proszę o sprawdzenie loga

**Posty:** 70 · przez **Komisasz** 06 Cze 2007, 23:19

ostatnimi czasy wyskakuje mi 100% zużycia procesora...i nie wiem dlaczego...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:55:50, on 2007-06-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe F:\WINDOWS\System32\svchost.exe C:\Program Files\Eset\nod32kui.exe F:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe F:\Program Files\Neostrada TP\NeostradaTP.exe F:\Program Files\Neostrada TP\ComComp.exe F:\Program Files\Neostrada TP\Watch.exe C:\Program Files\paintshop\Thinstall\Corel Pain Shop Pro 11.20PL\4000002e00003h\PSIService.exe C:\Program Files\Opera\Opera.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - F:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (file missing) O17 - HKLM\System\CCS\Services\Tcpip\..\{AC13E0D3-8595-408D-956B-48F20A8CE884}: NameServer = 85.255.114.85,85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\..\{FF782A2F-6B81-467B-B4E6-BDAAFFDBAF09}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.85 85.255.112.213 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.85 85.255.112.213 O23 - Service: Adobe LM Service - Adobe Systems - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\system32\HPZipm12.exe

**Posty:** 18165 · przez **wojtas** 06 Cze 2007, 23:21

skasuj:

O17 - HKLM\System\CCS\Services\Tcpip\..\{AC13E0D3-8595-408D-956B-48F20A8CE884}: NameServer = 85.255.114.85,85.255.112.213
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.85 85.255.112.213
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.85 85.255.112.213

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go

daj loga z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 70 · przez **Komisasz** 07 Cze 2007, 00:02

Kod: Zaznacz wszystko: "admin" - 2007-06-06 23:27:11 Dodatek Service Pack 2 NTFS ComboFix 07-06-3B - Running from: "F:\Documents and Settings\admin\Pulpit\" ((((((((((((((((((((((((( Files Created from 2007-05-06 to 2007-06-06 ))))))))))))))))))))))))))))))) 2007-06-06 23:22 6,253 --a------ F:\dnsbak.reg 2007-06-05 17:04 20,328 --a------ F:\DOCUME~1\admin\DANEAP~1\GDIPFONTCACHEV1.DAT 2007-05-29 22:30 88 -r-hs---- F:\WINDOWS\system32\5F6280B014.sys 2007-05-29 22:30 3,350 --ahs---- F:\WINDOWS\system32\KGyGaAvL.sys 2007-05-29 22:29 <DIR> d-------- F:\DOCUME~1\ALLUSE~1\DANEAP~1\InstallShield 2007-05-29 16:47 <DIR> d-------- F:\Program Files\Common Files\Adobe Systems Shared 2007-05-25 11:08 <DIR> d-------- F:\Program Files\Media Player Classic 2007-05-25 11:07 <DIR> d-------- F:\Program Files\Real Alternative 2007-05-25 11:07 <DIR> d-------- F:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-05-25 11:07 <DIR> d-------- F:\DOCUME~1\admin\DANEAP~1\Real 2007-05-24 21:50 <DIR> d-------- F:\DOCUME~1\admin\.jpi_cache 2007-05-22 07:28 3,968 --a------ F:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-05-21 21:27 82,432 -ra------ F:\WINDOWS\system32\MSXML4r.dll 2007-05-21 21:27 626,960 -ra------ F:\WINDOWS\system32\hpvaut32.dll 2007-05-21 21:27 487,424 -ra------ F:\WINDOWS\system32\hpvcp70.dll 2007-05-21 21:27 44,544 -ra------ F:\WINDOWS\system32\MSXML4a.dll 2007-05-21 21:27 344,064 -ra------ F:\WINDOWS\system32\hpvcr70.dll 2007-05-21 21:27 <DIR> d-------- F:\Program Files\Hewlett-Packard 2007-05-21 21:27 <DIR> d-------- F:\DOCUME~1\ALLUSE~1\DANEAP~1\Hewlett-Packard 2007-05-21 21:25 <DIR> d-------- F:\Program Files\Common Files\Hewlett-Packard 2007-05-21 21:23 94,208 --a------ F:\WINDOWS\system32\HPZipt12.dll 2007-05-21 21:23 65,536 --a------ F:\WINDOWS\system32\HPZipm12.exe 2007-05-21 21:23 61,440 --a------ F:\WINDOWS\system32\HPZinw12.exe 2007-05-21 21:23 57,344 --a------ F:\WINDOWS\system32\HPZisn12.dll 2007-05-21 21:23 306,688 --a------ F:\WINDOWS\IsUninst.exe 2007-05-21 21:23 278,584 --a------ F:\WINDOWS\system32\HPZidr12.dll 2007-05-21 21:23 204,800 --a------ F:\WINDOWS\system32\HPZipr12.dll 2007-05-21 21:20 <DIR> d-------- F:\Program Files\HP 2007-05-21 21:18 51,088 -ra------ F:\WINDOWS\system32\drivers\hpzid412.sys 2007-05-21 21:18 17,176 --------- F:\WINDOWS\hpomdl04.dat 2007-05-21 21:18 16,496 -ra------ F:\WINDOWS\system32\drivers\HPZipr12.sys 2007-05-21 21:18 104,642 --a------ F:\WINDOWS\hpoins04.dat 2007-05-21 21:17 90,112 -ra------ F:\WINDOWS\system32\hpovst08.dll 2007-05-21 21:17 581,632 -ra------ F:\WINDOWS\system32\hpotscl.dll 2007-05-21 21:17 278,528 -ra------ F:\WINDOWS\system32\hpgwiamd.dll 2007-05-21 21:17 270,336 -ra------ F:\WINDOWS\system32\HPZc3212.dll 2007-05-21 21:17 21,744 -ra------ F:\WINDOWS\system32\drivers\HPZius12.sys 2007-05-21 21:17 15,104 --a------ F:\WINDOWS\system32\drivers\usbscan.sys 2007-05-21 21:16 25,856 --a------ F:\WINDOWS\system32\drivers\usbprint.sys 2007-05-21 21:15 31,616 --a------ F:\WINDOWS\system32\drivers\usbccgp.sys 2007-05-21 17:06 <DIR> d-------- F:\WINDOWS\ShellNew 2007-05-21 16:58 2,560 --a------ F:\WINDOWS\system32\bitcometres.dll 2007-05-20 23:06 <DIR> d-------- F:\DOCUME~1\admin\DANEAP~1\vlc 2007-05-20 21:08 <DIR> d-------- F:\DOCUME~1\admin\DANEAP~1\Ahead 2007-05-20 21:04 <DIR> d-------- F:\Program Files\Common Files\Ahead 2007-05-20 20:45 221,184 --a------ F:\WINDOWS\system32\wmpns.dll 2007-05-20 20:22 29,704 --a------ F:\WINDOWS\system32\uxtuneup.dll 2007-05-20 20:22 <DIR> d-------- F:\DOCUME~1\admin\DANEAP~1\TuneUp Software 2007-05-20 20:21 <DIR> d-------- F:\Program Files\Common Files\Wise Installation Wizard 2007-05-20 20:21 <DIR> d-------- F:\DOCUME~1\ALLUSE~1\DANEAP~1\TuneUp Software 2007-05-20 20:14 512,096 --a------ F:\WINDOWS\system32\drivers\amon.sys 2007-05-20 20:14 298,104 --a------ F:\WINDOWS\system32\imon.dll 2007-05-20 20:14 15,424 --a------ F:\WINDOWS\system32\drivers\nod32drv.sys 2007-05-20 20:06 <DIR> d-------- F:\DOCUME~1\admin\DANEAP~1\Talkback 2007-05-20 19:44 <DIR> d-------- F:\DOCUME~1\admin\Gadu-Gadu 2007-05-20 19:10 <DIR> dr-hsc--- F:\WINDOWS\system32\dllcache 2007-05-20 19:10 <DIR> dr--s---- F:\WINDOWS\Fonts 2007-05-20 19:10 <DIR> dr------- F:\WINDOWS\Web 2007-05-20 19:10 <DIR> d--h----- F:\WINDOWS\inf 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\WinSxS 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\twain_32 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\wins 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\wbem 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\usmt 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\spool 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\ShellExt 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\Setup 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\ras 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\oobe 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\npp 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\mui 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\inetsrv 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\IME 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\icsxml 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\ias 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\export 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\drivers\etc 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\drivers\disdn 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\drivers 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\dhcp 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\config 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\3com_dmi 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\3076 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\2052 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1054 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1045 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1042 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1041 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1037 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1033 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1031 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1028 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32\1025 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system32 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\system 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\security 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\Resources 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\repair 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\mui 2007-05-20 19:10 <DIR> d-------- F:\WINDOWS\msapps (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-03 09:17:59 49,712 ----a-w F:\WINDOWS\system32\perfc015.dat 2007-06-03 09:17:59 355,830 ----a-w F:\WINDOWS\system32\perfh015.dat 2007-05-20 15:25:23 -------- d-----w F:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll [2007-03-19 09:47] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-20 20:12] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-01-16 09:41] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"=0 (0x0) "SynchronousUserGroupPolicy"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"=1 (0x1) "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"=0 (0x0) "NoSaveSettings"=0 (0x0) "NoRecentDocsHistory"=1 (0x1) "NoLowDiskSpaceChecks"=1 (0x1) "ClearRecentDocsOnExit"=1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* UxTuneUp Contents of the 'Scheduled Tasks' folder 2007-06-01 15:19:24 F:\WINDOWS\tasks\1-Click Maintenance.job ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-06 23:28:36 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-06 23:29:38 --- E O F ---

...aha przy wyłączaniu komputera wyskakuje mi komunikat windowsa - kończenie programu - Welcome - muszę kliknąć zakończ teraz inaczej komp sie nie wyłączy i komunikat stacja dyskietek A: nie jest gotowa (ponów próbę/ignoruj/kontynuuj) - ale to nie przeszkadza przy wyłączaniu...nie wiem o co chodzi z tym...

**Posty:** 18165 · przez **wojtas** 07 Cze 2007, 09:32

wylacz noda 32 przy wylaczeniu i zobacz czy bedzie komunikat

logi masz ok

**Posty:** 70 · przez **Komisasz** 07 Cze 2007, 13:40

no z tymi komunikatami to różnie bywa czasem są, czasem nie... a po wyłączeniu nie było o Welcome, stacja dyskietek ciągle nie gotowa

dzięki za sprawdzenie logów.

proszę o sprawdzenie loga

Proszę o sprawdzenie loga

Kto jest na forum