Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    Bardzo proszę o sprawdzenie loga

    13.03.06, 15:51
    Objawy są takie, że komputer jest strasznie zamulony, zawiesza się po próbie
    otwarcia zwykłego folderu, internet również chodzi bardzo wolno. Skaner mks-
    virem nic nie wykazał, również ad-aware i f-secure..

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\NMSSvc.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic
    Update.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
    C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\system32\NWTRAY.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\WINDOWS\TPPALDR.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
    C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\Compaq\EAKDRV\EAUSBKBD.EXE
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Gadu-Gadu\gg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.onet.pl/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
    go.compaq.com/1Q00CDT/0415/bl8.asp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
    O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button
    Support\StartEAK.exe
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-
    Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe
    O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
    O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital
    Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-
    Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-
    Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft
    AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-
    Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-
    Secure\Anti-Spyware\blockpopups.htm
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-
    secure\fsps\program\fslsp.dll
    O15 - Trusted Zone: www.mks.com.pl
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
    Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) -
    asp01.photoprintit.de/microsite/defaults/activex/IPSUploader.cab
    O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
    skaner.mks.com.pl/SkanerOnline.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{08E20642-2D70-4D39-A678-
    9308A553BBB7}: NameServer = 10.0.10.2
    O17 - HKLM\System\CS1\Services\Tcpip\..\{08E20642-2D70-4D39-A678-
    9308A553BBB7}: NameServer = 10.0.10.2
    O17 - HKLM\System\CS2\Services\Tcpip\..\{08E20642-2D70-4D39-A678-
    9308A553BBB7}: NameServer = 10.0.10.2
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-
    Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197
    \Program\SERVIC~1.EXE
    O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) -
    Compaq Computer Corporation - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. -
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation -
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-
    Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure
    Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-
    Secure\Common\FSMA32.EXE
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\Sy
    Obserwuj wątek
      • kolobos Re: Bardzo proszę o sprawdzenie loga 13.03.06, 15:59
        Odinstaluj mks i moze narazie f-secure, zainstaluj Avast i zobacz czy cos sie
        zmieni.W msconfig wylacz zbedne programy.
        Doklej tez koncowke log'a ktory jak widac nie zmiescil sie w calosci.
        • qwerty32 Re: Bardzo proszę o sprawdzenie loga 13.03.06, 16:03
          oto końcówka loga

          O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32
          \NMSSvc.exe
          O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
          C:\WINDOWS\System32\nvsvc32.exe

          • barracuda7110 Re: Bardzo proszę o sprawdzenie loga 13.03.06, 19:39
            Początku też nie wkleiłeś. Pozatym spróbuj przeskanować dyski scandiskiem,
            włączyć oczyszczanie, zrobić defragmentację.

            ps ile masz wolnego miejsca na partycji systemowej?
            • qwerty32 Re: Bardzo proszę o sprawdzenie loga 14.03.06, 16:52
              ponownie wklejam loga z prośbą o sprawdzenie...Użyłem Avasta, zrobiłem
              scandisk, oczyściłem dysk i zrobiłem defragmentacje, wyłączem zbędne programy -
              niestety wszytko bez rezulatatów...

              Logfile of HijackThis v1.99.1
              Scan saved at 16:44:56, on 2006-03-14
              Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
              C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
              C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
              C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
              C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
              C:\Program Files\F-Secure\Common\FSMA32.EXE
              C:\Program Files\F-Secure\Common\FSMB32.EXE
              C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
              C:\WINDOWS\System32\NMSSvc.exe
              C:\WINDOWS\System32\nvsvc32.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\F-Secure\Common\FCH32.EXE
              C:\Program Files\F-Secure\Common\FAMEH32.EXE
              C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
              C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
              C:\Program Files\F-Secure\Common\FNRB32.EXE
              C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
              C:\Program Files\F-Secure\Common\FIH32.EXE
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
              C:\WINDOWS\TPPALDR.EXE
              C:\Program Files\Common Files\Real\Update_OB\realsched.exe
              C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
              C:\WINDOWS\system32\NWTRAY.EXE
              C:\Program Files\Messenger\msmsgs.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
              C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
              C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
              C:\Program Files\eMule\emule.exe
              C:\WINDOWS\Explorer.exe
              C:\Program Files\hijackthis\HijackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
              www.onet.pl/
              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
              go.compaq.com/1Q00CDT/0415/bl8.asp
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
              C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
              O4 - HKLM\..\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe
              O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital
              Imaging\\Unload\hpqcmon.exe
              O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
              Files\Real\Update_OB\realsched.exe" -osboot
              O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-
              Packard\HP Share-to-Web\hpgs2wnd.exe
              O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
              O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
              O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-
              Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
              O8 - Extra context menu item: &Block this popup - C:\Program Files\F-
              Secure\Anti-Spyware\blockpopups.htm
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O10 - Unknown file in Winsock LSP: c:\program files\f-
              secure\fsps\program\fslsp.dll
              O15 - Trusted Zone: www.mks.com.pl
              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
              Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
              O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) -
              asp01.photoprintit.de/microsite/defaults/activex/IPSUploader.cab
              O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) -
              skaner.mks.com.pl/SkanerOnline.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{08E20642-2D70-4D39-A678-9308A553BBB7}:
              NameServer = 10.0.10.2
              O17 - HKLM\System\CS1\Services\Tcpip\..\{08E20642-2D70-4D39-A678-9308A553BBB7}:
              NameServer = 10.0.10.2
              O17 - HKLM\System\CS2\Services\Tcpip\..\{08E20642-2D70-4D39-A678-9308A553BBB7}:
              NameServer = 10.0.10.2
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner -
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil
              Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil
              Software\Avast4\ashMaiSv.exe" /service (file missing)
              O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil
              Software\Avast4\ashWebSv.exe" /service (file missing)
              O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure
              Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
              O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) -
              Compaq Computer Corporation - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
              O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. -
              C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
              O23 - Service: F-Secure Network Request Broker - F-Secure Corporation -
              C:\Program Files\F-Secure\Common\FNRB32.EXE
              O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-
              Secure\BackWeb\7681197\program\fsbwsys.exe
              O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure
              Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
              O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-
              Secure\Common\FSMA32.EXE
              O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32
              \NMSSvc.exe
              O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
              C:\WINDOWS\System32\nvsvc32.exe
              • qwerty32 PS.. 14.03.06, 16:53
                nie wiem niestety jak sprawdza się ilość miejsca na partycji systemowej..
                • barracuda7110 Re: PS.. 14.03.06, 19:24
                  Mój komputer-> prawoklik na dysku c i wybierz właściwości.

                  ps masz 2 antywirusy. Zrezygnuj z jednego.
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.