System się sypie

[KrzaQu666 (Dziwak666)]

Witam wszystkich. Mam problem dotyczący systemu operacyjnego, a mianowicie szybkości działania. System operacyjny(Windows Xp Professional SP2) włącza się dłużej niż powinien(coś koło 5 minut), wszystkie programy wolniej pracują. Na początku myślałem że to wina jakiś wirusów, albo coś w tym stylu, ale po przeskanowaniu systemu(Kaspersky 2009) nic mi nie znalazł.

O to log`i:

*Combofix:

ComboFix 09-02-08.02 - Miszczó 2009-02-09 14:26:21.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2046.1611 [GMT 1:00] Uruchomiony z: c:\documents and settings\Miszczó\Pulpit\ComboFix.exe AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2009-01-09 do 2009-02-09 ))))))))))))))))))))))))))))))) . 2009-02-09 12:59 . 2009-02-09 14:15 2009-02-08 22:17 . 2009-02-09 12:54 2009-02-08 21:37 . 2009-02-08 21:37 2009-02-08 19:38 . 2009-02-08 19:38 2009-02-08 18:35 . 2009-02-08 18:35 2009-02-08 18:35 . 2009-02-08 18:35 2009-02-06 21:41 . 2009-02-06 22:02 2009-02-06 10:49 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll 2009-02-06 00:33 . 2009-02-06 00:33 2009-02-06 00:32 . 2009-02-09 14:07 2009-02-06 00:32 . 2009-02-09 14:05 931,872 --ahs---- c:\windows\system32\drivers\fidbox.dat 2009-02-06 00:32 . 2009-02-09 14:22 204,832 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2009-02-06 00:32 . 2009-02-06 09:51 101,287 --a------ c:\windows\system32\drivers\klin.dat 2009-02-06 00:32 . 2009-02-06 09:51 89,601 --a------ c:\windows\system32\drivers\klick.dat 2009-02-06 00:32 . 2009-02-09 14:05 10,456 --ahs---- c:\windows\system32\drivers\fidbox.idx 2009-02-06 00:32 . 2009-02-09 14:22 2,828 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2009-02-06 00:31 . 2009-02-06 00:31 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-09 13:08 --------- d-----w c:\program files\neostrada tp 2009-02-08 16:11 --------- d-----w c:\documents and settings\Miszczó\Dane aplikacji\Xfire 2009-02-06 12:31 --------- d–h--w c:\program files\InstallShield Installation Information 2009-02-06 08:51 33,808 ----a-w c:\windows\system32\drivers\klbg.sys 2009-02-05 22:16 --------- d-----w c:\documents and settings\NetworkService\Dane aplikacji\Xfire 2009-02-05 22:09 --------- d-----w c:\documents and settings\Miszczó\Dane aplikacji\DAEMON Tools Pro 2009-02-05 22:09 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Pro 2009-02-05 22:06 685,816 ----a-w c:\windows\system32\drivers\sptd.sys 2009-02-05 22:05 --------- d-----w c:\documents and settings\Miszczó\Dane aplikacji\InstallShield 2009-02-05 22:00 --------- d-----w c:\documents and settings\Miszczó\Dane aplikacji\ATI 2009-02-05 22:00 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ATI 2009-02-05 21:59 --------- d-----w c:\program files\ATI Technologies 2009-02-05 21:46 --------- d-----w c:\program files\Thomson 2009-02-05 21:46 --------- d-----w c:\program files\Java 2009-02-05 21:46 --------- d-----w c:\program files\Common Files\InstallShield 2009-02-05 21:41 --------- d-----w c:\program files\Marvell 2009-02-05 21:39 315,392 ----a-w c:\windows\HideWin.exe 2009-02-05 21:39 --------- d-----w c:\program files\Realtek 2009-02-05 21:38 --------- d-----w c:\program files\Intel 2009-02-05 21:32 --------- d-----w c:\program files\microsoft frontpage 2009-02-05 21:31 --------- d-----w c:\program files\Usługi online 2009-01-23 01:17 42,320 ----a-w c:\windows\system32\xfcodec.dll 2009-01-14 07:14 3,455,488 ----a-w c:\windows\system32\drivers\ati2mtag.sys 2009-01-14 05:46 11,591,680 ----a-w c:\windows\system32\atioglxx.dll 2009-01-14 04:53 286,720 ----a-w c:\windows\system32\atiok3x2.dll 2009-01-14 04:49 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll 2009-01-14 04:47 323,584 ----a-w c:\windows\system32\ati2dvag.dll 2009-01-14 04:36 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe 2009-01-14 04:36 196,608 ----a-w c:\windows\system32\atipdlxx.dll 2009-01-14 04:36 151,552 ----a-w c:\windows\system32\Oemdspif.dll 2009-01-14 04:35 43,520 ----a-w c:\windows\system32\ati2edxx.dll 2009-01-14 04:35 155,648 ----a-w c:\windows\system32\ati2evxx.dll 2009-01-14 04:34 598,016 ----a-w c:\windows\system32\ati2evxx.exe 2009-01-14 04:32 53,248 ----a-w c:\windows\system32\ATIDDC.DLL 2009-01-14 04:22 4,009,152 ----a-w c:\windows\system32\ati3duag.dll 2009-01-14 04:05 2,500,224 ----a-w c:\windows\system32\ativvaxx.dll 2009-01-14 03:50 48,640 ----a-w c:\windows\system32\amdpcom32.dll 2009-01-14 03:45 401,408 ----a-w c:\windows\system32\atikvmag.dll 2009-01-14 03:44 17,408 ----a-w c:\windows\system32\atitvo32.dll 2009-01-14 03:44 110,592 ----a-w c:\windows\system32\atiadlxx.dll 2009-01-14 03:43 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll 2009-01-14 03:37 577,536 ----a-w c:\windows\system32\ati2cqag.dll 2009-01-14 03:37 307,200 ----a-w c:\windows\system32\atiiiexx.dll 2009-01-14 02:36 45,056 ----a-w c:\windows\system32\amdcalrt.dll 2009-01-14 02:36 45,056 ----a-w c:\windows\system32\amdcalcl.dll 2009-01-14 02:34 3,227,648 ----a-w c:\windows\system32\Amdcaldd.dll 2009-01-13 20:05 593,920 ------w c:\windows\system32\ati2sgag.exe 2008-11-11 19:00 218,376 ----a-w c:\windows\system32\klogon.dll . ((((((((((((((((((((((((((((( SnapShot_2009-02-08_19.51.26,87 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-03 22:43:54 66,560 ----a-w c:\windows\system32\cdm.dll + 2008-10-16 13:09:44 92,696 ----a-w c:\windows\system32\cdm.dll - 2009-02-05 21:35:07 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2009-02-09 12:59:22 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2009-02-05 21:35:07 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2009-02-09 12:59:22 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2009-02-05 21:35:07 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2009-02-09 12:59:22 32,768 ----a-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat - 2004-08-03 22:43:54 66,560 -c–a-w c:\windows\system32\dllcache\cdm.dll + 2008-10-16 13:09:44 92,696 -c–a-w c:\windows\system32\dllcache\cdm.dll - 2004-08-03 22:44:16 431,616 -c–a-w c:\windows\system32\dllcache\wuapi.dll + 2008-10-16 13:12:20 561,688 -c–a-w c:\windows\system32\dllcache\wuapi.dll - 2004-08-03 22:44:30 112,128 -c–a-w c:\windows\system32\dllcache\wuauclt.exe + 2008-10-16 13:09:44 51,224 -c–a-w c:\windows\system32\dllcache\wuauclt.exe - 2004-08-03 22:44:16 1,134,592 -c–a-w c:\windows\system32\dllcache\wuaueng.dll + 2008-10-16 13:13:40 1,809,944 -c–a-w c:\windows\system32\dllcache\wuaueng.dll - 2004-08-03 22:44:16 113,664 -c–a-w c:\windows\system32\dllcache\wucltui.dll + 2008-10-16 13:12:22 323,608 -c–a-w c:\windows\system32\dllcache\wucltui.dll - 2004-08-03 22:44:16 36,864 -c–a-w c:\windows\system32\dllcache\wups.dll + 2008-10-16 13:08:58 34,328 -c–a-w c:\windows\system32\dllcache\wups.dll - 2004-08-03 22:44:16 120,320 -c–a-w c:\windows\system32\dllcache\wuweb.dll + 2008-10-16 13:13:40 202,776 -c–a-w c:\windows\system32\dllcache\wuweb.dll - 2009-02-05 21:57:59 58,732 ----a-w c:\windows\system32\perfc009.dat + 2009-02-09 13:12:02 58,732 ----a-w c:\windows\system32\perfc009.dat - 2009-02-05 21:57:59 74,450 ----a-w c:\windows\system32\perfc015.dat + 2009-02-09 13:12:03 74,450 ----a-w c:\windows\system32\perfc015.dat - 2009-02-05 21:57:59 392,432 ----a-w c:\windows\system32\perfh009.dat + 2009-02-09 13:12:03 392,432 ----a-w c:\windows\system32\perfh009.dat - 2009-02-05 21:57:59 448,348 ----a-w c:\windows\system32\perfh015.dat + 2009-02-09 13:12:03 448,348 ----a-w c:\windows\system32\perfh015.dat + 2008-10-16 13:08:58 34,328 ----a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll + 2005-02-25 03:36:06 16,096 ------w c:\windows\system32\spmsg.dll - 2004-11-18 09:42:52 22,752 ----a-w c:\windows\system32\spupdsvc.exe + 2005-02-25 03:36:06 22,752 ----a-w c:\windows\system32\spupdsvc.exe - 2004-08-03 22:44:16 431,616 ----a-w c:\windows\system32\wuapi.dll + 2008-10-16 13:12:20 561,688 ----a-w c:\windows\system32\wuapi.dll - 2004-08-03 22:44:30 112,128 ----a-w c:\windows\system32\wuauclt.exe + 2008-10-16 13:09:44 51,224 ----a-w c:\windows\system32\wuauclt.exe - 2004-08-03 22:44:16 1,134,592 ----a-w c:\windows\system32\wuaueng.dll + 2008-10-16 13:13:40 1,809,944 ----a-w c:\windows\system32\wuaueng.dll - 2004-08-03 22:44:16 113,664 ----a-w c:\windows\system32\wucltui.dll + 2008-10-16 13:12:22 323,608 ----a-w c:\windows\system32\wucltui.dll - 2004-08-03 22:44:16 36,864 ----a-w c:\windows\system32\wups.dll + 2008-10-16 13:08:58 34,328 ----a-w c:\windows\system32\wups.dll + 2008-10-16 13:09:44 43,544 ----a-w c:\windows\system32\wups2.dll - 2004-08-03 22:44:16 120,320 ----a-w c:\windows\system32\wuweb.dll + 2008-10-16 13:13:40 202,776 ----a-w c:\windows\system32\wuweb.dll . – Migawka wyzerowana – . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “AVP”=“d:\programy\Kaspersky Anti-Virus 2009\avp.exe” [2009-02-06 206088] “StartCCC”=“c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” [2008-08-29 61440] “DeathAdder”=“d:\programy\Razer DeathAdder\razerhid.exe” [2007-09-07 159744] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2004-08-03 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “VIDC.XFR1”= xfcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] --a------ 2007-09-06 14:08 136136 d:\programy\DAEMON Tools Pro\DTProAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 d:\programy\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-01-26 11:38 866816 c:\program files\Thomson\SpeedTouch USB\dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2009-02-06 13:21 1410296 d:\gry\The Orange Box\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-09-12 17:45 36352 d:\programy\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] --------- 2004-10-14 16:55 32768 c:\progra~1\NEOSTR~1\GestMAJ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] --------- 2004-08-23 14:49 20480 c:\progra~1\NEOSTR~1\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2007-01-30 11:54 16116224 c:\windows\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 11:04 2879488 c:\windows\SkyTel.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] “DisableMonitoring”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “d:\Programy\Xfire\Xfire.exe”= “d:\Gry\The Orange Box\steamapps\dziwak666\team fortress 2\hl2.exe”= “d:\Programy\BitComet\BitComet.exe”= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808] R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2009-02-05 22784] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.neostrada.pl IE: { - c:\program files\Messenger\msmsgs.exe TCP: {741AC00A-DAAE-4057-B389-53B8A0F31892} = 194.204.159.1 217.98.63.164 FF - ProfilePath - c:\documents and settings\Miszczó\Dane aplikacji\Mozilla\Firefox\Profiles\2rjz2ug4.default\ FF - prefs.js: browser.startup.homepage - http://www.Pclab.pl FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll FF - plugin: c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-09 14:27:28 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów … skanowanie ukrytych wpisów autostartu … skanowanie ukrytych plików … skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > ‘winlogon.exe’(728) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2009-02-09 14:28:31 ComboFix-quarantined-files.txt 2009-02-09 13:28:29 ComboFix2.txt 2009-02-08 18:51:51 ComboFix3.txt 2009-02-06 09:27:38 Przed: 15 688 777 728 bajtów wolnych Po: 15,677,878,272 bajtów wolnych 207 — E O F — 2009-02-08 21:17:09

*hijackthis:

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:23:13, on 2009-02-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\Explorer.EXE D:\Programy\Razer DeathAdder\razerhid.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe D:\Programy\Razer DeathAdder\razertra.exe D:\Programy\Razer DeathAdder\razerofa.exe C:\Program Files\neostrada tp\neostradatp.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\neostrada tp\Watch.exe D:\Programy\Xfire\Xfire.exe D:\Programy\Mozilla Firefox\firefox.exe D:\Programy\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Programy\Kaspersky Anti-Virus 2009\ievkbd.dll O4 - HKLM…\Run: [AVP] “D:\Programy\Kaspersky Anti-Virus 2009\avp.exe” O4 - HKLM…\Run: [startCCC] “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” MSRun O4 - HKLM…\Run: [DeathAdder] D:\Programy\Razer DeathAdder\razerhid.exe O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Programy\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O17 - HKLM\System\CCS\Services\Tcpip…{741AC00A-DAAE-4057-B389-53B8A0F31892}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip…{741AC00A-DAAE-4057-B389-53B8A0F31892}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Programy\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe – End of file - 3496 bytes

*Silent Runners:

“Silent Runners.vbs”, revision 59, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “AVP” = ““D:\Programy\Kaspersky Anti-Virus 2009\avp.exe”” [“Kaspersky Lab”] “StartCCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” MSRun” [“Advanced Micro Devices, Inc.”] “DeathAdder” = “D:\Programy\Razer DeathAdder\razerhid.exe” [empty string] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}(Default) = “IEVkbdBHO” -> {HKLM…CLSID} = “IEVkbdBHO Class” \InProcServer32(Default) = “D:\Programy\Kaspersky Anti-Virus 2009\ievkbd.dll” [“Kaspersky Lab”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Programy\WinRAR 3.61\rarext.dll” [null data] “{85E0B171-04FA-11D1-B7DA-00A0C90348D6}” = “Web traffic protection statistics” -> {HKLM…CLSID} = “Web traffic protection statistics” \InProcServer32(Default) = “D:\Programy\Kaspersky Anti-Virus 2009\SCIEPlgn.dll” [“Kaspersky Lab”] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] <> klogon\DLLName = “C:\WINDOWS\system32\klogon.dll” [“Kaspersky Lab”] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Programy\Kaspersky Anti-Virus 2009\ShellEx.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Programy\WinRAR 3.61\rarext.dll” [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Programy\WinRAR 3.61\rarext.dll” [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Programy\Kaspersky Anti-Virus 2009\ShellEx.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Programy\WinRAR 3.61\rarext.dll” [null data] Default executables: -------------------- <> HKLM\SOFTWARE\Classes.com(Default) = “ComFile” Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoDrives” = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoDrives” = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “DisableRegistryTools” = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\web\wallpaper\Idylla.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Miszczó\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp” Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ WinampMTPHandler\ “Provider” = “Winamp” “ProgID” = “Shell.HWEventHandlerShellExecute” “InitCmdLine” = “D:\Programy\Winamp\winamp.exe” HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID(Default) = “{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}” -> {HKLM…CLSID} = “ShellExecute HW Event Handler” \LocalServer32(Default) = “rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}” [MS] WinampPlayMediaOnArrival\ “Provider” = “Winamp” “InvokeProgID” = “Winamp.File” “InvokeVerb” = “Play” HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command(Default) = "“D:\Programy\Winamp\winamp.exe” “%1"” [“Nullsoft”] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = “{46986115-84D6-459c-8F95-52DD653E532E}” -> {HKLM…CLSID} = (no title provided) \LocalServer32(Default) = ““D:\Programy\Winamp\winamp.exe”” [“Nullsoft”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID{85E0B171-04FA-11D1-B7DA-00A0C90348D6}(Default) = “Web traffic protection statistics” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “D:\Programy\Kaspersky Anti-Virus 2009\SCIEPlgn.dll” [“Kaspersky Lab”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ “ButtonText” = “Web traffic protection statistics” Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{08C06D61-F1F3-4799-86F8-BE1A89362C85}” = (no title provided) -> {HKLM…CLSID} = “Search Class” \InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL” [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] France Telecom Routing Table Service, FTRTSVC, “C:\WINDOWS\System32\FTRTSVC.exe” [“France Telecom”] ---------- (launch time: 2009-02-09 14:29:41) <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 36 seconds, including 12 seconds for message boxes)

Z góry dziekuję za pomoc

[huber2t]

W logu nic nie widzę

usuń ręcznie folder C:\Qoobox , usuń instalkę Combofix z dysku.

Przeczyść system Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar całego komputera http://www.kaspersky.pl/virusscanner.html Daj raport z niego na forum

Logi dajesz na http://wklej.eu lub na http://wklej.org a w poście dajesz tylko link

[eyeti]

Podaj konfigurację sprzętu.

Być może dysk zaczyna odmawiać posłuszeństwa, gdyż i od niego zależy wydajność systemu.

[KrzaQu666 (Dziwak666)]

Dzięki za odp. jak zrobię wszystkie czynności to dam znać czy “coś” ruszyło

– Dodane 09.02.2009 (Pn) 15:45 –

Podaj konfigurację sprzętu.

Intel® Pentium® Dual CPU E2140(był podkręcony do 3Ghz, ale dzisiaj odkręciłem ponieważ myślałem że problemy mogą być przez to…)

2046MB RAM DDR II PC800 GoodRam

160 GB Total Samsung 8MB Cache SATA II

Gigabyte Radeon HD4850 512MB

Abit IP35-E