Prosze sprawdzić logi komp mi strasznie zwolnił

Logfile of HijackThis v1.99.1

Scan saved at 11:50:53, on 2007-01-25

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:

C:\XP\System32\smss.exe

C:\XP\system32\winlogon.exe

C:\XP\system32\services.exe

C:\XP\system32\lsass.exe

C:\XP\system32\svchost.exe

C:\XP\System32\svchost.exe

C:\XP\system32\spoolsv.exe

C:\XP\system32\netsecurity.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

d:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\XP\System32\PAStiSvc.exe

C:\XP\system32\svchost.exe

C:\XP\system32\1032\dll\svchost.exe

C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe

C:\XP\Explorer.EXE

C:\Program Files\Launch Manager\PowerKey.exe

C:\Program Files\Launch Manager\CtrlVol.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\XP\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\PowerOff\PowerOff.exe

C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe

C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWare.exe

C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWareControl.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe

C:\XP\system32\1032\dll\projects\setiathome.berkeley.edu\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\DOCUME~1\Waldzio\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis1.99.1.zip\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INTERNET

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program\MICROS~1\Office12\GrooveShellExtensions.dll

O4 - HKLM…\Run: [PowerKey] “C:\Program Files\Launch Manager\PowerKey.exe”

O4 - HKLM…\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe

O4 - HKLM…\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe

O4 - HKLM…\Run: [kis] “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe”

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [ctfmon.exe] C:\XP\system32\ctfmon.exe

O4 - HKCU…\Run: [H/PC Connection Agent] “C:\Program Files\Microsoft ActiveSync\wcescomm.exe”

O4 - HKCU…\Run: [speedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe

O4 - HKCU…\Run: [PowerOff] “C:\Program Files\PowerOff\PowerOff.exe” /HIDE

O8 - Extra context menu item: Add to &Teleport - C:\PROGRA~1\Teleport Pro\teleport.htm

O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm

O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

O9 - Extra ‘Tools’ menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O11 - Options group: [iNTERNATIONAL] International*

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program\MICROS~1\Office12\GrooveSystemServices.dll

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll

O20 - Winlogon Notify: igfxcui - C:\XP\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: klogon - C:\XP\system32\klogon.dll

O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\XP\system32\WPDShServiceObj.dll

O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: STI Simulator - Unknown owner - C:\XP\System32\PAStiSvc.exe

O23 - Service: Installator Windows (windowsinstaller) - Unknown owner - C:\XP\system32\1032\dll\svchost.exe (file missing)

valdziu proszę objąć log w tagi - informacja, jak to zrobić - http://forum.dobreprogramy.pl/viewtopic.php?t=36654

Nie trzymaj hijacka w TEMPie lub innym katalogu tymczasowym - umieść go np. na pulpicie.

Start >>> uruchom >>> cmd >>> w konsoli, która się otworzy wpisz:

Folder zaznaczony na czerwono usuń ręcznie z dysku będąc w trybie awaryjnym, a wpis HJT.

Przeskanuj plik:

na stronie http://virusscan.jotti.org/, a jeśli okaże się szkodnikiem, to również usuń.

Po wykonaniu proszę pokazać nowy log z HijackThis plus z SilentRunners.

Zrobiłem to:

Start >>> uruchom >>> cmd >>> w konsoli, która się otworzy wpisz:

Cytat:

sc stop windowsinstaller

sc delete windowsinstaller

Również:

Usunąłem ten folder w trybie awaryjnym

Pliku netsecurity nie moge znaleźć w sys32 ale wydaje mi sie ze przed właczeniem trybu waaryjnego był.

Przesyłam logi:

Logfile of HijackThis v1.99.1

Scan saved at 13:02:05, on 2007-01-25

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:

C:\XP\System32\smss.exe

C:\XP\system32\csrss.exe

C:\XP\system32\winlogon.exe

C:\XP\system32\services.exe

C:\XP\system32\lsass.exe

C:\XP\system32\svchost.exe

C:\XP\system32\svchost.exe

C:\XP\System32\svchost.exe

C:\XP\system32\svchost.exe

C:\XP\system32\spoolsv.exe

C:\XP\System32\SCardSvr.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEABUG\MDM.EXE

d:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\XP\System32\PAStiSvc.exe

C:\XP\system32\svchost.exe

C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe

C:\XP\System32\alg.exe

C:\XP\Explorer.EXE

C:\Program Files\Launch Manager\PowerKey.exe

C:\Program Files\Launch Manager\CtrlVol.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\XP\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\PowerOff\PowerOff.exe

C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Documents and Settings\Waldzio\Pulpit\hijackthis1.99.1\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INTERNET

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program\MICROS~1\Office12\GrooveShellExtensions.dll

O4 - HKLM…\Run: [PowerKey] “C:\Program Files\Launch Manager\PowerKey.exe”

O4 - HKLM…\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe

O4 - HKLM…\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe

O4 - HKLM…\Run: [kis] “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe”

O4 - HKLM…\Run: [Ashampoo AntiSpyWare Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare\AntiSpyWareGuard.exe

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [ctfmon.exe] C:\XP\system32\ctfmon.exe

O4 - HKCU…\Run: [H/PC Connection Agent] “C:\Program Files\Microsoft ActiveSync\wcescomm.exe”

O4 - HKCU…\Run: [speedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe

O4 - HKCU…\Run: [PowerOff] “C:\Program Files\PowerOff\PowerOff.exe” /HIDE

O8 - Extra context menu item: Add to &Teleport - C:\PROGRA~1\Teleport Pro\teleport.htm

O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm

O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

O9 - Extra ‘Tools’ menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O11 - Options group: [iNTERNATIONAL] International*

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program\MICROS~1\Office12\GrooveSystemServices.dll

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll

O20 - Winlogon Notify: igfxcui - C:\XP\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: klogon - C:\XP\system32\klogon.dll

O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\XP\system32\WPDShServiceObj.dll

O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Program\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: STI Simulator - Unknown owner - C:\XP\System32\PAStiSvc.exe

A jeżeli chodzi o silent runerrsy mam problrm bo pojawia sie komunikat, że nie mam włączonej obsługi skryptów

Czysto.

O problemach z silentem poczytaj TUTAJ.