C83-46F7-9B06-9672ECD9D99B} - C:\WINDOWS\system32\winbrume.dll (file missing) O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D8274} - C:\WINDOWS\System32\spm8274.dll (file missing) O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file) O4 - HKLM…\Run: [fb661dd6.exe] C:\WINDOWS\System32\fb661dd6.exe O4 - HKCU…\Run: [0mcamcap] C:\WINDOWS\System32\0mcamcap.exe O4 - HKCU…\Run: [fb661dd6.exe] C:\Documents and Settings\Janek\Ustawienia lokalne\Dane aplikacji\fb661dd6.exe O4 - HKCU…\Run: [shell] “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe” O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing) O21 - SSODL: DCOM Server 2237 - {2C1CD3D7-86AC-4068-93BC-A02304BB2237} - C:\WINDOWS\System32\2237_28.dll

Pliki i foldery zaznaczone usuwasz ręcznie z dysku natomiast wpisy w HijackThis.

Wygląda mi na to,że odinstalowywałeś Nortona Antyvirusa. Czy rzeczywiście tak robiłeś ? Jeżeli tak to niestety muszę Cię poinformować ,że są resztki po nim:

Więc zobacz tutaj aby się nich skutecznie pozbyć:

http://forum.dobreprogramy.pl/viewtopic.php?t=75075

Po wykonaniu w/w dajesz nowy log z HijackThis plus z SilentRunners.