Spowolniony komp

Valuable1 · 26 Grudzień 2007 10:20

Gość od netu powiedział, że mam jakiś syf na kompie - jak usunę net będzie szybszy.

Prosze o sprawdzenie loga:

Logfile of HijackThis v1.99.1 Scan saved at 11:16:06, on 2007-12-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe D:\Avast4\aswUpdSv.exe D:\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Comodo\Firewall\cmdagent.exe D:\HP\HP Software Update\HPWuSchd2.exe D:\mks_vir_2007\bin\MksFwall.exe D:\mks_vir_2007\bin\MksPC.exe D:\Comodo\Firewall\CPF.exe D:\adobe\Lightroom 1.3\apdproxy.exe D:\Gadu-Gadu\gg.exe D:\mks_vir_2007\bin\mksvirmonsvc.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Nonbrand\802.11g Wireless LAN PCI Card Driver and Utility\RtWlan.exe D:\Spyware Terminator\sp_rsser.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\DRIVERS\WtSrv.exe D:\Avast4\ashMaiSv.exe D:\Avast4\ashWebSv.exe D:\Opera\Opera.exe D:\mks_vir_2007\bin\mksupdate.exe C:\DOCUME~1\WACICI~1\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {B71FA585-B351-4E48-8DA8-22F6F705EC73} - (no file) O2 - BHO: (no name) - {D3721CFA-B379-43EE-8D9B-83D9E34934F7} - (no file) O4 - HKLM…\Run: [HP Software Update] D:\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [COMODO Firewall Pro] “D:\Comodo\Firewall\CPF.exe” /background O4 - HKLM…\Run: [Adobe Photo Downloader] “D:\adobe\Lightroom 1.3\apdproxy.exe” O4 - HKCU…\Run: [NBJ] “C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” O4 - HKCU…\Run: [Gadu-Gadu] “D:\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: 802.11g Wireless LAN PCI Card Utility.lnk = ? O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O10 - Unknown file in Winsock LSP: d:\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: d:\mks_vir_2007\bin\mkslsp.dll O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://acs.pandasoftware.com/activescan … asinst.cab O20 - Winlogon Notify: mljkhed - mljkhed.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - D:\Comodo\Firewall\cmdagent.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: MksFwall - MKS Sp z o.o. - D:\mks_vir_2007\bin\MksFwall.exe O23 - Service: MksPC - Unknown owner - D:\mks_vir_2007\bin\MksPC.exe O23 - Service: MksUpdate - MKS Sp. z o. o. - D:\mks_vir_2007\bin\mksupdate.exe O23 - Service: mks_vir file monitor (MksVirMonSvc) - Unknown owner - D:\mks_vir_2007\bin\mksvirmonsvc.exe O23 - Service: MkS_Scan - Unknown owner - D:\mks_vir_2007\bin\mks_scan.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing) O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Spyware Terminator\sp_rsser.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\system32\DRIVERS\WtSrv.exe

Gutek · 26 Grudzień 2007 11:26

O2 - BHO: (no name) - {B71FA585-B351-4E48-8DA8-22F6F705EC73} - (no file)

O2 - BHO: (no name) - {D3721CFA-B379-43EE-8D9B-83D9E34934F7} - (no file)	

O20 - Winlogon Notify: mljkhed - mljkhed.dll (file missing)

usuń wpisy HJT

Daj log z ComboFix

Valuable1 · 26 Grudzień 2007 13:53

W HJT zaznaczyłem te wpisy i klinęłem "Fix"

ComboFix:

ComboFix 07-12-21.4 - Właściciel 2007-12-26 13:10:42.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.977 [GMT 1:00] Running from: C:\Documents and Settings\Właściciel\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ddccc.dll C:\WINDOWS\system32\pmnno.dll C:\WINDOWS\system32\xpdx.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\xpdx ((((((((((((((((((((((((( Files Created from 2007-11-26 to 2007-12-26 ))))))))))))))))))))))))))))))) . 2007-12-20 22:19 . 2007-12-20 22:19 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-20 21:50 . 2007-12-20 21:50 2007-12-19 19:19 . 2007-12-19 19:19 169 --a------ C:\WINDOWS\RtlRack.ini 2007-12-19 19:15 . 2007-12-19 19:15 2007-12-19 19:15 . 2002-11-26 22:59 1,577,984 --------- C:\WINDOWS\system32\alsndmgr.cpl 2007-12-19 19:15 . 2002-11-26 23:46 730,700 --------- C:\WINDOWS\system32\drivers\alcxwdm.sys 2007-12-19 19:15 . 2002-10-20 22:33 208,896 --------- C:\WINDOWS\alcupd.exe 2007-12-19 19:15 . 2002-02-04 22:54 141,016 --------- C:\WINDOWS\system32\alsndmgr.wav 2007-12-19 19:15 . 2002-10-16 21:54 131,072 --------- C:\WINDOWS\alcrmv.exe 2007-12-19 19:15 . 2002-11-19 06:01 46,592 --------- C:\WINDOWS\soundman.exe 2007-12-19 19:15 . 2002-11-19 18:29 640 --------- C:\WINDOWS\system32\drivers\alcxinit.dat 2007-12-19 19:15 . 2001-07-05 09:19 164 --------- C:\WINDOWS\avrack.ini 2007-12-19 18:55 . 2007-12-19 19:15 2007-12-15 18:58 . 2007-12-15 18:59 2007-12-10 23:19 . 2007-12-11 15:16 2007-12-05 21:35 . 2007-12-05 21:35 2007-12-02 16:50 . 2004-03-29 17:23 90,112 --a------ C:\WINDOWS\unvise32.exe 2007-12-02 16:34 . 2007-12-02 16:34 2007-11-28 15:00 . 2007-11-28 15:00 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-19 18:57 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-12-15 22:37 --------- d-----w C:\Program Files\Spyware Terminator 2007-12-15 22:36 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spyware Terminator 2007-12-15 12:53 --------- d-----w C:\Program Files\Common Files\PCSuite 2007-12-05 20:42 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-12-04 01:08 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-12-04 01:08 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-12-04 01:08 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-01 18:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2007-06-10 09:56 904,747 --sh–w C:\WINDOWS\system32\kjllm.bak1 2007-07-13 15:35 1,043,898 --sh–w C:\WINDOWS\system32\kjllm.bak2 . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“D:\Gadu-Gadu\gg.exe” [2006-11-10 21:30] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “HP Software Update”=“D:\HP\HP Software Update\HPWuSchd2.exe” [2005-12-15 10:18] “COMODO Firewall Pro”=“D:\Comodo\Firewall\CPF.exe” [2007-09-21 19:49] “Adobe Photo Downloader”=“D:\adobe\Lightroom 1.3\apdproxy.exe” [2007-12-04 02:07] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-03 23:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ 802.11g Wireless LAN PCI Card Utility.lnk - C:\Program Files\Nonbrand\802.11g Wireless LAN PCI Card Driver and Utility\RtWlan.exe [2007-09-21 11:28:18] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @=“service” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft System Service] taskmgr1.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WService] WService.EXE R0 mksidsa;mksidsa;C:\WINDOWS\system32\mksidsa.sys [2007-05-24 04:06] R1 mksfwallt;mksfwallt;C:\WINDOWS\system32\mksfwallt.sys [2007-05-24 04:06] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2007-08-09 15:48] R2 MksFwall;MksFwall;D:\mks_vir_2007\bin\MksFwall.exe [2007-05-24 04:06] R2 MksPC;MksPC;D:\mks_vir_2007\bin\MksPC.exe [2007-05-24 04:06] R2 MksUpdate;MksUpdate;D:\mks_vir_2007\bin\mksupdate.exe [2007-05-24 04:06] R3 mksfwallf;mksfwallf;C:\WINDOWS\system32\mksfwallf.sys [2007-05-24 04:06] R3 mksidsf;mksidsf;C:\WINDOWS\system32\mksidsf.sys [2007-05-24 04:06] R3 MksMonEn;MksMonEn;D:\mks_vir_2007\bin\MksMonEn.sys [2007-09-21 19:14] R3 MksMonEv;MksMonEv;D:\mks_vir_2007\bin\MksMonEv.sys [2007-05-24 04:06] R3 MksMonFd;MksMonFd;D:\mks_vir_2007\bin\MksMonFd.sys [2007-05-24 04:06] R3 rtl8185;802.11g Wireless LAN PCI Card Driver;C:\WINDOWS\system32\DRIVERS\rtl8185.sys [2005-10-20 12:05] R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57] S3 fixustor;fixustor;C:\WINDOWS\system32\drivers\fixustor.sys [2004-01-05 19:23] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-26 13:33:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> D:\mks_vir_2007\bin\mkslsp.dll . Completion time: 2007-12-26 13:34:56 - machine was rebooted . 2007-12-12 13:43:17 — E O F —

Gutek · 27 Grudzień 2007 00:33

Wklej do Notatnika: