Problem z kompem! pilne

Witam
Mam problem z kompem od pewnego czasu, tzn
miałem jakis juz czas temu wirusa co infekował pliki z rozszerzeniem.exe - ale jakoś rozwiązałem ten problem
A ostatnio znowu sie zaczeło wirusy i wolny komp oraz zamoczyne wyłanczanie sie. Zdenerwowałem sie i przeinstalowałem kompa, ale chodzi strasznie wolno jak nieraz chce cos włączyc to musze troche poczekać, albo wogóle sie nie da np. chce włączyc skanowanie antywirusem ( AVIRA premium) i mi nie chce włączyć. Ogólnie po pewnym czasie wyskakuje błąd z RAID SERVICE US. ENGLISH RESOURCES i żego zamyka albo wyskakuje błąd ze za 1 min wyłączy mi kompa.
Przesyłam loga z Combofixa a poniżej z HijackThis


ComboFix 08-06-03.4 - Administrator 2008-06-04 19:58:03.1 - NTFSx86

Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED excl.gif
.

((((((((((((((((((((((((( Files Created from 2008-05-04 to 2008-06-04 )))))))))))))))))))))))))))))))
.

2008-06-04 19:40 . 2008-06-04 19:40 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-04 19:39 . 2008-06-04 19:39 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-06-04 18:32 . 2008-06-04 18:32 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-06-04 18:29 . 2008-06-04 18:29 74,752 -ra------ C:\WINDOWS\system32\winscrvs.exe
2008-06-04 10:24 . 2008-06-04 10:24 0 -ra------ C:\WINDOWS\system32\TFTP3852
2008-06-04 10:01 . 2008-06-04 08:15 261 --a------ C:\WINDOWS\system32\$winnt$.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-04 17:56 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\DNA
2008-06-04 11:51 --------- d-----w C:\Program Files\FlashGet
2008-06-04 11:37 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\BitTorrent
2008-06-04 08:13 --------- d-----w C:\Program Files\BitTorrent
2008-06-04 07:24 --------- d-----w C:\Program Files\epson
2008-06-04 07:03 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Tlen.pl
2008-06-04 07:01 71,464 ----a-w C:\WINDOWS\system32\drivers\avfwim.sys
2008-06-04 07:01 66,176 ----a-w C:\WINDOWS\system32\drivers\avfwot.sys
2008-06-04 06:44 --------- d-----w C:\Program Files\Avira
2008-06-04 06:44 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Avira
2008-06-04 06:43 --------- d-----w C:\Program Files\Tlen.pl
2008-06-04 06:43 --------- d-----w C:\Program Files\NimoCodec Pack
2008-06-04 06:43 --------- d-----w C:\Program Files\DivX
2008-06-04 06:42 --------- d-----w C:\Program Files\Lavasoft
2008-06-04 06:42 --------- d-----w C:\Program Files\DNA
2008-06-04 06:42 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Lavasoft
2008-06-04 06:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-04 06:38 --------- d-----w C:\Program Files\WLAN
2008-06-04 06:34 --------- d-----w C:\Program Files\Realtek Sound Manager
2008-06-04 06:34 --------- d-----w C:\Program Files\Gigabyte
2008-06-04 06:34 --------- d-----w C:\Program Files\AvRack
2008-06-04 06:31 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-04 06:29 --------- d-----w C:\Program Files\ATI Technologies
2008-06-04 06:24 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-04 06:23 --------- d-----w C:\Program Files\Microsoft Works
2008-06-04 06:13 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-04 06:12 --------- d-----w C:\Program Files\Usługi online
.

------- Sigcheck -------

2001-10-26 19:30 12800 b3c95bfeef6781a82a1c429f466a3a11 C:\WINDOWS\system32\svchost.exe
2001-10-26 19:30 12800 b3c95bfeef6781a82a1c429f466a3a11 C:\WINDOWS\system32\dllcache\svchost.exe

2001-10-26 19:29 562688 c30a1860fb4608a73023bb417acc93ba C:\WINDOWS\system32\user32.dll
2001-10-26 19:29 562688 c30a1860fb4608a73023bb417acc93ba C:\WINDOWS\system32\dllcache\user32.dll

2001-10-26 19:29 75264 9b7d1c56cc12d806314b853bf52ecb4c C:\WINDOWS\system32\ws2_32.dll
2001-10-26 19:29 75264 9b7d1c56cc12d806314b853bf52ecb4c C:\WINDOWS\system32\dllcache\ws2_32.dll

2001-10-26 19:29 596480 f83cf52c53f37189ae42f57995613a8d C:\WINDOWS\system32\wininet.dll
2001-10-26 19:29 596480 f83cf52c53f37189ae42f57995613a8d C:\WINDOWS\system32\dllcache\wininet.dll

2001-08-18 08:24 327168 e7774698bb0d14b0710a9a31e209f9b6 C:\WINDOWS\system32\dllcache\tcpip.sys
2001-08-18 08:24 327168 e7774698bb0d14b0710a9a31e209f9b6 C:\WINDOWS\system32\drivers\tcpip.sys

2001-10-26 19:30 432640 306530c12f412868e2e85431250e68a1 C:\WINDOWS\system32\winlogon.exe
2001-10-26 19:30 432640 306530c12f412868e2e85431250e68a1 C:\WINDOWS\system32\dllcache\winlogon.exe

2001-08-18 08:24 161536 3efd4f59ba0a340de0a3ab984001dbf7 C:\WINDOWS\system32\dllcache\ndis.sys
2001-08-18 08:24 161536 3efd4f59ba0a340de0a3ab984001dbf7 C:\WINDOWS\system32\drivers\ndis.sys


2001-10-26 20:03 1898112 0bf3b27c8df71e13d1759a7c820c21fc C:\WINDOWS\system32\ntkrnlpa.exe

2001-10-26 18:51 1983616 7be0777d592cbb55712cead4598da88e C:\WINDOWS\system32\ntoskrnl.exe

2001-10-26 19:29 1002496 0b6cb4abb3166e1717bda7895f2029d8 C:\WINDOWS\explorer.exe
2001-10-26 19:29 1002496 0b6cb4abb3166e1717bda7895f2029d8 C:\WINDOWS\system32\dllcache\explorer.exe

2001-10-26 19:30 101888 bf4cbefdce42a699389791647cb95ca2 C:\WINDOWS\system32\services.exe
2001-10-26 19:30 101888 bf4cbefdce42a699389791647cb95ca2 C:\WINDOWS\system32\dllcache\services.exe

2001-10-26 19:29 11776 5cc79cfe660dd720739fb9adb03f2275 C:\WINDOWS\system32\lsass.exe
2001-10-26 19:29 11776 5cc79cfe660dd720739fb9adb03f2275 C:\WINDOWS\system32\dllcache\lsass.exe

2001-10-26 19:29 13312 106e93e7eead4f0797fc1a30bd53fa3d C:\WINDOWS\system32\ctfmon.exe
2001-10-26 19:29 13312 106e93e7eead4f0797fc1a30bd53fa3d C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29 13312]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14 1077277]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-04 08:42 289088]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2008-01-15 17:09 6290944]
"Windows Time Service Diagnostic Tool"="C:\WINDOWS\System32\wbem\winscrvs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 12:00 335872]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 11:01 68096 C:\WINDOWS\SOUNDMAN.EXE]
"NVRaidService"="C:\WINDOWS\System32\nvraidservice.exe" [2004-06-11 05:15 83968]
"avgnt"="C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" [2008-06-04 09:01 262401]
"EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304]
"Windows Time Service Diagnostic Tool"="C:\WINDOWS\System32\wbem\winscrvs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Windows Time Service Diagnostic Tool"="C:\WINDOWS\System32\wbem\winscrvs.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-10-26 19:29 13312]
"Windows Time Service Diagnostic Tool"="C:\WINDOWS\System32\wbem\winscrvs.exe" [ ]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
WConfig.lnk - C:\Program Files\WLAN\WConfig\WConfig.exe [2008-06-04 08:38:25 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= DivXa32.acm
"msacm.l3codec"= L3codecp.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=


*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-04 19:58:38
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-06-04 19:59:20
ComboFix-quarantined-files.txt 2008-06-04 17:59:12

Pre-Run: 12,127,502,336 bajtów wolnych
Post-Run: 12,179,353,600 bajtów wolnych

120



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:00:06, on 2008-06-04
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\nvraidservice.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\WLAN\WConfig\WConfig.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\WINDOWS\System32\dwwin.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\System32\nvraidservice.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [Windows Time Service Diagnostic Tool] C:\WINDOWS\System32\wbem\winscrvs.exe
O4 - HKLM\..\RunServices: [Windows Time Service Diagnostic Tool] C:\WINDOWS\System32\wbem\winscrvs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Windows Time Service Diagnostic Tool] C:\WINDOWS\System32\wbem\winscrvs.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WConfig.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virussca...can_unicode.cab
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Avira Premium Security Suite MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe

--
End of file - 5797 bytes



Bardzo proszę o pomoc
Z góry dzięki

prawdopodobie trafiles virusa CIH'a lub jego odmiane. To werdny wirus ale juz w sumie stary i jedyna metoda do zainfekowania nim koputera jest : brak antyvirusa lub poczta niewiadomego pochodzenia. Aby sie go pozbyc ( ja tak robilem w dawych czasach) usuwalem partycje ( utrata wszelkich danych) i dodatkowo wyciagalem baterie, ktora podtrzymywala BIOS, oraz zostawialem komputer na 1h bez napiecia-dlaczego? Ten wirek jak i kilka jego pochodnych potrafily alokowac sie we wszystkim co mialo jakakolwiek pamiec czyli: HDD, pamiec RAM, BIOS- slyszalem o tym ze sie zapakowal do pamieci podrecznej L2 procesora ale mysle,ze ktos mial bujna wyobraznie.Najdziwniejsze jest to,zeantivirus nic nie alarmowal a powinien.