bardzo prosze o sprawdzenie loga

[Creative_pp]

Mj kom troche dziwnie się zachowuje, zmienia sie czułośc myszki i kal w cokolwiek klkam to sie otwoera po kilka razy, neta mi rozłacza co jakis czas

Oto LOG

Logfile of HijackThis v1.99.1
Scan saved at 20:14:07, on 2007-10-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\r2 Studios\HideOE\HideOE.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\SubEdit-Player\subedit.exe
C:\Program Files\outlook express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Opera\Opera.exe
E:\rapget136_(www.programosy.pl)\rapget136\rapget.exe
C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.playmobile.pl/login
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 193.219.28.144:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [HideOE] "C:\Program Files\r2 Studios\HideOE\HideOE.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Rejestrowanie produktów Corela.lnk = C:\Program Files\Corel\Graphics9\Register\Remind32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.mks.com.pl
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,4956/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E64D1917-F60F-44CE-8B76-B129D969FB00}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFE1A0A6-1D10-49BF-95DE-040BBE6C64C3}: NameServer = 213.172.186.4,213.172.186.5
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

daj loga z combofixa

[Creative_pp]

Zmień opcje z disable na enable. Uruchom ponownie komputer.

Zrobione

Otlo log z Combo

ComboFix 07-10-2.2 - Administrator 2007-10-01 20:55:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.431 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-2. )))))))))))))))))))))))))))))))
.

2007-09-30 23:50 <DIR> d-------- C:\Program Files\foobar2000
2007-09-30 23:50 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\foobar2000
2007-09-30 23:49 <DIR> d-------- C:\Program Files\1by1
2007-09-28 15:17 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Samsung
2007-09-28 15:02 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2007-09-28 15:01 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-09-28 00:49 9,256 --a------ C:\WINDOWS\system32\drivers\sscdwhnt.sys
2007-09-28 00:49 9,256 --a------ C:\WINDOWS\system32\drivers\sscdwh.sys
2007-09-28 00:49 9,256 --a------ C:\WINDOWS\system32\drivers\sscdcmnt.sys
2007-09-28 00:49 9,256 --a------ C:\WINDOWS\system32\drivers\sscdcm.sys
2007-09-28 00:49 80,552 --a------ C:\WINDOWS\system32\drivers\sscdbus.sys
2007-09-28 00:49 11,944 --a------ C:\WINDOWS\system32\drivers\sscdmdfl.sys
2007-09-28 00:49 106,792 --a------ C:\WINDOWS\system32\drivers\sscdmdm.sys
2007-09-28 00:48 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2007-09-28 00:48 <DIR> d-------- C:\Program Files\Samsung
2007-09-24 18:25 <DIR> d-------- C:\Program Files\AA
2007-09-18 14:56 <DIR> d-------- C:\Program Files\r2 Studios
2007-09-18 10:23 <DIR> d-------- C:\Program Files\PopTray
2007-09-12 20:11 <DIR> d-------- C:\Program Files\EACom
2007-09-12 20:08 <DIR> d-------- C:\Program Files\Electronic Arts
2007-09-10 01:15 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-09-10 01:15 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji\SecuROM
2007-09-10 01:12 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-09-10 01:12 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-09-10 01:12 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-09-10 01:12 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2007-09-10 01:12 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-09-10 01:12 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2007-09-07 15:50 <DIR> d-------- C:\Program Files\Microsoft Speech SDK 5.1
2007-09-06 20:29 <DIR> d-------- C:\Program Files\uTorrent
2007-09-06 20:28 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent
2007-09-03 18:41 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Spamihilator
2007-09-03 12:07 92,208 --a------ C:\WINDOWS\system32\WING.DLL
2007-09-03 12:07 12,800 --a------ C:\WINDOWS\system\WING32.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-01 18:28 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-10-01 18:28 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-09-30 21:03 --------- d-------- C:\Documents and Settings\Administrator\Dane aplikacji\teamspeak2
2007-09-28 15:01 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-09-28 00:41 --------- d---s---- C:\Program Files\Xfire
2007-09-25 22:40 --------- d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Xfire
2007-09-23 12:29 --------- d-------- C:\Program Files\NAPI-PROJEKT
2007-09-23 01:21 --------- d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Skype
2007-09-07 00:06 --------- d-------- C:\Program Files\America's Army
2007-09-06 12:13 --------- d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Real
2007-09-06 02:02 --------- d-------- C:\Program Files\SkanerOnline
2007-09-06 01:52 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic
2007-09-01 12:55 --------- d-------- C:\Program Files\Winamp
2007-08-31 15:17 --------- d-------- C:\Program Files\Fotojoker
2007-08-19 15:50 --------- d-------- C:\Program Files\Anim-FX
2007-08-16 15:26 --------- d-------- C:\Program Files\Damian Pasternak
2007-08-15 21:12 --------- d-------- C:\Program Files\Opera
2007-08-14 23:15 --------- d-------- C:\Program Files\MoorHunt
2007-08-14 23:14 --------- d-------- C:\Program Files\Google
2007-08-14 21:59 --------- d-------- C:\Program Files\SystemRequirementsLab
2007-08-09 22:56 --------- d-------- C:\Program Files\SHOUTcast
2007-08-09 21:55 --------- d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Google
2007-08-07 23:41 --------- d-------- C:\Program Files\PartyGaming
2007-08-06 20:02 --------- d-------- C:\Program Files\PowerQuest
2007-08-05 22:28 66872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-03-19 20:13 6422611 --a------ C:\Program Files\frostwire-4.13.1.6.windows.exe
2007-02-19 23:05 19 --a------ C:\Program Files\Answer.txt
2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2006-08-06 21:35]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-09-05 17:11]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Twoje TVN24"="" []
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36]
"HideOE"="C:\Program Files\r2 Studios\HideOE\HideOE.exe" [2003-07-24 12:38]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44]

R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys
S2 vcs;vcs;\??\C:\Program Files\AV VCS 3.0\vcs.sys
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\System32\ntsim.sys
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys
S3 sscdmdfl;SAMSUNG Mobile Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
S3 sscdmdm;SAMSUNG Mobile Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-02 20:56:56
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-02 20:57:52
C:\ComboFix-quarantined-files.txt ... 2007-10-02 20:57
C:\ComboFix2.txt ... 2007-05-29 21:23
.
--- E O F ---

[wojtas]

jest czysto

jedynie jesli przez proxy nie laczysz skasuj:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 193.219.28.144:8080

Autor postu otrzymał pochwałę