System się zawiesza, często potrzebny jest reset

[xmx]

Witam, to mój pierwszy post na forum. Mam olbrzymie problemy ze swoim laptopem. Ciągle się zawiesza, często nie mogę nic uruchomic z paska narzędzi, dodatkowo podczas próby skanowania gmerem wyskakuje jakiś błąd i laptop się zawiesza, konieczny jest wtedy reset poprzez wyciągnięcie baterii i odłączenie od prądu dlatego przedstawiam tylko logi z otl.
Wklej org nie działa, dlatego pozwoliłam sobie wrzucic na wklej.to
log otl:
http://wklej.to/892jd
otl extras:
http://wklej.to/2LHRo

[wojtas]

po pierwsze 2 antywirusy : avast i McAfee. koniecznie odinstaluj jeden ( avast mniej obciąża kompa )

widać wpisy w kluczu MountPoints2 : podejrzewam infekcje z pendriva

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
IE - HKLM\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3099577691-4056225575-788103364-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15854&l=dis
IE - HKU\S-1-5-21-3099577691-4056225575-788103364-1000\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic-Polska Toolbar) - {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3099577691-4056225575-788103364-1000\..\Toolbar\WebBrowser: (Softonic-Polska Toolbar) - {C86EB8A9-CCC2-4B6C-B75D-73576ED591BF} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: [LogMeIn GUI] File not found
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKU\S-1-5-21-3099577691-4056225575-788103364-1000..\Run: [] File not found
O4 - HKU\S-1-5-21-3099577691-4056225575-788103364-1000..\Run: [ALLUpdate] File not found
O4 - HKU\S-1-5-21-3099577691-4056225575-788103364-1000..\Run: [cdoosoft] File not found
O4 - HKU\S-1-5-21-3099577691-4056225575-788103364-1000..\Run: [FootNotes] File not found
O9 - Extra Button: eBay - {76577871-04EC-495E-A12B-91F7C3600AFA} - File not found
O9 - Extra Button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - File not found
O33 - MountPoints2\{13e0c104-e3dc-11de-9a77-00037a8e29c0}\Shell\AutoRun\command - "" = G:\xmor.exe
O33 - MountPoints2\{13e0c104-e3dc-11de-9a77-00037a8e29c0}\Shell\open\Command - "" = G:\xmor.exe
O33 - MountPoints2\{21928a53-109f-11df-bc4c-00037a8e29c0}\Shell\AutoRun\command - "" = r3q63rok.exe
O33 - MountPoints2\{21928a53-109f-11df-bc4c-00037a8e29c0}\Shell\open\Command - "" = r3q63rok.exe
O33 - MountPoints2\{33cb1c7c-f2d8-11de-bb0d-00037a8e29c0}\Shell\AutoRun\command - "" = 3exi.exe
O33 - MountPoints2\{33cb1c7c-f2d8-11de-bb0d-00037a8e29c0}\Shell\open\Command - "" = 3exi.exe
O33 - MountPoints2\{3b150a24-9fa3-11df-8931-00037a8e29c0}\Shell\Auto\command - "" = activexdebugger32.exe f
O33 - MountPoints2\{3b150a24-9fa3-11df-8931-00037a8e29c0}\Shell\explore\Command - "" = activexdebugger32.exe f
O33 - MountPoints2\{3b150a24-9fa3-11df-8931-00037a8e29c0}\Shell\open\Command - "" = activexdebugger32.exe f
O33 - MountPoints2\{4c0e0ab1-3663-11de-a384-00037a8e29c0}\Shell\AutoRun\command - "" = 2.bat
O33 - MountPoints2\{4c0e0ab1-3663-11de-a384-00037a8e29c0}\Shell\open\Command - "" = 2.bat
O33 - MountPoints2\{72ca14ab-d8cb-11de-941b-00037a8e29c0}\Shell\AutoRun\command - "" = G:\ngp8l.exe
O33 - MountPoints2\{72ca14ab-d8cb-11de-941b-00037a8e29c0}\Shell\open\Command - "" = G:\ngp8l.exe
O33 - MountPoints2\{913504bc-47b6-11de-8ee5-00037a8e29c0}\Shell - "" = AutoRun
O33 - MountPoints2\{913504bc-47b6-11de-8ee5-00037a8e29c0}\Shell\AutoRun\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{913504bc-47b6-11de-8ee5-00037a8e29c0}\Shell\configure\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{913504bc-47b6-11de-8ee5-00037a8e29c0}\Shell\install\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{b12fd0f6-ac18-11dd-863b-001e3352ad48}\Shell - "" = AutoRun
O33 - MountPoints2\{b12fd0f6-ac18-11dd-863b-001e3352ad48}\Shell\AutoRun\command - "" = D:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{b12fd0f6-ac18-11dd-863b-001e3352ad48}\Shell\dinstall\command - "" = D:\Directx\dxsetup.exe
O33 - MountPoints2\{b40ca919-8657-11dd-bb39-001f3c8162bc}\Shell\AutoRun\command - "" = awb3ryk.exe
O33 - MountPoints2\{b40ca919-8657-11dd-bb39-001f3c8162bc}\Shell\open\Command - "" = awb3ryk.exe
O33 - MountPoints2\{e19ac530-7ea5-11df-880b-00037a8e29c0}\Shell\AutoRun\command - "" = rwj0.cmd
O33 - MountPoints2\{e19ac530-7ea5-11df-880b-00037a8e29c0}\Shell\open\Command - "" = rwj0.cmd
O33 - MountPoints2\{e5b089ab-b1b8-11de-8bf6-00037a8e29c0}\Shell - "" = AutoRun
O33 - MountPoints2\{e5b089ab-b1b8-11de-8bf6-00037a8e29c0}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{e5b089d0-b1b8-11de-8bf6-00037a8e29c0}\Shell - "" = AutoRun
O33 - MountPoints2\{e5b089d0-b1b8-11de-8bf6-00037a8e29c0}\Shell\AutoRun\command - "" = H:\AutoRun.exe

:Files
C:\Users\Madzia\AppData\Local\Temp*.html
C:\Windows\Tasks\*.job

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). + Przy podpiętym urządzeniu przenośnym (pendrive, telefon - to co jest podłączane do kompa) , uruchom USBFIX z opcji Listing i pokaż raport na forum.

[xmx]

Hmm podczas skanowania otl w usb nie było nic podłączone, ale po kolei wszystkie logi:

log po wykonaniu skryptu: http://wklej.to/fq4l7
log otl.txt: http://wklej.to/AMbBd
log usb fix:

Kod: Zaznacz wszystko

############################## | UsbFix 7.038 | [Listing]

User: Madzia (Administrator) # MADZIA-PC [TOSHIBA Satellite A300]
Updated 14/01/2011 by El Desaparecido / C_XX
Started at 22:57:52 | 16/01/2011
Website: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz
CPU 2: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz
Microsoft® Windows Vista™ Home Premium  (6.0.6001 32-Bit) # Service Pack 1
Internet Explorer 7.0.6001.18000

Windows Firewall: Enabled
Antivirus: avast! antivirus 4.8.1229 [VPS 081221-0] 4.8.1229 [Enabled | Updated]
RAM -> 3069 Mb
C:\ (%systemdrive%) -> Fixed drive # 116 Gb (23 Mb free - 20%) [Vista] # NTFS
E:\ -> Fixed drive # 115 Gb (61 Mb free - 53%) [Data] # NTFS
F:\ -> CD-ROM

################## | Listing |

[19/09/2008 - 15:30:01 | SHD ]    C:\$RECYCLE.BIN
[04/12/2010 - 14:40:05 | A | 1024]    C:\.rnd
[29/12/2009 - 20:01:41 | RSH | 103936]    C:\3exi.exe
[18/09/2006 - 22:43:36 | A | 24]    C:\autoexec.bat
[23/04/2008 - 08:16:50 | SHD ]    C:\Boot
[21/01/2008 - 03:24:42 | RASH | 333203]    C:\bootmgr
[23/04/2008 - 08:16:51 | RAS | 8192]    C:\BOOTSECT.BAK
[15/01/2011 - 21:42:11 | HD ]    C:\Config.Msi
[18/09/2006 - 22:43:37 | A | 10]    C:\config.sys
[02/11/2006 - 14:02:03 | SHD ]    C:\Documents and Settings
[07/01/2011 - 20:27:29 | D ]    C:\Downloads
[16/01/2011 - 22:47:09 | ASH | 3219087360]    C:\hiberfil.sys
[28/12/2009 - 10:59:59 | RSH | 106496]    C:\imghyva6.exe
[04/01/2009 - 17:34:38 | D ]    C:\Intel
[24/05/2010 - 21:02:35 | RHD ]    C:\MSOCache
[16/01/2011 - 22:47:07 | ASH | 3532881920]    C:\pagefile.sys
[23/06/2009 - 07:36:23 | D ]    C:\PerfLogs
[14/01/2009 - 21:07:03 | A | 47261]    C:\playground.log
[16/01/2011 - 22:47:47 | D ]    C:\Program Files
[08/01/2011 - 14:19:52 | HD ]    C:\ProgramData
[25/11/2008 - 20:22:18 | D ]    C:\Pulpit
[23/04/2008 - 08:51:34 | A | 651]    C:\RHDSetup.log
[23/04/2008 - 08:58:50 | A | 86]    C:\setup.log
[22/06/2010 - 13:52:58 | AH | 268]    C:\sqmdata00.sqm
[22/06/2010 - 14:11:33 | AH | 268]    C:\sqmdata01.sqm
[22/06/2010 - 21:27:10 | AH | 268]    C:\sqmdata02.sqm
[22/06/2010 - 22:47:23 | AH | 268]    C:\sqmdata03.sqm
[23/06/2010 - 09:05:53 | AH | 268]    C:\sqmdata04.sqm
[23/06/2010 - 10:00:34 | AH | 268]    C:\sqmdata05.sqm
[23/06/2010 - 16:22:52 | AH | 268]    C:\sqmdata06.sqm
[23/06/2010 - 16:52:00 | AH | 268]    C:\sqmdata07.sqm
[23/06/2010 - 22:16:20 | AH | 268]    C:\sqmdata08.sqm
[24/06/2010 - 07:52:26 | AH | 268]    C:\sqmdata09.sqm
[25/06/2010 - 08:23:37 | AH | 268]    C:\sqmdata10.sqm
[26/06/2010 - 09:28:42 | AH | 268]    C:\sqmdata11.sqm
[27/06/2010 - 09:26:50 | AH | 268]    C:\sqmdata12.sqm
[28/06/2010 - 05:53:59 | AH | 268]    C:\sqmdata13.sqm
[29/06/2010 - 08:56:28 | AH | 268]    C:\sqmdata14.sqm
[30/06/2010 - 07:07:27 | AH | 268]    C:\sqmdata15.sqm
[01/07/2010 - 07:11:39 | AH | 268]    C:\sqmdata16.sqm
[02/07/2010 - 07:36:24 | AH | 268]    C:\sqmdata17.sqm
[02/07/2010 - 19:26:38 | AH | 268]    C:\sqmdata18.sqm
[22/06/2010 - 00:07:00 | AH | 268]    C:\sqmdata19.sqm
[22/06/2010 - 13:52:58 | AH | 244]    C:\sqmnoopt00.sqm
[22/06/2010 - 14:11:33 | AH | 244]    C:\sqmnoopt01.sqm
[22/06/2010 - 21:27:10 | AH | 244]    C:\sqmnoopt02.sqm
[22/06/2010 - 22:47:23 | AH | 244]    C:\sqmnoopt03.sqm
[23/06/2010 - 09:05:53 | AH | 244]    C:\sqmnoopt04.sqm
[23/06/2010 - 10:00:34 | AH | 244]    C:\sqmnoopt05.sqm
[23/06/2010 - 16:22:52 | AH | 244]    C:\sqmnoopt06.sqm
[23/06/2010 - 16:52:00 | AH | 244]    C:\sqmnoopt07.sqm
[23/06/2010 - 22:16:20 | AH | 244]    C:\sqmnoopt08.sqm
[24/06/2010 - 07:52:26 | AH | 244]    C:\sqmnoopt09.sqm
[25/06/2010 - 08:23:37 | AH | 244]    C:\sqmnoopt10.sqm
[26/06/2010 - 09:28:42 | AH | 244]    C:\sqmnoopt11.sqm
[27/06/2010 - 09:26:50 | AH | 244]    C:\sqmnoopt12.sqm
[28/06/2010 - 05:53:58 | AH | 244]    C:\sqmnoopt13.sqm
[29/06/2010 - 08:56:28 | AH | 244]    C:\sqmnoopt14.sqm
[30/06/2010 - 07:07:27 | AH | 244]    C:\sqmnoopt15.sqm
[01/07/2010 - 07:11:39 | AH | 244]    C:\sqmnoopt16.sqm
[02/07/2010 - 07:36:23 | AH | 244]    C:\sqmnoopt17.sqm
[02/07/2010 - 19:26:38 | AH | 244]    C:\sqmnoopt18.sqm
[22/06/2010 - 00:07:00 | AH | 244]    C:\sqmnoopt19.sqm
[13/05/2008 - 08:18:39 | AH | 176]    C:\SWSTAMP.TXT
[16/01/2011 - 12:10:33 | SHD ]    C:\System Volume Information
[19/09/2008 - 15:30:40 | D ]    C:\Toshiba
[16/01/2011 - 22:57:48 | D ]    C:\UsbFix
[16/01/2011 - 22:57:48 | A | 4339]    C:\UsbFix.txt
[19/09/2008 - 15:20:57 | RD ]    C:\Users
[16/01/2011 - 22:50:09 | D ]    C:\Windows
[29/12/2009 - 10:14:18 | RSH | 98816]    C:\wisf1.exe
[16/01/2011 - 22:26:39 | D ]    C:\_OTL
[19/09/2008 - 15:30:02 | SHD ]    E:\$RECYCLE.BIN
[07/07/2010 - 22:23:56 | D ]    E:\18Paczki
[29/12/2009 - 20:01:41 | RSH | 103936]    E:\3exi.exe
[04/06/2010 - 19:15:32 | D ]    E:\Albumy
[31/12/2009 - 11:29:50 | RSH | 106496]    E:\anoataly.exe
[26/09/2010 - 16:47:17 | D ]    E:\dokjuments
[23/09/2010 - 09:18:04 | D ]    E:\filmy
[20/09/2008 - 01:07:24 | D ]    E:\HDDRecovery
[28/12/2009 - 10:59:59 | RSH | 106496]    E:\imghyva6.exe
[27/09/2010 - 16:42:25 | D ]    E:\muzyka
[12/08/2010 - 20:11:55 | D ]    E:\od andrzeja
[04/12/2010 - 13:47:55 | D ]    E:\Program Files
[23/09/2010 - 09:06:05 | D ]    E:\seriale
[27/09/2010 - 16:43:03 | D ]    E:\sety
[19/09/2008 - 15:09:59 | SHD ]    E:\System Volume Information
[08/07/2010 - 20:13:45 | D ]    E:\Wesele Agnieszki i Grzeska
[18/11/2010 - 21:30:14 | D ]    E:\xyz
[13/02/2009 - 12:01:58 | D ]    E:\z pulpity
[30/05/2010 - 21:13:20 | D ]    E:\ślub

################## | E.O.F |

[wojtas]

podłącz te urządzenia przenośne co masz
Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

rocesses
killallprocesses

:Files
3exi.exe /alldrives
imghyva6.exe /alldrives
wisf1.exe /alldrives
$RECYCLE.BIN /alldrives
imghyva6.exe /alldrives
anoataly.exe /alldrives
C:\*.sqm

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).

[xmx]

Podłączyłam wszystko oprócz pendriva, którego obecnie chwilowo nie mam
log po wykonaniu skryptu: http://wklej.to/6xa88
log otl.txt: http://wklej.to/8S1ow

[wojtas]

gdy go podłączysz zapewne infekcja wróci...

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
O2 - BHO: (no name) - {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - No CLSID value found.
O3 - HKU\S-1-5-21-3099577691-4056225575-788103364-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

:Files
C:\Users\Madzia\AppData\Local\Temp*.html

Kliknij wykonaj skrypt

1.Uruchom OTL z opcji sprzątanie.
2. wykonaj optymalizację Windowsa ( jest to instrukcja pod XP ale są podobne niektóre rzeczy )
3. zrób pełny skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )
4. Skasuj stan przywracania systemu


Zaktualizuj zabezpieczenia:
>>> Adobe Reader (bez Free McAfee® Security Scan Plus)
>>> Internet Explorer 8
>>> Service Pack 2