zamulony komp!!!!

[slowik76]

Proszę o sprawdzenie loga poniewaz od jakiegoś czasu strasznie wolno się włącza komp!! dzięki!!-------Logfile of HijackThis v1.99.1
Scan saved at 06:54:01, on 2007-09-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\K-Meleon\k-meleon.exe
C:\Documents and Settings\tomek&sylwia\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eu.microsoft.com/poland/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

[pp3088]

Czysto.

Daj loga z Combofix.

[slowik76]

ComboFix 07-09-20.1 - "tomek&sylwia" 2007-09-21 14:18:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.633 [GMT 2:00]
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 )))))))))))))))))))))))))))))))
.

2007-09-21 14:17 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-21 10:21 0 ---h----- C:\DOCUME~1\TOMEK&~1\DANEAP~1\TurboLaunch_IconCache.dat
2007-09-21 10:20 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\Help
2007-09-21 09:08 <DIR> d-------- C:\Program Files\PowerQuest
2007-09-21 09:08 <DIR> d-------- C:\Program Files\InstallShield Installation Information
2007-09-21 09:08 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-09-21 08:49 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-09-20 16:14 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP
2007-09-20 15:58 <DIR> d-------- C:\Program Files\Skype
2007-09-20 15:58 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\Skype
2007-09-20 15:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype
2007-09-20 11:13 <DIR> d-------- C:\Program Files\Real Alternative
2007-09-20 11:13 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\Real
2007-09-20 11:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real
2007-09-20 10:44 327,168 --a------ C:\WINDOWS\IsUn0415.exe
2007-09-20 10:44 <DIR> d-------- C:\WINDOWS\Profiles
2007-09-20 10:44 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\InterTrust
2007-09-20 10:02 <DIR> d-------- C:\WINDOWS\pss
2007-09-20 09:48 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-09-20 09:47 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-09-20 09:41 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-09-20 09:39 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-09-20 09:27 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\WinRAR
2007-09-20 09:15 57,344 --a------ C:\WINDOWS\system32\CGZipLibrary.DLL
2007-09-20 09:15 40,960 --a------ C:\WINDOWS\system32\SSubTmr6.dll
2007-09-20 09:15 <DIR> d-------- C:\Program Files\RegDoctor
2007-09-20 09:11 86,016 -ra------ C:\WINDOWS\system32\CNMCP5y.exe
2007-09-20 09:10 <DIR> d-------- C:\Program Files\Canon
2007-09-20 09:09 7,680 --a------ C:\WINDOWS\system32\CNMVS5y.DLL
2007-09-20 09:09 116,736 --a------ C:\WINDOWS\system32\CNMLM5y.DLL
2007-09-20 09:09 <DIR> d--h----- C:\BJPrinter
2007-09-20 09:07 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-09-20 09:07 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-09-19 21:49 <DIR> d-------- C:\Program Files\OO Software
2007-09-19 20:41 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\Thinstall
2007-09-19 20:40 <DIR> d-------- C:\Program Files\CCleaner
2007-09-19 20:31 <DIR> d-------- C:\Program Files\Odkurzacz
2007-09-19 20:14 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2007-09-19 19:27 <DIR> d-------- C:\WINDOWS\system32\oodag
2007-09-19 19:23 <DIR> d-------- C:\Program Files\Ares
2007-09-19 18:22 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-09-19 18:21 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-09-19 18:21 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-09-19 18:06 <DIR> d-------- C:\Program Files\K-Meleon
2007-09-19 18:06 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\K-Meleon
2007-09-19 17:50 <DIR> d-------- C:\Program Files\Gadu-Gadu
2007-09-19 17:50 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\Gadu-Gadu
2007-09-19 17:47 <DIR> d-------- C:\Program Files\ESTsoft
2007-09-19 17:47 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\ESTSoft
2007-09-19 17:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ESTsoft
2007-09-19 17:43 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-09-19 17:43 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2007-09-19 17:43 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-09-19 17:43 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-09-19 17:43 <DIR> d-------- C:\Program Files\SubEdit-Player
2007-09-19 17:43 <DIR> d-------- C:\Program Files\ffdshow
2007-09-19 17:39 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-09-19 17:38 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2007-09-19 17:38 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-09-19 17:38 46,464 --a------ C:\WINDOWS\system32\drivers\GAGP30KX.SYS
2007-09-19 17:37 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne
2007-09-19 17:37 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji
2007-09-19 17:37 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji
2007-09-19 17:37 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start
2007-09-19 17:37 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start
2007-09-19 17:37 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty
2007-09-19 17:37 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony
2007-09-19 17:37 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony
2007-09-19 17:37 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione
2007-09-19 17:37 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit
2007-09-19 17:37 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty
2007-09-19 17:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione
2007-09-19 17:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit
2007-09-19 17:34 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-09-19 17:34 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2007-09-19 17:34 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\TuneUp Software
2007-09-19 17:33 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-19 17:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\TuneUp Software
2007-09-19 17:29 <DIR> d-------- C:\Program Files\Your Uninstaller 2006
2007-09-19 17:29 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\URSoft
2007-09-19 17:19 1,156 --a------ C:\WINDOWS\mozver.dat
2007-09-19 17:16 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\Talkback
2007-09-19 17:13 0 --a------ C:\WINDOWS\nsreg.dat
2007-09-19 16:43 82,061 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-09-19 16:43 81,549 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-09-19 16:43 116,256 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-09-19 16:43 1,761,568 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-19 16:43 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-09-19 16:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab
2007-09-19 16:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab Setup Files
2007-09-19 16:40 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2007-09-19 16:39 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-09-19 16:13 <DIR> d-------- C:\Program Files\uTorrent
2007-09-19 16:13 <DIR> d-------- C:\DOCUME~1\TOMEK&~1\DANEAP~1\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-21 10:02 28232 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-09-21 10:02 15500 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-09-19 15:44 --------- d-------- C:\Program Files\microsoft frontpage
2007-07-20 00:57 267112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2007-07-20 00:54 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-07-19 18:14 444776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-07-19 18:14 3727720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-07-19 18:14 1358192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-06-28 12:51 206088 --a------ C:\WINDOWS\system32\klogon.dll
--------- C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiscSpaceChecks"=000000000000f03f

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

R0 viasraid;viasraid;C:\WINDOWS\system32\drivers\viasraid.sys
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
*Newly Created Service* - PQNTDRV
.
Contents of the 'Scheduled Tasks' folder
"2007-09-19 15:34:27 C:\WINDOWS\Tasks\1-Click Maintenance.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-21 14:23:40
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-21 14:24:27
.
--- E O F ---

[slake1]

Czysto.

Przeczyść rejestr programem jv16 PowerTools.

[slowik76]

Wielkie dzięki za pomoc!!!!

[buzu]

od jakiegoś czasu strasznie wolno się włącza komp

Prawdopodobnie przyczyną wolnego włączania kompa jest pakiet KIS.
Ale coś za coś.