Sprawdzenie loga

Cliq · 19 Kwiecień 2008 10:32

Witam, prosze o sprawdzenie loga, komp co raz wolniej chodzi, gierki sie tną, które kiedyś dobrze chodziły. Nie chcem robi formata, ponieważ nie chcem tracić danych.

Logfile of HijackThis v1.99.1 Scan saved at 12:28:07, on 2008-04-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\CPUCooL\CooLSrv.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\Explorer.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe E:\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file) R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: 72.167.37.76 nprotect.acclaimdownloads.com O1 - Hosts: 72.167.37.76 nprotect.acclaimdownloads.com O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\DAEMON Tools SearchBar\search.dll (file missing) O2 - BHO: XBTP01621 Class - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~1\MediaBar.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [Gadu-Gadu] “E:\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [sRS Audio Sandbox] “C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe” /hideme O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

huber2t · 19 Kwiecień 2008 10:34

fix w hijackthis

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll


Folder::

C:\Program Files\BearShare applications\BearShare MediaBar

Plik -> zapisz jako -> CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.

Cliq · 19 Kwiecień 2008 10:54

ComboFix 08-04-18.3 - Użytkownik 2008-04-19 12:51:02.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.268 [GMT 2:00] Running from: C:\Documents and Settings\Użytkownik\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Użytkownik\Pulpit\CFScript.txt.txt * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED FILE :: C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll . /wow section - STAGE 38 pv: No matching processes found Składnia polecenia jest niepoprawna. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\Użytkownik\Ulubione\Error Cleaner.url C:\Documents and Settings\Użytkownik\Ulubione\Online Security Test.url C:\Documents and Settings\Użytkownik\Ulubione\Privacy Protector.url C:\Documents and Settings\Użytkownik\Ulubione\SpywareMalware Protection.url C:\Program Files\BearShare applications\BearShare MediaBar C:\Program Files\BearShare applications\BearShare MediaBar\basis.xml C:\Program Files\BearShare applications\BearShare MediaBar\clean_BearShare.bmp C:\Program Files\BearShare applications\BearShare MediaBar\icons.bmp C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.crc C:\Program Files\BearShare applications\BearShare MediaBar\newversion.txt C:\Program Files\BearShare applications\BearShare MediaBar\options.html C:\Program Files\BearShare applications\BearShare MediaBar\SearchGlass.bmp C:\Program Files\BearShare applications\BearShare MediaBar\Uninstall.exe C:\Program Files\BearShare applications\BearShare MediaBar\version.txt C:\WINDOWS\dat.txt C:\WINDOWS\rs.txt ----- BITS: Possible infected sites ----- hxxp://onlinesafepro.com . ((((((((((((((((((((((((( Files Created from 2008-03-19 to 2008-04-19 ))))))))))))))))))))))))))))))) . 2008-04-19 10:33 . 2008-04-19 10:42 502,368 --a------ C:\WINDOWS\system32\drivers\amon.sys 2008-04-19 10:33 . 2008-04-19 10:42 270,336 --a------ C:\WINDOWS\system32\imon.dll 2008-04-19 10:33 . 2008-04-19 10:32 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2008-04-19 10:13 . 2008-04-19 10:13 2008-04-19 10:12 . 2008-04-19 10:12 2008-04-14 22:01 . 2008-04-14 22:09 2008-04-14 18:44 . 2008-04-14 22:20 2008-04-14 18:37 . 2008-04-14 18:45 2,837 --a------ C:\WINDOWS\system32\lchdebuglog.ini 2008-04-14 18:36 . 2008-04-14 22:20 2008-04-13 10:55 . 2008-04-13 10:55 2008-04-12 22:30 . 2008-04-12 22:30 2008-04-11 19:26 . 2008-04-11 19:26 2008-04-11 19:26 . 2008-04-11 19:26 2008-03-25 23:44 . 2008-03-25 23:48 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-19 10:51 --------- d-----w C:\Program Files\ESET 2008-04-19 10:51 --------- d-----w C:\Program Files\BearShare applications 2008-04-17 15:50 --------- d-----w C:\Documents and Settings\Użytkownik\Dane aplikacji\MegauploadToolbar 2008-04-14 20:20 --------- d-----w C:\Program Files\sXe Injected 2008-04-12 14:31 --------- d-----w C:\Program Files\Ski Jump International 2008-04-12 14:31 --------- d-----w C:\Program Files\Counter Strike 1.6 Reloaded 2008-04-12 11:22 --------- d-----w C:\Program Files\KONAMI 2008-04-06 15:40 --------- d-s—w C:\Program Files\HLSW 2008-04-04 20:39 --------- d–h--w C:\Program Files\InstallShield Installation Information 2008-04-04 16:27 --------- d-----w C:\Program Files\SpeedFan 2008-04-04 16:26 --------- d-----w C:\Program Files\GameSpy Arcade 2008-03-29 18:01 --------- d-----w C:\Documents and Settings\Użytkownik\Dane aplikacji\uTorrent 2008-03-24 22:02 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-03-17 18:29 --------- d-----w C:\Program Files\FastStone Image Viewer 2008-03-17 18:29 --------- d-----w C:\Documents and Settings\Użytkownik\Dane aplikacji\FastStone 2008-03-16 18:14 --------- d-----w C:\Documents and Settings\Użytkownik\Dane aplikacji\fltk.org 2008-03-14 18:25 --------- d-----w C:\Documents and Settings\Użytkownik\Dane aplikacji\Tlen.pl 2008-03-07 14:03 --------- d-----w C:\Program Files\Common Files\DirectX 2008-03-06 17:31 --------- d-----w C:\Program Files\Rockstar Games 2008-03-06 12:11 --------- d-----w C:\Program Files\IrfanView 2008-03-05 15:30 97,288 ----a-w C:\DSETUP.dll 2008-03-05 15:30 527,880 ----a-w C:\DXSETUP.exe 2008-03-05 15:30 1,694,728 ----a-w C:\dsetup32.dll 2008-03-03 19:05 --------- d-----w C:\Program Files\Tlen.pl 2008-02-29 13:54 --------- d-----w C:\Program Files\Teamspeak2_RC2 2008-02-29 13:54 --------- d-----w C:\Documents and Settings\Użytkownik\Dane aplikacji\teamspeak2 2008-02-26 20:45 --------- d-----w C:\Program Files\Activision 2008-02-10 17:27 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-02-05 16:28 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-02-05 15:00 22,328 ----a-w C:\Documents and Settings\Użytkownik\Dane aplikacji\PnkBstrK.sys . ------- Sigcheck ------- 2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS$hf_mig$\KB917953\SP2QFE\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS$NtUninstallKB917953$\tcpip.sys 2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\system32\dllcache\tcpip.sys 2006-04-20 13:51 359808 b4e29943b4b04bd5e7381546848e6669 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“E:\Gadu-Gadu\gg.exe” [2007-07-09 09:39 2119104] “SRS Audio Sandbox”=“C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe” [2007-09-12 23:00 3158016] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-10-22 13:22 7700480] “nwiz”=“nwiz.exe” [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50 155648] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2004-11-02 20:24 32768] “NvMediaCenter”=“NvMCTray.dll” [2006-10-22 13:22 86016 C:\WINDOWS\system32\nvmctray.dll] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2008-04-19 10:42 921600] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44 15360] [HKLM~\startupfolder\C:^Documents and Settings^Użytkownik^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Użytkownik\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] C:\Program Files\AdVantage\AdVantage.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 12:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] C:\Program Files\Ares\Ares.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2007-09-26 16:27 286016 C:\Program Files\BitTorrent_DNA\dna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 18:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] C:\Program Files\DAP\DAP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hosted] C:\Windows\system32\system.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] --a------ 2008-01-15 17:09 6290944 C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-10-22 13:22 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon] --a------ 2006-05-21 19:00 2375680 C:\Program Files\RivaTuner v2.0 RC 16\RivaTuner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2006-11-14 11:21 16270848 C:\WINDOWS\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRS Audio Sandbox] --a------ 2007-09-12 23:00 3158016 C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-03-31 14:22 1271032 E:\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-09-07 20:34 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\Program Files\DAEMON Tools SearchBar\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE] C:\Program Files\DAEMON Tools SearchBar\whse.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-01-16 00:54 37376 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusDisableNotify”=dword:00000001 “UpdatesDisableNotify”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile] “EnableFirewall”= 0 (0x0) [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “F:\Program Files\BearShare Applications\BearShare\BearShare.exe”= “E:\Gadu-Gadu\gg.exe”= “C:\Program Files\HLSW\hlsw.exe”= “C:\Program Files\uTorrent\utorrent.exe”= “C:\Program Files\SopCast\SopCast.exe”= “C:\Documents and Settings\Użytkownik\Dane aplikacji\SopCast\adv\SopAdver.exe”= “C:\Program Files\BitTorrent_DNA\dna.exe”= “C:\Program Files\Internet Explorer\IEXPLORE.EXE”= “C:\totalcmd\TOTALCMD.EXE”= “C:\WINDOWS\system32\dplaysvr.exe”= “E:\stronghold.exe”= “C:\WINDOWS\system32\PnkBstrA.exe”= “C:\WINDOWS\system32\PnkBstrB.exe”= “C:\Program Files\KONAMI\Pro Evolution Soccer 2008\PES2008.exe”= [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] “7876:TCP”= 7876:TCP:BitComet 7876 TCP “7876:UDP”= 7876:UDP:BitComet 7876 UDP S3 NRKCTL32;NRKCTL32;C:\Documents and Settings\Użytkownik\Pulpit\NRKCTL32.SYS [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{c33db115-4feb-11dc-af6a-001a4d2cd90c}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(0)\command - Recycled\ctfmon.exe *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-19 12:52:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe - C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-04-19 12:53:41 ComboFix-quarantined-files.txt 2008-04-19 10:53:30 Pre-Run: 32,766,095,360 bajtów wolnych Post-Run: 34,250,354,688 bajtów wolnych 207 — E O F — 2008-01-11 14:13:56 Co teraz mam robić??

Gutek · 19 Kwiecień 2008 14:06

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=213350

Optymalizacja XP: viewtopic.php?t=76580

Optymalizacja autostartu: http://www.bezpieczenstwosystemow.pl/in … opic=116.0

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

Opis RegCleaner - http://www.agavk.p9.pl/strony/progra_regcleaner.php

Zobacz - Obsługa jv16 PowerTools