Zwolniona prędkość Internetu

[rlk120]

Witam.

Dawno mnie tu nie było ale mam prośbę.

Sprawdźcie mi logi bo od wczoraj zamiast transferu 65 kb/s mam niecałe 20 kb.

Wydaje mi się że są jakieś wirusy.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:38:15, on 2007-10-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe D:\Tlen.pl\tlen.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKCU…\Run: [Komunikator] D:\Tlen.pl\tlen.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{32383304-8C4E-4A30-9140-9C9F2600D496}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE – End of file - 2455 bytes

Proszę o pomoc, podpowiedzieć co usunąć.

[arekmalek]

No tu jest czysto. Daj log z combofix http://forum.dobreprogramy.pl/viewtopic.php?t=36654 na samym dole…

[rlk120]

ComboFix 07-10-17.8 - ťukasz 2007-10-17 20:43:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.556 [GMT 2:00] Running from: C:\Documents and Settings\ťukasz\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\check_LSA7.txt C:\check_LSA7.txt C:\WINDOWS\cookies.ini C:\WINDOWS\system32\aoswkyts.dll C:\WINDOWS\system32\bnvwfcee.ini C:\WINDOWS\system32\eecfwvnb.dll C:\WINDOWS\system32\pqstv.bak1 C:\WINDOWS\system32\pqstv.bak1 C:\WINDOWS\system32\pqstv.bak1 C:\WINDOWS\system32\pqstv.bak2 C:\WINDOWS\system32\pqstv.bak2 C:\WINDOWS\system32\pqstv.bak2 C:\WINDOWS\system32\pqstv.ini C:\WINDOWS\system32\pqstv.ini C:\WINDOWS\system32\pqstv.ini C:\WINDOWS\system32\pqstv.ini2 C:\WINDOWS\system32\pqstv.ini2 C:\WINDOWS\system32\pqstv.ini2 C:\WINDOWS\system32\pqstv.tmp C:\WINDOWS\system32\pqstv.tmp C:\WINDOWS\system32\pqstv.tmp C:\WINDOWS\system32\vtsqp.dll C:\WINDOWS\system32\vtsqp.dll C:\WINDOWS\system32\vtsqp.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-09-17 to 2007-10-17 ))))))))))))))))))))))))))))))) . 2007-10-17 20:43 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-17 20:03 2007-10-17 17:03 176,128 --a------ C:\WINDOWS\system32\FTD2XX.dll 2007-10-16 20:38 2007-10-16 20:38 520,192 --a------ C:\WINDOWS\mmfplay.exe 2007-10-16 20:38 438,272 --a------ C:\WINDOWS\AWBencoder.exe 2007-10-16 20:38 380,928 --a------ C:\WINDOWS\AWBdecoder.exe 2007-10-16 20:38 286,720 --a------ C:\WINDOWS\system32\software2046.dll 2007-10-16 20:38 266,240 --a------ C:\WINDOWS\mmamrkvt.exe 2007-10-16 20:38 193,536 --a------ C:\WINDOWS\hpconsiggi.exe 2007-10-16 20:37 2007-10-16 20:27 2007-10-16 20:21 26,496 --a–c— C:\WINDOWS\system32\dllcache\usbstor.sys 2007-10-15 17:48 2007-10-15 17:47 2007-10-14 09:28 2007-10-14 09:22 2007-10-14 09:17 2007-10-14 09:15 2007-10-10 14:27 2007-09-29 19:01 2007-09-29 18:39 2007-09-29 18:39 225,280 --a------ C:\WINDOWS\system32\rewire.dll 2007-09-29 08:04 2007-09-28 18:52 2007-09-20 18:26 1,024 --a------ C:\WINDOWS\unins000.dat 2007-09-19 16:36 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-17 18:45 4,456,448 —ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT 2007-10-17 18:09 --------- d-----w C:\Program Files\Kaspersky Lab 2007-10-16 18:37 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-16 15:10 --------- d—a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-10-10 12:24 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-19 14:36 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2007-09-16 17:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-09-11 18:30 --------- d-----w C:\Program Files\Lexmark X1100 Series 2007-09-04 13:30 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-09-04 13:30 --------- d-----w C:\Program Files\AGEIA Technologies . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Komunikator”=“D:\Tlen.pl\tlen.exe” [2007-09-27 13:43] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-09-19 16:36:49] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLwoDiskSpaceChecks”=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxyyay] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “CPUCooLServer”=2 (0x2) “FLEXnet Licensing Service”=3 (0x3) “Adobe LM Service”=3 (0x3) “Bonjour Service”=2 (0x2) . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-17 20:46:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes …

Chyba coś jest urwane ale Combo sam “powiedział” zeby wyłączyc go

Złączono Posta : 17.10.2007 (Sro) 20:54

Deckard’s System Scanner v20071014.68 Run by Łukasz on 2007-10-17 20:51:54 Computer is in Normal Mode. -------------------------------------------------------------------------------- – System Restore -------------------------------------------------------------- Successfully created a Deckard’s System Scanner Restore Point. – Last 3 Restore Point(s) – 3: 2007-10-17 18:51:56 UTC - RP3 - Deckard’s System Scanner Restore Point 2: 2007-10-17 18:43:36 UTC - RP2 - ComboFix created restore point 1: 2007-10-17 18:43:31 UTC - RP1 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. – HijackThis (run as Łukasz.exe) ---------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:52, on 2007-10-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Łukasz\Pulpit\dss.exe D:\PROGRA~1\TRENDM~1\HIJACK~1\Łukasz.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKCU…\Run: [Komunikator] D:\Tlen.pl\tlen.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{32383304-8C4E-4A30-9140-9C9F2600D496}: NameServer = 194.204.159.1 217.98.63.164 O20 - Winlogon Notify: byxyyay - C:\WINDOWS\ O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE – End of file - 2512 bytes – File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL “%1”,%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser “%1”,%* .js - jsfile - DefaultIcon - “D:\Adobe dreamweaver CS3\Adobe Dreamweaver CS3\Dreamweaver.exe”,7 .js - jsfile - shell\open\command - “D:\Adobe dreamweaver CS3\Adobe Dreamweaver CS3\Dreamweaver.exe”,"%1" – Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 ntiopnp - c:\windows\system32\drivers\ntiopnp.sys R3 catchme - c:\docume~1\ukasz~1\ustawi~1\temp\catchme.sys (file missing) R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys – Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S? combofix - S4 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - “c:\program files\bonjour\mdnsresponder.exe” S4 CPUCooLServer (CPUCooLServer Service) - d:\cpucool\coolsrv.exe S4 FLEXnet Licensing Service - “c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe” – Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Kontroler Ethernet Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\3&267A616A&0&50 Manufacturer: Name: Kontroler Ethernet PNP Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\3&267A616A&0&50 Service: – Files created between 2007-09-17 and 2007-10-17 ----------------------------- 2007-10-17 20:03:47 0 d-------- C:\Program Files\SkanerOnline 2007-10-17 17:03:21 176128 --a------ C:\WINDOWS\system32\FTD2XX.dll 2007-10-16 20:38:44 0 d-------- C:\ringtoneexport 2007-10-16 20:38:00 286720 --a------ C:\WINDOWS\system32\software2046.dll 2007-10-16 20:38:00 520192 --a------ C:\WINDOWS\mmfplay.exe 2007-10-16 20:38:00 266240 --a------ C:\WINDOWS\mmamrkvt.exe 2007-10-16 20:38:00 193536 --a------ C:\WINDOWS\hpconsiggi.exe 2007-10-16 20:38:00 438272 --a------ C:\WINDOWS\AWBencoder.exe 2007-10-16 20:38:00 380928 --a------ C:\WINDOWS\AWBdecoder.exe 2007-10-16 20:37:59 0 d-------- C:\Program Files\Ringtone4Me 2007-10-16 20:27:08 0 d-------- C:\WINDOWS\system32\aspi 2007-10-15 17:48:01 0 d-------- C:\WINDOWS\RegisteredPackages 2007-10-15 17:47:53 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-10-14 09:22:13 0 d-------- C:\Program Files\Bonjour 2007-10-14 09:17:22 0 d-------- C:\Program Files\Common Files\Macrovision Shared 2007-10-14 09:15:18 0 d-------- C:\Program Files\Common Files\Adobe 2007-09-29 19:01:02 0 d-------- C:\tlen 2007-09-29 18:39:53 225280 --a------ C:\WINDOWS\system32\rewire.dll 2007-09-29 18:39:50 0 d-------- C:\Program Files\Image-Line 2007-09-29 08:04:32 0 d-------- C:\Documents and Settings\Łukasz\Application Data 2007-09-29 08:04:32 0 d-------- C:\Documents and Settings\Łukasz\Application Data\Syntrillium 2007-09-28 18:52:52 0 d-------- C:\Cool Edit Pro 2.1 2007-09-20 18:26:33 1024 --a------ C:\WINDOWS\unins000.dat 2007-09-19 20:57:19 0 d–hs---- C:\WINDOWS\CSC 2007-09-19 17:12:42 348160 --a------ C:\WINDOWS\system32\NCTWMAFile2.dll 2007-09-19 17:12:42 479232 --a------ C:\WINDOWS\system32\NCTAudioVisualization2.dll 2007-09-19 17:12:42 602112 --a------ C:\WINDOWS\system32\NCTAudioTransform2.dll 2007-09-19 17:12:42 458752 --a------ C:\WINDOWS\system32\NCTAudioRecord2.dll 2007-09-19 17:12:41 458752 --a------ C:\WINDOWS\system32\NCTAudioPlayer2.dll 2007-09-19 17:12:41 1212416 --a------ C:\WINDOWS\system32\NCTAudioInformation2.dll 2007-09-19 17:12:41 1986560 --a------ C:\WINDOWS\system32\NCTAudioFile2.dll 2007-09-19 17:12:41 880640 --a------ C:\WINDOWS\system32\NCTAudioEditor2.dll 2007-09-19 17:12:40 417792 --a------ C:\WINDOWS\system32\NCTAudioDisplay2.dll 2007-09-19 17:12:40 2084864 --a------ C:\WINDOWS\system32\NCTAudioDesign2.dll 2007-09-19 17:12:40 835584 --a------ C:\WINDOWS\system32\NCTAudioCDGrabber2.dll 2007-09-19 17:12:37 1101824 --a------ C:\WINDOWS\system32\NMSDVDXU.dll 2007-09-19 16:36:51 1531904 --a------ C:\WINDOWS\adiras.exe 2007-09-19 16:36:50 127456 --a------ C:\WINDOWS\system32\ipdetect.exe 2007-09-19 16:36:49 114688 --a------ C:\WINDOWS\system32\unaddrv.exe 2007-09-19 16:36:49 126976 --a------ C:\WINDOWS\system32\coclassfast.dll 2007-09-19 16:36:49 46892 --a------ C:\WINDOWS\system32\adadix16.dll 2007-09-19 16:36:46 143360 --a------ C:\WINDOWS\autoclk.exe 2007-09-19 16:36:44 0 d-------- C:\Program Files\SAGEM – Find3M Report --------------------------------------------------------------- 2007-10-17 20:19:36 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Tlen.pl 2007-10-17 20:09:09 0 d-------- C:\Program Files\Kaspersky Lab 2007-10-17 18:24:13 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Gadu-Gadu 2007-10-17 18:06:15 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\uTorrent 2007-10-16 20:37:59 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-10-15 17:48:54 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Adobe 2007-10-15 17:47:53 0 d-------- C:\Program Files\Common Files 2007-10-10 14:24:30 0 d-------- C:\Program Files\Common Files\InstallShield 2007-09-19 16:44:02 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Help 2007-09-11 20:30:52 0 d-------- C:\Program Files\Lexmark X1100 Series 2007-09-10 13:37:41 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic 2007-09-10 13:37:24 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Real 2007-09-05 19:34:53 0 d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Lavasoft 2007-09-04 15:30:42 0 d-------- C:\Program Files\AGEIA Technologies 2007-09-04 15:30:16 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-03 13:17:04 4096 --a------ C:\WINDOWS\d3dx.dat 2007-08-27 20:05:53 355486 --a------ C:\WINDOWS\system32\perfh015.dat 2007-08-27 20:05:53 49492 --a------ C:\WINDOWS\system32\perfc015.dat 2007-07-29 17:51:44 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-07-25 15:24:30 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-07-21 19:15:45 110592 --a------ C:\WINDOWS\system32\imsised.dll 2007-07-21 19:10:27 176128 --a------ C:\WINDOWS\system32\imsised.exe – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Komunikator”=“D:\Tlen.pl\tlen.exe” [2007-09-27 13:43] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-09-19 16:36:49] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLwoDiskSpaceChecks”=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxyyay] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “CPUCooLServer”=2 (0x2) “FLEXnet Licensing Service”=3 (0x3) “Adobe LM Service”=3 (0x3) “Bonjour Service”=2 (0x2) – End of Deckard’s System Scanner: finished at 2007-10-17 20:52:45 ------------

Deckard’s System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- – System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Polish CPU 0: AMD Athlon 64 Processor 4000+ Percentage of Memory in Use: 26% Physical Memory (total/avail): 767.23 MiB / 560.46 MiB Pagefile Memory (total/avail): 1874.29 MiB / 1728.05 MiB Virtual Memory (total/avail): 2047.88 MiB / 1934.36 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 14.65 GiB total, 8.75 GiB free. D: is Fixed (NTFS) - 39.07 GiB total, 8.88 GiB free. E: is Fixed (NTFS) - 20.81 GiB total, 9.85 GiB free. F: is CDROM (No Media) \.\PHYSICALDRIVE0 - WDC WD80 0JD-00JNC0 SCSI Disk Device - 74.53 GiB - 3 partitions \PARTITION0 (bootable) - Instalowalny system plików - 14.65 GiB - C: \PARTITION1 - Instalowalny system plików - 39.07 GiB - D: \PARTITION2 - Instalowalny system plików - 20.81 GiB - E: – Security Center ------------------------------------------------------------- – Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\ťukasz\Dane aplikacji CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=XXX-98ADA874498 ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\ťukasz LOGONSERVER=\XXX-98ADA874498 NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 55 Stepping 2, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=3702 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\UKASZ~1\USTAWI~1\Temp TMP=C:\DOCUME~1\UKASZ~1\USTAWI~1\Temp USERDOMAIN=XXX-98ADA874498 USERNAME=ťukasz USERPROFILE=C:\Documents and Settings\ťukasz windir=C:\WINDOWS __COMPAT_LAYER=EnableNXShowUI – User Profiles --------------------------------------------------------------- Łukasz (admin) – Add/Remove Programs --------------------------------------------------------- --> MsiExec /X{82D8304F-73D7-4EE6-8472-D0684BAA2865} --> MsiExec.exe /X{69495273-FCDC-4A86-BCB7-49B504D3FB0E} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf 7-Zip 4.42 --> “D:\7-Zip\Uninstall.exe” ABBYY FineReader 5.0 Sprint --> MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2} Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95} Adobe Asset Services CS3 --> MsiExec.exe /I{8BC84ECC-EA87-49C0-93C0-2B5DF62745CD} Adobe Audition 2.0 --> msiexec /I {01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC} Adobe Bridge CS3 --> MsiExec.exe /I{68CF6DD2-8BA3-4A70-81D8-7CC5F24C9BA2} Adobe Bridge Start Meeting --> MsiExec.exe /I{7F3A2319-79CF-4701-95FB-034E99281808} Adobe Camera Raw 4.0 --> MsiExec.exe /I{183B7569-90FB-4C56-9761-0EEB002CAB83} Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C} Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D} Adobe Device Central CS3 --> MsiExec.exe /I{20B83B31-09C4-4F0E-9774-EF8A12A0A527} Adobe Dreamweaver CS3 --> C:\Program Files\Common Files\Adobe\Installers\435a6af7459cb02a9c1138113a26e93\Setup.exe Adobe Dreamweaver CS3 --> MsiExec.exe /I{F01D5ED5-D53A-4468-B428-149DC2CB3110} Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{4DF98D0B-637E-42B4-B9D6-EB7693D2FBF8} Adobe Extension Manager CS3 --> MsiExec.exe /I{2A539CD9-0F75-4875-9A32-E06DD93C4114} Adobe Help Viewer CS3 --> MsiExec.exe /I{733D84D6-AAFD-4368-A1D0-F2734F6B9082} Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C} Adobe Setup --> MsiExec.exe /I{3A12C952-61D5-4C3B-B68B-8CFBE47E22F1} Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312} Adobe Update Manager CS3 --> MsiExec.exe /I{D1C59F81-66FD-4E8E-B9F7-F4B2442D5222} Adobe Version Cue CS3 Client --> MsiExec.exe /I{41C3C974-EC5E-494C-AFE6-E31D92E2E6CB} AGEIA PhysX v7.05.06 --> MsiExec.exe /X{82D8304F-73D7-4EE6-8472-D0684BAA2865} Aktualizacja dla systemu Windows XP (KB894391) --> “C:\WINDOWS$NtUninstallKB894391$\spuninst\spuninst.exe” ASIO4ALL --> D:\ASIO4ALL v2\uninstall.exe µTorrent --> “D:\uTorrent\uninstall.exe” Audacity 1.2.6 --> “D:\Audacity\unins000.exe” CDBurnerXP Pro 3 --> MsiExec.exe /I{896D642C-7125-44F0-AC49-A23ABF82209C} Collab --> D:\Collab\uninstall.exe Cool Edit Pro 2.1 --> D:\Program Files\coolpro2\cep2unin.exe Cool Record Edit Pro v3.6 Build 555 --> “D:\Cool Record Edit Pro\unins000.exe” CPUCooL (remove only) --> “D:\CPUCooL\CPUCooL-uninst.exe” CWK (Czasowy Wyłącznik Komputera) --> “D:\CWK\CWK.exe” /uninstall Download Accelerator Plus (DAP) --> D:\PROGRA~1\DAP\DAPREMOVE.EXE Dziobas Rar Player 0.007PL --> “D:\Dziobas Rar Player\unins000.exe” Ekspert CD --> C:\WINDOWS\unins000.exe eMule --> “D:\eMule\Uninstall.exe” EVEREST Home Edition v2.20 --> “D:\EVEREST Home Edition\unins000.exe” FaxTools --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{F45298E5-0083-426F-A668-1A2C5F04B8A0}\setup.exe” -l0x15 ControlPanel FL Studio 7 --> D:\FL Studio 7\uninstall.exe Gadu-Gadu 7.7 --> D:\Gadu-Gadu\Setup.exe HijackThis 2.0.2 --> “D:\Program Files\Trend Micro\HijackThis\HijackThis.exe” /uninstall IL Download Manager --> C:\Program Files\Image-Line\Downloader\uninstall.exe Image Line Deckadance VSTi v1.07 --> “D:\VstPlugins\Deckadance\Uninstall\unins000.exe” intelliScore Ensemble WAV to MIDI Converter Demo --> D:\Program Files\intelliScore Ensemble WAV to MIDI Converter Demo\Uninstal.exe jv16 PowerTools 1.3 --> “D:\jv16 PowerTools 2006\unins000.exe” K-Lite Mega Codec Pack 3.4.0 --> “D:\Program Files\K-Lite Codec Pack\unins000.exe” Lexmark X1100 Series --> C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBKUN5C.EXE -dLexmark X1100 Series Mobile Music Polyphonic --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{8D0F386A-ADEC-4536-8EEA-6DD203F95239}\Setup.exe” Mozilla Firefox (2.0.0.7) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe Realtek AC’97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe” REMOVE SAGEM F@st 800-840 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\Setup.exe” -l0x15 SHOUTcast Source DSP 1.8.2 (remove only) --> D:\Winamp\uninst-dsp.exe Skaner on-line mks_vir --> C:\WINDOWS\system32\SkanerOnlineUninstall.exe Streamripper Plugin 1.62.2 (Remove only) --> D:\Winamp\streamripper_uninstall.exe Thief: Deadly Shadows --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{7CE3498C-866B-427E-8273-9CA67B24BA01} Tlen.pl --> “D:\Tlen.pl\uninstall.exe” Two Worlds --> “D:\Two Worlds\unins000.exe” Virtual DJ - Atomix Productions --> D:\PROGRA~1\VIRTUA~1\UNWISE.EXE D:\PROGRA~1\VIRTUA~1\INSTALL.LOG Winamp (remove only) --> “D:\Winamp\UninstWA.exe” Winamp 5.35 PL --> “D:\Winamp\uninst-winamp_pl.exe” – Application Event Log ------------------------------------------------------- Event Record #/Type886 / Error Event Submitted/Written: 10/17/2007 08:46:20 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd sed.cfexe, wersja 0.0.0.0, moduł powodujący błąd sed.cfexe, wersja 0.0.0.0, adres błędu 0x000106ac. Przetwarzanie zdarzenia określonego nośnika dla [sed.cfexe!ws!] Event Record #/Type881 / Error Event Submitted/Written: 10/17/2007 08:44:18 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd sed.cfexe, wersja 0.0.0.0, moduł powodujący błąd sed.cfexe, wersja 0.0.0.0, adres błędu 0x000106ac. Przetwarzanie zdarzenia określonego nośnika dla [sed.cfexe!ws!] Event Record #/Type873 / Error Event Submitted/Written: 10/17/2007 04:10:39 PM Event ID/Source: 490 / ESENT Event Description: svchost (1012) Próba otwarcia pliku “C:\WINDOWS\system32\CatRoot2{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb” w trybie odczytu lub zapisu zakończyła się niepomyślnie z błędem systemowym 32 (0x00000020): "Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ". Operacja otwierania pliku zostanie zakończona z błędem -1032 (0xfffffbf8). Event Record #/Type870 / Error Event Submitted/Written: 10/17/2007 03:52:12 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd tlen.exe, wersja 6.0.2.55, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x01111147. Przetwarzanie zdarzenia określonego nośnika dla [tlen.exe!ws!] Event Record #/Type869 / Warning Event Submitted/Written: 10/17/2007 03:52:11 PM Event ID/Source: 1001 / MsiInstaller Event Description: Wykrywanie produktu „{7CE3498C-866B-427E-8273-9CA67B24BA01}”, funkcja „Data” nie powiodło się podczas żądania składnika „{D2D7B4BF-6CCA-11D5-8B3F-00105A9846E9}” – Security Event Log ---------------------------------------------------------- No Errors/Warnings found. – System Event Log ------------------------------------------------------------ Event Record #/Type3962 / Error Event Submitted/Written: 10/17/2007 08:46:01 PM Event ID/Source: 7000 / Service Control Manager Event Description: Nie można uruchomić usługi General Purpose USB Driver (adildr.sys) z powodu następującego błędu: %%1058 Event Record #/Type3956 / Error Event Submitted/Written: 10/17/2007 08:44:50 PM Event ID/Source: 7000 / Service Control Manager Event Description: Nie można uruchomić usługi combofix z powodu następującego błędu: %%1053 Event Record #/Type3955 / Error Event Submitted/Written: 10/17/2007 08:44:50 PM Event ID/Source: 7009 / Service Control Manager Event Description: Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą combofix. Event Record #/Type3942 / Error Event Submitted/Written: 10/17/2007 08:11:30 PM Event ID/Source: 7034 / Service Control Manager Event Description: Usługa Windows User Mode Driver Framework niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Event Record #/Type3926 / Error Event Submitted/Written: 10/17/2007 08:11:02 PM Event ID/Source: 7000 / Service Control Manager Event Description: Nie można uruchomić usługi General Purpose USB Driver (adildr.sys) z powodu następującego błędu: %%1058 – End of Deckard’s System Scanner: finished at 2007-10-17 20:52:45 ------------

Tu jeszcze 2 logi z tego drugiego programu który tam był

[arekmalek]

Użyj jeszcze SDFIX w trybie awaryjnym