System powoli się uruchamia, zamula - zainfekowany plik syst

**Posty:** 22 · przez **lili661** 05 Sty 2009, 20:21

Witam, od paru dni komputer uruchamia się jakieś 15 minut, często ma takie zwieszki i tak zamula, że ciężko na nim jakkolwiek pracować.
Arcavir wykrył Trojana, a dokładnie Trojan.Gamethief.Wow.Dzf w pliku systemowym C:/WINDOWS/system32/vbsdfe0.dll
na internecie przeczytałam, że mogę ten plik usunąć, więc próbowałam najpierw tym arcavirem, ale co usunę, to wirus wraca bo praktycznie co 2 minuty pokazuje mi się od nowa informacja na temat tego zainfekowanego pliku.
Weszłam więc w ten cały folder i chciałam to zrobić ręcznie, jednak pliku o takiej nazwie tam nie znalazłam.
Combofix także usunął wszystkie wirusy, ale tego nie wykrył.
Jestem bezradna, proszę o pomoc :-|

tutaj dodaje logi z combofixa:

Kod: Zaznacz wszystko: ComboFix 09-01-05.02 - martinez 2009-01-05 18:40:44.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1426 [GMT 1:00] Uruchomiony z: c:\downloads\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\2u.com D:\2u.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-05 do 2009-01-05 ))))))))))))))))))))))))))))))) . 2009-01-05 18:39 . 2009-01-05 18:39 <DIR> d-------- C:\Downloads 2009-01-03 16:20 . 2009-01-03 16:20 <DIR> d-------- c:\program files\Bonjour 2009-01-03 16:09 . 2009-01-03 16:09 <DIR> d-------- c:\program files\Common Files\Macrovision Shared 2009-01-02 18:16 . 2009-01-02 18:17 <DIR> d-------- c:\documents and settings\martinez\Dane aplikacji\Media Player Classic 2009-01-01 18:20 . 2009-01-01 18:20 <DIR> d----c--- c:\windows\system32\DRVSTORE 2009-01-01 18:20 . 2009-01-01 18:20 <DIR> d-------- c:\windows\system32\AGEIA 2009-01-01 18:20 . 2009-01-01 18:20 <DIR> d-------- c:\program files\AGEIA Technologies 2008-12-30 00:27 . 2008-12-30 00:27 <DIR> d-------- c:\program files\Common Files\xing shared 2008-12-30 00:26 . 2008-12-30 00:26 <DIR> d-------- c:\program files\Real 2008-12-30 00:26 . 2008-12-30 00:27 <DIR> d-------- c:\program files\Common Files\Real 2008-12-21 16:58 . 2008-12-21 17:01 <DIR> d-------- c:\program files\F-Group 2008-12-21 16:55 . 2008-12-21 16:55 <DIR> d-------- c:\program files\FDRLab 2008-12-21 16:55 . 2008-12-21 16:55 <DIR> d-------- c:\documents and settings\martinez\Dane aplikacji\FDRLab 2008-12-21 14:20 . 2008-12-21 14:20 <DIR> d-------- c:\program files\MSBuild 2008-12-21 14:16 . 2008-12-21 14:16 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-21 14:15 . 2008-12-21 14:15 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-21 14:15 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-21 14:10 . 2008-12-21 14:10 <DIR> d-------- c:\program files\Sony Setup 2008-12-21 14:10 . 2008-12-21 14:10 <DIR> d-------- c:\documents and settings\martinez\Dane aplikacji\Sony Setup 2008-12-21 04:01 . 2008-12-22 01:34 <DIR> d-------- C:\Fraps 2008-12-12 17:24 . 2008-12-13 16:54 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ArcaBit 2008-12-12 17:19 . 2008-12-12 17:19 <DIR> d-------- c:\windows\system32\config\systemprofile\Dane aplikacji\ArcaBit 2008-12-12 17:18 . 2008-12-12 17:18 <DIR> d-------- c:\documents and settings\LocalService\Dane aplikacji\ArcaBit 2008-12-12 16:57 . 2008-12-12 17:27 <DIR> d-------- c:\program files\ArcaBit 2008-12-12 16:55 . 2009-01-01 18:20 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-12-09 16:01 . 2008-12-09 16:01 <DIR> d-------- c:\program files\Common Files\snp2std 2008-12-09 14:14 . 2008-12-26 12:44 115,869 -r-hs---- c:\windows\system32\vamsoft.exe 2008-12-07 14:53 . 2009-01-05 04:48 522 --a------ C:\hpfr3420.xml 2008-12-05 20:39 . 2009-01-05 18:20 <DIR> d-------- c:\program files\Steam . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-05 17:39 --------- d-----w c:\program files\FlashGet 2009-01-05 16:02 --------- d-----w c:\program files\Mozilla Thunderbird 2009-01-03 15:22 --------- d-----w c:\program files\Common Files\Adobe 2009-01-03 14:47 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-27 16:27 --------- d-----w c:\program files\NAPI-PROJEKT 2008-12-21 21:00 --------- d-----w c:\program files\PeerGuardian2 2008-12-21 13:03 --------- d-----w c:\program files\MSECACHE 2008-12-20 21:47 6,312,289 ----a-w c:\program files\VentriloMIX.rar 2008-12-17 21:36 --------- d-----w c:\documents and settings\martinez\Dane aplikacji\Skype 2008-12-17 15:09 --------- d-----w c:\documents and settings\martinez\Dane aplikacji\skypePM 2008-12-09 15:01 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-02 17:11 --------- d-----w c:\program files\Windows Media Connect 2 2008-11-25 21:17 --------- d-----w c:\program files\Gadu-Gadu 2008-11-23 00:14 --------- d-----w c:\program files\Windows Installer Clean Up 2008-11-22 15:17 --------- d-----w c:\program files\Mp3 To Wave Converter 2008-11-11 20:16 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2008-11-10 18:05 --------- d-----w c:\program files\Foxit Software 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-05 10:32 63,818 -c--a-w c:\windows\BricoPackUninst.cmd 2008-10-05 10:32 6,120 -c--a-w c:\windows\BricoPackFoldersDelete.cmd 2008-10-05 10:32 219,648 ----a-w c:\windows\system32\uxtheme.dll 2005-11-04 06:29 72,832 -c--a-w c:\windows\inf\CamAvb.sys 2005-01-01 00:22 16,384 -csha-w c:\windows\system32\config\systemprofile\Cookies\index.dat 2005-01-01 00:22 32,768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat 2005-01-01 00:22 32,768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012005010120050102\index.dat 2005-01-01 00:22 32,768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((( snapshot_2009-01-05_ 4.52.27,50 ))))))))))))))))))))))))))))))))))))))))) . + 2009-01-05 17:19:10 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_66c.dat + 2009-01-05 17:31:06 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_978.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424] "Steam"="c:\program files\steam\steam.exe" [2008-12-05 1410296] "vamsoft"="c:\windows\system32\vamsoft.exe" [2008-12-26 115869] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "Flashget"="c:\program files\FlashGet\flashget.exe" [2007-09-25 2007088] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-04-07 188416] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "FixCamera"="c:\windows\FixCamera.exe" [2007-07-11 20480] "tsnp2std"="c:\windows\tsnp2std.exe" [2007-05-12 270336] "snp2std"="c:\windows\vsnp2std.exe" [2007-05-10 344064] "AvMenu"="c:\program files\ArcaBit\ArcaVir\AVMenu.exe" [2008-12-15 555528] "ArcaCheck"="c:\program files\ArcaBit\ArcaVir\ArcaCheck.exe" [2008-11-04 662024] "ABRegmon"="c:\program files\ArcaBit\ArcaVir\abregmon.exe" [2008-12-17 387592] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] "SoundMan"="SOUNDMAN.EXE" [2006-08-03 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-06 147456] hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672] Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2005-01-01 805392] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent] [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.SEDG"= mcs_vfw.dll "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^martinez^Menu Start^Programy^Autostart^OpenOffice.org 3.0.lnk] path=c:\documents and settings\martinez\Menu Start\Programy\Autostart\OpenOffice.org 3.0.lnk backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera] --a------ 2007-07-11 16:09 20480 c:\windows\FixCamera.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2008-06-19 08:53 570664 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-08-11 16:46 21741864 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] --a------ 2007-09-12 11:17 340136 c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-05-16 14:01 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "WinampAgent"="c:\program files\Winamp\winampa.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\Steam\\steamapps\\florian206\\counter-strike source\\hl2.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Steam\\steamapps\\abini\\counter-strike source\\hl2.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "50001:TCP"= 50001:TCP:ArcaVir CommunicationPort (S) "50000:TCP"= 50000:TCP:ArcaVir CommunicationPort (A) R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [2008-07-31 20616] R1 ABTDI;ABTDI;c:\program files\ArcaBit\ArcaVir\ABTDI.sys [2008-02-26 51208] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-08-13 78416] R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2008-10-04 179584] R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2008-10-04 49536] R3 ABFLT;ArcaBit File Monitor Driver;c:\progra~1\ArcaBit\ArcaVir\ABFLT.sys [2007-12-10 37896] R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;c:\program files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe [2008-01-30 200704] R3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;c:\program files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe [2008-09-05 241664] R4 ABFileMon;ArcaBit FileMonitor;c:\program files\ArcaBit\ArcaVir\FileMonSV.exe [2008-12-04 158216] R4 ArcaRemoteService;ArcaBit Control;c:\program files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe [2008-12-05 122880] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-08-13 20560] R4 AVTasks2;ArcaBit Tasks Service;c:\progra~1\ArcaBit\Common\ARCATA~1.EXE [2008-09-17 90112] R4 AVUpdate;ArcaBit Update Service;c:\progra~1\ArcaBit\ARCAUP~1\update.exe [2008-12-04 117256] S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2008-08-26 93696] S3 Camdrv30;Philips ToUcam XS;c:\windows\system32\drivers\camdrv30.sys [2008-12-09 171264] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2008-07-02 26248] S4 AVBackup;ArcaBit Backup Service;c:\program files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe [2008-11-25 178696] . Zawartość folderu 'Zaplanowane zadania' 2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] 2008-12-06 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1220179696.job - c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ uInternet Settings,ProxyOverride = *.local IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\SOFTWARE IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\SOFTWARE\Classes IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\SOFTWARE\Classes\CLSID IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438} IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\ProgID IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438} - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - c:\program files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll TCP: {1E5121F1-94CF-40D7-A533-0FEA24B68498} = 194.204.152.34,194.204.159.1 FF - ProfilePath - c:\documents and settings\martinez\Dane aplikacji\Mozilla\Firefox\Profiles\n69rfhqm.default\ FF - prefs.js: browser.startup.homepage - onet.pl FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - component: c:\program files\Mozilla Firefox\extensions\arcabit@www.arcabit.pl\components\ArcaExt.dll FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-05 18:43:49 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(800) c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll . Czas ukończenia: 2009-01-05 18:45:06 ComboFix-quarantined-files.txt 2009-01-05 17:45:03 ComboFix2.txt 2009-01-05 03:53:44 ComboFix3.txt 2008-12-21 15:32:39 ComboFix4.txt 2008-12-12 15:24:47 Przed: 40 079 273 984 bajtów wolnych Po: 40,001,642,496 bajtów wolnych 241 --- E O F --- 2009-01-05 04:11:31

i z HiJackThisa:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:46:42, on 2009-01-05 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\tsnp2std.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\Program Files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\PROGRA~1\ArcaBit\Common\ARCATA~1.EXE C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\PROGRA~1\ArcaBit\ARCAUP~1\update.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\Program Files\FlashGet\flashget.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Documents and Settings\martinez\Pulpit\Reszta programów\Optymalizacja windowsa xp\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nasza-klasa.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\abregmon.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra 'Tools' menuitem: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1218642589484 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1104540844390 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218590575218 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E5121F1-94CF-40D7-A533-0FEA24B68498}: NameServer = 194.204.152.34,194.204.159.1 O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit Control (ArcaRemoteService) - Unknown owner - C:\Program Files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ArcaBit Backup Service (AVBackup) - ArcaBit - C:\Program Files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe O23 - Service: ArcaBit Tasks Service (AVTasks2) - ArcaBit - C:\PROGRA~1\ArcaBit\Common\ARCATA~1.EXE O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\PROGRA~1\ArcaBit\ARCAUP~1\update.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 12320 bytes

dodam tylko, że tak samo przy starcie systemu nie chodzi klawiatura i nie mogę wybrać nawet w jakim trybie chcę odpalić komputer.
Macie jakiś pomysł jak usunąć ten plik, gdzie go znaleźć. Może jak wyleczyć?
Z Góry ogromne dzięki,
pozdrawiam.

**Posty:** 7838 · przez **Lukesh** 05 Sty 2009, 20:27

Na logach sie nie znam, ale od siebie moge szczerze polecic te dwa tematy:

optymalizacja-windowsa-xp-vt89133.html
przyspieszenie-ladowania-startu-xp-vt102670.html

**Posty:** 22 · przez **lili661** 05 Sty 2009, 20:48

Optymalizacje robiłam na samym początku, bo wydawało mi się, że mam za bardzo zawalony komputer, ale jednak to nie to

**Posty:** 8001 · przez **Okocza** 05 Sty 2009, 21:11

lili661, w logu ja nic nie widzę...

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd. Ewentualnie daj screen z programu Starter

**Posty:** 22 · przez **lili661** 05 Sty 2009, 21:48

Zrobiłam wszystko

z programu starter:

Kod: Zaznacz wszystko: Element,Wartość,Sekcja,Enabled,Description,Company "ABRegmon","C:\Program Files\ArcaBit\ArcaVir\abregmon.exe","Rejestr - Machine Run","1","Registry Monitor (ArcaVir 2009)","ArcaBit" "ArcaCheck","C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup","Rejestr - Machine Run","1","ArcaCheck (ArcaVir 2009)","ArcaBit" "avast!","C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe","Rejestr - Machine Run","0","avast! service GUI component (avast! Antivirus )","ALWIL Software" "AvMenu","C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe","Rejestr - Machine Run","1","ArcaVir Tray Module (ArcaVir 2009)","ArcaBit" "CTFMON.EXE","C:\WINDOWS\system32\ctfmon.exe","Rejestr - User Run","1","CTF Loader (Microsoft® Windows® Operating System)","Microsoft Corporation" "CTFMON.EXE","C:\WINDOWS\system32\CTFMON.EXE","Rejestr - Def User Run","1","CTF Loader (Microsoft® Windows® Operating System)","Microsoft Corporation" "FixCamera","C:\WINDOWS\FixCamera.exe","Rejestr - Machine Run","1","CameraFixer MFC Application (CameraFixer Application)","" "Flashget","C:\Program Files\FlashGet\flashget.exe /min","Rejestr - Machine Run","1","FlashGet","FlashGet.com" "Gadu-Gadu",""C:\Program Files\Gadu-Gadu\gg.exe" /tray","Rejestr - User Run","1","Gadu-Gadu - program główny (Gadu-Gadu)","Gadu-Gadu S.A." "hp psc 1000 series.lnk","C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe","Autostart - Wszyscy Użytkownicy","1","HP OfficeJet COM Device Objects (hp digital imaging - hp all-in-one series)","Hewlett-Packard Co." "HPDJ Taskbar Utility","C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe","Rejestr - Machine Run","1"," (HP DeskJet)","HP" "hpoddt01.exe.lnk","C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe","Autostart - Wszyscy Użytkownicy","1","hpotdd01 (Hewlett-Packard hpotdd01)","Hewlett-Packard" "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}",""C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020","Rejestr - User Run","1","Nero Home","Nero AG" "Kernel and Hardware Abstraction Layer","KHALMNPR.EXE","Rejestr - Machine Run","1","Logitech KHAL Main Process (Logitech SetPoint)","Logitech, Inc." "Logitech SetPoint.lnk","C:\Program Files\Logitech\SetPoint\SetPoint.exe","Autostart - Wszyscy Użytkownicy","1","Logitech SetPoint Event Manager (UNICODE) (Logitech SetPoint)","Logitech, Inc." "NBKeyScan",""C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"","Rejestr - Machine Run","1","Nero BackItUp","Nero AG" "nltide_2","regsvr32 /s /n /i:U shell32","Rejestr - Def User RunOnce","1","","" "NvCplDaemon","RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup","Rejestr - Machine Run","1","NVIDIA Display Properties Extension (NVIDIA Compatible Windows 2000 Display driver, Version 175.19 )","NVIDIA Corporation" "NVIDIA nTune",""C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear","Rejestr - User Run","1","NVIDIA nTune Command (NVIDIA nTune)","NVIDIA" "NvMediaCenter","RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit","Rejestr - Machine Run","1","NVIDIA Media Center Library","NVIDIA Corporation" "QuickTime Task",""C:\Program Files\QuickTime\qttask.exe" -atboottime","Rejestr - Machine Run","1","QuickTime Task (QuickTime)","Apple Inc." "snp2std","C:\WINDOWS\vsnp2std.exe","Rejestr - Machine Run","1","CameraMonitor Application","Sonix" "SoundMan","SOUNDMAN.EXE","Rejestr - Machine Run","1","Realtek Sound Manager","Realtek Semiconductor Corp." "SpybotSD TeaTimer","C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe","Rejestr - User Run","1","System settings protector (Spybot - Search & Destroy)","Safer Networking Limited" "Steam",""c:\program files\steam\steam.exe" -silent","Rejestr - User Run","1","Steam","Valve Corporation" "SunJavaUpdateSched",""C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"","Rejestr - Machine Run","1","Java(TM) Platform SE binary (Java(TM) Platform SE 6 U7)","Sun Microsystems, Inc." "tsnp2std","C:\WINDOWS\tsnp2std.exe","Rejestr - Machine Run","1","tsnp2std Microsoft (tsnp2std )","" "vamsoft","C:\WINDOWS\system32\vamsoft.exe","Rejestr - User Run","1","",""

**Posty:** 8001 · przez **Okocza** 05 Sty 2009, 21:49

lili661, screen z programu starter

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\windows\system32\vamsoft.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

i wracasz z nowymi logami.

Autor postu otrzymał pochwałę

**Posty:** 300 · przez **sgsman** 05 Sty 2009, 21:58

Okoczaku, pragnę zauważyć, że lili661 chyba cały czas ma tamten plik na dysku.

Lili661, oprócz tego, co radzą wszyscy wyżej, wykonaj skan tego pliku

C:/WINDOWS/system32/vbsdfe0.dll

tutaj:http://www.virustotal.com/
i tutaj: http://virusscan.jotti.org/
a potem wrzuć raporty ze skanów (oczywiście w tagach "code").

**Posty:** 18165 · przez **wojtas** 05 Sty 2009, 22:24

oczywiscie ten plik jest syfem:

C:/WINDOWS/system32/vbsdfe0.dll

tylko pytanie czy jest w kompie jeszcze.. dlatego wykonaj co kazalem.. wroc z nowymi logami i potem bedziemy dzialac dalej

**Posty:** 22 · przez **lili661** 10 Sty 2009, 16:17

No więc...od poczatku:

najpierw wrzucam zaległy screen startera:

http://i39.tinypic.com/30lylqa.jpg

Okocza usunęłam ten plik i o dziwo po ponownym uruchomieniu komputera arcavir nie wykrył już tego wirusa, a komputer uruchomił się w miarę szybko.
Wydawało mi się, że go usunęłam, więc wzięłam się za skanowanie combofixem i podczas skanowania arcavir wykrył mi jakiegoś innego wirusa i wyświetlił komunikat. Dziwne jest to, że jest to wirus tego samego typu Trojan.Gamethief coś tam..coś tam, tamten tez miał taki początek nazwy.
No i jakiś dziwny napis pokazał mi się w combofixie, który wcześniej nie występował, zrobiłam sreena:

http://i44.tinypic.com/vqsm7c.jpg

no i logi z combofixa i hijackthisa:

Kod: Zaznacz wszystko: ComboFix 09-01-09.03 - martinez 2009-01-10 15:03:14.10 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1461 [GMT 1:00] Uruchomiony z: c:\documents and settings\martinez\Pulpit\Reszta programów\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-10 do 2009-01-10 ))))))))))))))))))))))))))))))) . 2009-01-10 14:50 . 2009-01-10 14:51 <DIR> d-------- C:\!KillBox 2009-01-10 14:16 . 2009-01-10 14:16 <DIR> d-------- c:\program files\DVDVideoSoft 2009-01-10 14:16 . 2009-01-10 14:16 <DIR> d-------- c:\program files\Common Files\DVDVideoSoft 2009-01-10 14:16 . 2009-01-10 14:16 <DIR> d-------- c:\program files\AskBarDis 2009-01-07 04:49 . 2009-01-07 04:49 <DIR> d-------- c:\program files\Mop 2009-01-05 20:51 . 2009-01-05 20:51 <DIR> d--h----- c:\windows\PIF 2009-01-05 20:44 . 2009-01-05 20:47 <DIR> d-------- c:\program files\CodeStuff 2009-01-05 18:47 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix 2009-01-05 18:39 . 2009-01-10 14:50 <DIR> d-------- C:\Downloads 2009-01-03 16:20 . 2009-01-03 16:20 <DIR> d-------- c:\program files\Bonjour 2009-01-03 16:09 . 2009-01-03 16:09 <DIR> d-------- c:\program files\Common Files\Macrovision Shared 2009-01-02 18:16 . 2009-01-02 18:17 <DIR> d-------- c:\documents and settings\martinez\Dane aplikacji\Media Player Classic 2009-01-01 18:20 . 2009-01-01 18:20 <DIR> d----c--- c:\windows\system32\DRVSTORE 2009-01-01 18:20 . 2009-01-01 18:20 <DIR> d-------- c:\windows\system32\AGEIA 2009-01-01 18:20 . 2009-01-01 18:20 <DIR> d-------- c:\program files\AGEIA Technologies 2008-12-30 00:27 . 2008-12-30 00:27 <DIR> d-------- c:\program files\Common Files\xing shared 2008-12-30 00:26 . 2008-12-30 00:26 <DIR> d-------- c:\program files\Real 2008-12-30 00:26 . 2008-12-30 00:27 <DIR> d-------- c:\program files\Common Files\Real 2008-12-21 16:58 . 2008-12-21 17:01 <DIR> d-------- c:\program files\F-Group 2008-12-21 16:55 . 2008-12-21 16:55 <DIR> d-------- c:\program files\FDRLab 2008-12-21 16:55 . 2008-12-21 16:55 <DIR> d-------- c:\documents and settings\martinez\Dane aplikacji\FDRLab 2008-12-21 14:20 . 2008-12-21 14:20 <DIR> d-------- c:\program files\MSBuild 2008-12-21 14:16 . 2008-12-21 14:16 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-21 14:15 . 2008-12-21 14:15 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-21 14:15 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-21 14:10 . 2008-12-21 14:10 <DIR> d-------- c:\program files\Sony Setup 2008-12-21 14:10 . 2008-12-21 14:10 <DIR> d-------- c:\documents and settings\martinez\Dane aplikacji\Sony Setup 2008-12-21 04:01 . 2008-12-22 01:34 <DIR> d-------- C:\Fraps 2008-12-12 17:24 . 2008-12-13 16:54 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ArcaBit 2008-12-12 17:19 . 2008-12-12 17:19 <DIR> d-------- c:\windows\system32\config\systemprofile\Dane aplikacji\ArcaBit 2008-12-12 17:18 . 2008-12-12 17:18 <DIR> d-------- c:\documents and settings\LocalService\Dane aplikacji\ArcaBit 2008-12-12 16:57 . 2008-12-12 17:27 <DIR> d-------- c:\program files\ArcaBit 2008-12-12 16:55 . 2009-01-01 18:20 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-10 13:54 --------- d-----w c:\program files\Steam 2009-01-10 13:51 --------- d-----w c:\program files\FlashGet 2009-01-10 13:03 --------- d-----w c:\program files\Mozilla Thunderbird 2009-01-10 12:54 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-07 22:20 --------- d-----w c:\documents and settings\martinez\Dane aplikacji\Skype 2009-01-07 18:54 --------- d-----w c:\documents and settings\martinez\Dane aplikacji\skypePM 2009-01-03 15:22 --------- d-----w c:\program files\Common Files\Adobe 2008-12-27 16:27 --------- d-----w c:\program files\NAPI-PROJEKT 2008-12-21 21:00 --------- d-----w c:\program files\PeerGuardian2 2008-12-21 13:03 --------- d-----w c:\program files\MSECACHE 2008-12-20 21:47 6,312,289 ----a-w c:\program files\VentriloMIX.rar 2008-12-09 15:01 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-09 15:01 --------- d-----w c:\program files\Common Files\snp2std 2008-12-02 17:11 --------- d-----w c:\program files\Windows Media Connect 2 2008-11-25 21:17 --------- d-----w c:\program files\Gadu-Gadu 2008-11-23 00:14 --------- d-----w c:\program files\Windows Installer Clean Up 2008-11-22 15:17 --------- d-----w c:\program files\Mp3 To Wave Converter 2008-11-11 20:16 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2008-11-10 18:05 --------- d-----w c:\program files\Foxit Software 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2005-11-04 06:29 72,832 -c--a-w c:\windows\inf\CamAvb.sys 2005-01-01 00:22 16,384 -csha-w c:\windows\system32\config\systemprofile\Cookies\index.dat 2005-01-01 00:22 32,768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat 2005-01-01 00:22 32,768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012005010120050102\index.dat 2005-01-01 00:22 32,768 -csha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-08-26 10:32 279944 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424] "Steam"="c:\program files\steam\steam.exe" [2008-12-05 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Flashget"="c:\program files\FlashGet\flashget.exe" [2007-09-25 2007088] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-04-07 188416] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "FixCamera"="c:\windows\FixCamera.exe" [2007-07-11 20480] "tsnp2std"="c:\windows\tsnp2std.exe" [2007-05-12 270336] "snp2std"="c:\windows\vsnp2std.exe" [2007-05-10 344064] "AvMenu"="c:\program files\ArcaBit\ArcaVir\AVMenu.exe" [2008-12-15 555528] "ArcaCheck"="c:\program files\ArcaBit\ArcaVir\ArcaCheck.exe" [2008-11-04 662024] "ABRegmon"="c:\program files\ArcaBit\ArcaVir\abregmon.exe" [2008-12-17 387592] "MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 171520] "SoundMan"="SOUNDMAN.EXE" [2006-08-03 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-06 147456] hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672] Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2005-01-01 805392] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.SEDG"= mcs_vfw.dll "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^martinez^Menu Start^Programy^Autostart^OpenOffice.org 3.0.lnk] path=c:\documents and settings\martinez\Menu Start\Programy\Autostart\OpenOffice.org 3.0.lnk backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera] --a------ 2007-07-11 16:09 20480 c:\windows\FixCamera.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2008-06-19 08:53 570664 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-08-11 16:46 21741864 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] --a------ 2007-09-12 11:17 340136 c:\program files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 03:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-05-16 14:01 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "NMIndexingService"=3 (0x3) "idsvc"=3 (0x3) "IDriverT"=3 (0x3) "FLEXnet Licensing Service"=3 (0x3) "Capture Device Service"=2 (0x2) "Bonjour Service"=2 (0x2) "avast! Web Scanner"=3 (0x3) "avast! Mail Scanner"=3 (0x3) "avast! Antivirus"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "ose"=3 (0x3) "aswUpdSv"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "WinampAgent"="c:\program files\Winamp\winampa.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\Steam\\steamapps\\florian206\\counter-strike source\\hl2.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Steam\\steamapps\\abini\\counter-strike source\\hl2.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "50001:TCP"= 50001:TCP:ArcaVir CommunicationPort (S) "50000:TCP"= 50000:TCP:ArcaVir CommunicationPort (A) R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [2008-07-31 20616] R1 ABTDI;ABTDI;c:\program files\ArcaBit\ArcaVir\ABTDI.sys [2008-02-26 51208] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-08-13 78416] R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2008-10-04 179584] R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2008-10-04 49536] R3 ABFLT;ArcaBit File Monitor Driver;c:\progra~1\ArcaBit\ArcaVir\ABFLT.sys [2007-12-10 37896] R3 ArcaBit.Core.Configurator;ArcaBit.Core.Configurator;c:\program files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe [2008-01-30 200704] R3 ArcaBit.Core.LoggingService;ArcaBit.Core.LoggingService;c:\program files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe [2008-09-05 241664] R4 ABFileMon;ArcaBit FileMonitor;c:\program files\ArcaBit\ArcaVir\FileMonSV.exe [2008-12-04 158216] R4 ArcaRemoteService;ArcaBit Control;c:\program files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe [2008-12-05 122880] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-08-13 20560] R4 AVTasks2;ArcaBit Tasks Service;c:\progra~1\ArcaBit\Common\ARCATA~1.EXE [2008-09-17 90112] R4 AVUpdate;ArcaBit Update Service;c:\progra~1\ArcaBit\ARCAUP~1\update.exe [2008-12-04 117256] S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2008-08-26 93696] S3 Camdrv30;Philips ToUcam XS;c:\windows\system32\drivers\camdrv30.sys [2008-12-09 171264] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2008-07-02 26248] S4 AVBackup;ArcaBit Backup Service;c:\program files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe [2008-11-25 178696] . Zawartość folderu 'Zaplanowane zadania' 2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] 2008-12-06 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1220179696.job - c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-vamsoft - c:\windows\system32\vamsoft.exe Notify-AtiExtEvent - (no file) . ------- Skan uzupełniający ------- . uStart Page = hxxp://nasza-klasa.pl/ uInternet Settings,ProxyOverride = *.local IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\SOFTWARE IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\SOFTWARE\Classes IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\SOFTWARE\Classes\CLSID IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438} IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438}\ProgID IE: {{40525A66-DB98-480D-BCF9-7AF88C1AF438} - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - c:\program files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll TCP: {1E5121F1-94CF-40D7-A533-0FEA24B68498} = 194.204.152.34,194.204.159.1 FF - ProfilePath - c:\documents and settings\martinez\Dane aplikacji\Mozilla\Firefox\Profiles\n69rfhqm.default\ FF - prefs.js: browser.startup.homepage - onet.pl FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - component: c:\program files\Mozilla Firefox\extensions\arcabit@www.arcabit.pl\components\ArcaExt.dll FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-10 15:06:48 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1659004503-1637723038-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{83A082FA-B7C0-7232-0E53-6013D0ACE4F4}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "pahjjheldppmhifjpellaaaokbkgibda"=hex:61,62,61,6f,63,65,6b,6c,69,66,69,66,67, 65,66,62,6e,6c,6a,65,65,6d,70,64,6c,63,64,6c,6b,69,6c,70,64,6c,00,00 [HKEY_USERS\S-1-5-21-1659004503-1637723038-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CEBAB9F5-D3A4-264D-78AC-40D80231591B}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "pakmbahoflakejdonppdppglfkeicgkp"=hex:61,61,00,00 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(812) c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll . Czas ukończenia: 2009-01-10 15:08:22 ComboFix-quarantined-files.txt 2009-01-10 14:08:20 ComboFix2.txt 2009-01-09 13:36:08 Przed: 39 367 745 536 bajtów wolnych Po: 39,359,078,400 bajtów wolnych Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4 262 --- E O F --- 2009-01-09 22:59:45

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:10:08, on 2009-01-10 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\tsnp2std.exe C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe C:\Program Files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe C:\PROGRA~1\ArcaBit\Common\ARCATA~1.EXE C:\PROGRA~1\ArcaBit\ARCAUP~1\update.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\martinez\Pulpit\Reszta programów\Optymalizacja windowsa xp\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nasza-klasa.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [AvMenu] C:\Program Files\ArcaBit\ArcaVir\AVMenu.exe O4 - HKLM\..\Run: [ArcaCheck] C:\Program Files\ArcaBit\ArcaVir\ArcaCheck.exe /startup O4 - HKLM\..\Run: [ABRegmon] C:\Program Files\ArcaBit\ArcaVir\abregmon.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra 'Tools' menuitem: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1218642589484 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1104540844390 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218590575218 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E5121F1-94CF-40D7-A533-0FEA24B68498}: NameServer = 194.204.152.34,194.204.159.1 O23 - Service: ArcaBit FileMonitor (ABFileMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\FileMonSV.exe O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit - C:\Program Files\ArcaBit\ArcaVir\NetMonSV.exe O23 - Service: ArcaBit.Core.Configurator - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.Configurator2.exe O23 - Service: ArcaBit.Core.LoggingService - ArcaBit - C:\Program Files\ArcaBit\Common\ArcaBit.Core.LoggingService.exe O23 - Service: ArcaBit Control (ArcaRemoteService) - Unknown owner - C:\Program Files\ArcaBit\ArcaAgent\ArcaRemoteSvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ArcaBit Backup Service (AVBackup) - ArcaBit - C:\Program Files\ArcaBit\ArcaTools\arcabackup\ArcaBackupService.exe O23 - Service: ArcaBit Tasks Service (AVTasks2) - ArcaBit - C:\PROGRA~1\ArcaBit\Common\ARCATA~1.EXE O23 - Service: ArcaBit Update Service (AVUpdate) - ArcaBit - C:\PROGRA~1\ArcaBit\ARCAUP~1\update.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 11335 bytes

Sgsman niestety nie mogłam tym przeskanować tego pliku, ponieważ jego nie ma w tym folderze, albo jest ukryty i nie mogłam go wybrać poprzez opcję ''przeglądaj'', a ścieżki wpisać nie można było.

**Posty:** 18165 · przez **wojtas** 10 Sty 2009, 19:00

masz 2 antywirusy wywal jeden!!

c:\program files\AskBarDis

skasuj ten folder do kosza i te wpisy

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.