Wolne działanie kompa, Megaclick w FF

Rysiu · 9 Listopad 2007 21:05

Ostatnio komp strasznie dlugo sie włącza, Kaspersky także. Występują także problemy z połączeniem do internetu. Oto log z HJT:

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:28:47, on 2007-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe D:\PowerDVD\PDVDServ.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = £¹cza R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: rightonadz browser optimizer - {971C3384-F75E-4562-95B3-CBE7417529BC} - C:\WINDOWS\system32\gzmrotate.dll (file missing) O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~1\MediaBar.dll (file missing) O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O4 - HKLM…\Run: [updReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM…\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM…\Run: [RemoteControl] D:\PowerDVD\PDVDServ.exe O4 - HKLM…\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘US£UGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘US£UGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – End of file - 5282 bytes

Pozdrawiam

Xaros · 9 Listopad 2007 22:55

Reszta OK, jak na moje oko.

Pozdrawiam, Xaros

Gutek · 10 Listopad 2007 00:32

Daj log z ComboFix

Rysiu · 11 Listopad 2007 13:12

Oto log z ComboFixa:

ComboFix 07-11-06.4 - Tomek 2007-11-11 13:59:19.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.685 [GMT 1:00] Running from: C:\Documents and Settings\Tomek\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\2.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\2.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\2.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\2.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\2.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\2.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\2.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search . ((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 ))))))))))))))))))))))))))))))) . 2007-11-11 13:45 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-09 20:42 82,258 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-11-09 20:42 82,258 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-11-09 20:41 2007-11-09 20:41 2007-11-09 20:41 691,744 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-09 20:41 6,432 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-09 20:34 2007-11-09 20:10 2007-11-09 19:16 2007-11-04 03:03 2007-11-03 11:54 2007-10-28 10:53 2007-10-19 14:01 106,496 --a------ C:\WINDOWS\DIIUnin.exe 2007-10-19 14:01 30,359 --a------ C:\WINDOWS\DIIUnin.dat 2007-10-19 14:01 2,829 --a------ C:\WINDOWS\DIIUnin.pif . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-11 13:00 12,332 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-11 13:00 1,604 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-09 19:13 --------- d-----w C:\Program Files\BearShare applications 2007-11-03 21:13 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Skype 2007-11-03 10:54 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-11 17:00 --------- d-----w C:\Program Files\HP 2007-10-11 17:00 --------- d-----w C:\Program Files\Common Files\HP 2007-09-21 14:23 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Ahead 2007-09-21 11:45 --------- d-----w C:\Program Files\Common Files\Ahead 2007-09-21 11:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2007-09-20 11:52 --------- d-----w C:\Program Files\Ahead 2007-09-20 11:51 --------- d-----w C:\Program Files\Adssite Advanced Toolbar 2007-09-20 11:29 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\ATI 2007-09-20 11:24 --------- d-----w C:\Program Files\ATI Technologies 2007-09-17 16:39 --------- d-----w C:\Program Files\NO1 Video Converter 2007-09-14 20:00 --------- d-----w C:\Program Files\Tibia 2007-09-14 19:43 --------- d-----w C:\Program Files\BitTorrent Fastest Tool 2007-09-14 19:37 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Adssite Advanced Toolbar 2007-09-14 19:04 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\dvdcss 2007-09-12 18:09 --------- d-----w C:\Program Files\CyberLink DVD Solution 2007-09-12 13:12 --------- d-----w C:\Program Files\Common Files\LightScribe 2007-09-12 12:25 --------- d-----w C:\Program Files\Nero . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “UpdReg”=“C:\WINDOWS\UpdReg.EXE” [2000-05-11 00:00] “CTSysVol”=“C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe” [2005-10-31 09:51] “RemoteControl”=“D:\PowerDVD\PDVDServ.exe” [2004-11-02 19:24] “WheelMouse”=“C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe” [2002-07-29 18:34] “Sony Ericsson PC Suite”=“C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” [2005-10-26 15:17] “HP Software Update”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [2006-02-19 01:41] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2005-05-03 20:05] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2007-03-01 14:57] “AVP”=“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe” [2007-06-28 12:51] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2007-06-27 18:03] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper] Rundll32 P17.dll,P17Helper R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 14:02:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-11 14:04:48 - machine was rebooted . — E O F —

Pozdrawiam

Gutek · 11 Listopad 2007 14:37

Już powinno być Ok