Zwolnił, a dopiero po formacie

[mr_mietus (Egmont7)]

Witam!

Otóż mój komputer znowu zwolnił, 2 tygodnie po formacie.

Logfile of HijackThis v1.99.1 Scan saved at 20:46:57, on 2007-06-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\oodag.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\LXSUPMON.EXE C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\Fmctrl.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe E:\Format\Instalki\AdbeRdr80_en_US.exe C:\DOCUME~1\Krzysiek\USTAWI~1\Temp\Adobe Reader 8.0\setup.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\MsiExec.exe C:\WINDOWS\system32\MsiExec.exe C:\WINDOWS\system32\MsiExec.exe C:\Documents and Settings\Krzysiek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime O4 - HKLM…\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [systemTray] SysTray.Exe O4 - HKLM…\Run: [FmctrlTray] Fmctrl.EXE O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU…\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_34.cab O17 - HKLM\System\CCS\Services\Tcpip…{202E5A8B-DE03-4EC9-8C20-7B43315379EC}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip…{202E5A8B-DE03-4EC9-8C20-7B43315379EC}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\System32\oodag.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Pozdrawiam i proszę o sprawdzenie loga.

Złączono Posta : 25.06.2007 (Pon) 21:26

Nikt nie pomoże?

Bardzo proszę…

[qrczak13]

Daj log z ComboFix.

[mr_mietus (Egmont7)]

Przepraszam, że dopiero teraz, ale nie miałem dostępu do kompa.

“Krzysiek” - 2007-06-26 16:35:44 - ComboFix 07-06-25.3 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-26 to 2007-06-26 ))))))))))))))))))))))))))))))) 2007-06-25 21:48 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-25 21:34 2007-06-22 13:34 4 --a------ C:\WINDOWS\system32\proc1712545084.bin 2007-06-22 13:34 2007-06-18 16:48 2007-06-18 15:51 2007-06-17 22:01 2007-06-17 22:01 2007-06-17 22:00 2007-06-17 21:25 2007-06-17 21:19 2007-06-17 21:11 2007-06-16 18:17 2007-06-16 18:13 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2007-06-16 18:13 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2007-06-16 18:13 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2007-06-16 18:13 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys 2007-06-16 18:11 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-06-16 18:11 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-06-16 13:58 9,728 --a------ C:\WINDOWS\system32\drivers\FMJOY.SYS 2007-06-16 13:58 53,248 --a------ C:\WINDOWS\system32\ftdll32.dll 2007-06-16 13:58 5,779 --a------ C:\WINDOWS\system32\drivers\FMPNP.SYS 2007-06-16 13:58 328,320 --a------ C:\WINDOWS\system32\drivers\FM801.SYS 2007-06-16 13:58 304,128 --a------ C:\WINDOWS\IsUninst.exe 2007-06-16 13:58 270,336 --a------ C:\WINDOWS\system32\fmctrl.exe 2007-06-16 11:38 1,156 --a------ C:\WINDOWS\mozver.dat 2007-06-16 06:21 2007-06-16 06:17 2007-06-16 06:16 85,376 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-06-16 06:16 83,456 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-06-16 06:16 825,344 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-06-16 06:16 82,432 --a------ C:\WINDOWS\system32\dmscript.dll 2007-06-16 06:16 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-06-16 06:16 733,696 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-06-16 06:16 72,704 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-06-16 06:16 70,656 --a------ C:\WINDOWS\system32\amstream.dll 2007-06-16 06:16 7,552 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-06-16 06:16 619,008 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-06-16 06:16 61,440 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-06-16 06:16 60,928 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-06-16 06:16 59,904 --a------ C:\WINDOWS\system32\devenum.dll 2007-06-16 06:16 57,856 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-06-16 06:16 563,200 --a------ C:\WINDOWS\system32\qedit.dll 2007-06-16 06:16 51,328 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-06-16 06:16 51,200 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-06-16 06:16 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-06-16 06:16 5,376 --a------ C:\WINDOWS\system32\drivers\mspclock.sys 2007-06-16 06:16 48,640 --a------ C:\WINDOWS\system32\drivers\stream.sys 2007-06-16 06:16 46,592 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-06-16 06:16 4,992 --a------ C:\WINDOWS\system32\drivers\mspqm.sys 2007-06-16 06:16 4,352 --a------ C:\WINDOWS\system32\drivers\swenum.sys 2007-06-16 06:16 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-06-16 06:16 386,048 --a------ C:\WINDOWS\system32\qdvd.dll 2007-06-16 06:16 375,296 --a------ C:\WINDOWS\system32\dpnet.dll 2007-06-16 06:16 367,616 --a------ C:\WINDOWS\system32\dsound.dll 2007-06-16 06:16 363,520 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-06-16 06:16 35,840 --a------ C:\WINDOWS\system32\dmloader.dll 2007-06-16 06:16 35,328 --a------ C:\WINDOWS\system32\pid.dll 2007-06-16 06:16 35,328 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-06-16 06:16 35,328 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-06-16 06:16 30,208 --a------ C:\WINDOWS\system32\dplaysvr.exe 2007-06-16 06:16 3,584 --a------ C:\WINDOWS\system32\dpnlobby.dll 2007-06-16 06:16 3,584 --a------ C:\WINDOWS\system32\dpnaddr.dll 2007-06-16 06:16 28,672 --a------ C:\WINDOWS\system32\dmband.dll 2007-06-16 06:16 279,040 --a------ C:\WINDOWS\system32\qdv.dll 2007-06-16 06:16 27,136 --a------ C:\WINDOWS\system32\ddrawex.dll 2007-06-16 06:16 266,240 --a------ C:\WINDOWS\system32\ddraw.dll 2007-06-16 06:16 24,064 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-06-16 06:16 229,888 --a------ C:\WINDOWS\system32\dplayx.dll 2007-06-16 06:16 212,992 --a------ C:\WINDOWS\system32\dpvoice.dll 2007-06-16 06:16 21,504 --a------ C:\WINDOWS\system32\dpvacm.dll 2007-06-16 06:16 204,288 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-06-16 06:16 20,480 --a------ C:\WINDOWS\system32\encapi.dll 2007-06-16 06:16 2,113,536 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-06-16 06:16 192,512 --a------ C:\WINDOWS\system32\qcap.dll 2007-06-16 06:16 19,456 --a------ C:\WINDOWS\system32\dswave.dll 2007-06-16 06:16 19,328 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-06-16 06:16 185,856 --a------ C:\WINDOWS\system32\dinput8.dll 2007-06-16 06:16 181,760 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-06-16 06:16 181,248 --a------ C:\WINDOWS\system32\dmime.dll 2007-06-16 06:16 18,432 --a------ C:\WINDOWS\system32\dpnsvr.exe 2007-06-16 06:16 17,408 --a------ C:\WINDOWS\system32\msyuv.dll 2007-06-16 06:16 17,024 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-06-16 06:16 163,328 --a------ C:\WINDOWS\system32\dinput.dll 2007-06-16 06:16 15,360 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-06-16 06:16 15,360 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-06-16 06:16 140,928 --a------ C:\WINDOWS\system32\drivers\ks.sys 2007-06-16 06:16 14,336 --a------ C:\WINDOWS\system32\msdmo.dll 2007-06-16 06:16 116,736 --a------ C:\WINDOWS\system32\dpvvox.dll 2007-06-16 06:16 11,776 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-06-16 06:16 11,136 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-06-16 06:16 105,984 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-06-16 06:16 104,448 --a------ C:\WINDOWS\system32\dmusic.dll 2007-06-16 06:16 103,424 --a------ C:\WINDOWS\system32\dmsynth.dll 2007-06-16 06:16 10,880 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-06-16 06:16 1,689,088 --a------ C:\WINDOWS\system32\d3d9.dll 2007-06-16 06:16 1,431,552 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-06-16 06:16 1,298,432 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-06-16 06:16 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-06-16 06:16 1,290,752 --a------ C:\WINDOWS\system32\quartz.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-16 04:01:17 -------- d-----w C:\Program Files\Usługi online 2007-06-15 14:04:26 86,968 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-15 14:04:26 494,308 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-26 08:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys 2007-04-26 08:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2007-01-29 05:59] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2004-08-25 12:52] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2004-08-25 14:25] “WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 18:07] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 18:07] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 18:07] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-06-15 17:56] “SystemTray”=“SysTray.Exe” [2001-10-30 14:00 C:\WINDOWS\system32\systray.exe] “FmctrlTray”=“Fmctrl.EXE” [2001-08-20 21:47 C:\WINDOWS\system32\fmctrl.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-01-16 10:41] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-01-22 15:37] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2006-08-02 23:46] “AutoConnect”=“C:\Program Files\AutoConnect\AutoConnect.exe” [2004-08-28 20:27] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe” [2007-06-15 17:24] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “”= “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser] C:\Program Files\Eraser\eraser.exe -hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-26 16:39:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … ? [2248] scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-26 16:41:44 — E O F —

Pozdrawiam i dziękuję za zainteresowanie.

Złączono Posta : 26.06.2007 (Wto) 19:45

Na prawdę nikt nie pomoże?

Bardzo proszę.

Złączono Posta : 26.06.2007 (Wto) 19:46

Na prawdę nikt nie pomoże?

Bardzo proszę.

[qrczak13]

Log ok.

Poczytaj o zbędnikach w autostarcie.

Optymalizacja i odchudzanie Windows XP

Czyszczenie rejestru - jv16 PowerTools 2006 1.5.2.350