zwieszka podczas pogłaszania

**Posty:** 14 · przez **SKrystek** 25 Lip 2008, 17:52

Już od 1,5 roku jestem posiadaczem laptopa HP Pavilion dv9000. Dzisiaj niespodziewanie zaczęły się kłopoty. Za każdym razem gdy majstruje nad głośnością system się zwiesza. Tzn. kursor działa, ale cała reszta, pulpit, ikony, menu start, okna programów pozostają nieaktywne.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:31:30, on 2008-07-25 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe c:\Program Files\Common Files\Symantec Shared\ccProxy.exe c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\SYSTEM32\odbcasvc.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\YDP\UserAccessManager\useraccess.exe C:\WINDOWS\system32\mqsvc.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\mqtgsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Opera\Opera.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Octoshape Streaming Services\Seba\OctoshapeClient.exe C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\WinExit\WinExit.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Opera\Opera.exe C:\Documents and Settings\Seba\My Documents\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=pavilion&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=: R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = : R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: CNavExtBho Class - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\PL\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=113007 serial=dr12wes-3007622-euw lang=PL O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [svchosts] C:\WINDOWS\system32:svchosts.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Seba\OctoshapeClient.exe" -inv:bootrun O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe O4 - Startup: WinExit.lnk = C:\Program Files\WinExit\WinExit2Tray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AVerQuick.lnk = C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1175948703828 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - C:\Program Files\Common Files\YDP\UserAccessManager\useraccess .exe

**Posty:** 8001 · przez **Okocza** 25 Lip 2008, 17:59

Kod: Zaznacz wszystko: R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe

to na fix w hj daj log z combofixa

**Posty:** 14 · przez **SKrystek** 25 Lip 2008, 19:11

Kod: Zaznacz wszystko: ComboFix 08-07-24.6 - Seba 2008-07-25 18:08:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.361 [GMT 2:00] Running from: C:\Documents and Settings\Seba\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . [i] ADS - system32: deleted 66923 bytes in 2 streams. [/i] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\8ti.exe C:\autorun.inf C:\DOCUME~1\Seba\LOCALS~1\Temp\ovlx.dll C:\DOCUME~1\Seba\LOCALS~1\Temp\zb5ok.dll C:\Documents and Settings\Seba\svchost.exe C:\ffojc.com C:\hgu.bat C:\qxbx9blb.com C:\WINDOWS\system32\amvo0.dll C:\WINDOWS\system32\amvo1.dll C:\WINDOWS\system32\ckvo.exe C:\WINDOWS\system32\ckvo0.dll C:\WINDOWS\system32\odbcasvc.exe D:\Autorun.inf D:\hgu.bat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ODBCASVC -------\Service_odbcasvc ((((((((((((((((((((((((( Files Created from 2008-06-25 to 2008-07-25 ))))))))))))))))))))))))))))))) . 2008-07-25 14:50 . 2008-07-25 14:50 <DIR> d-------- C:\Documents and Settings\Seba\Application Data\ArcSoft 2008-07-25 14:49 . 2006-11-10 15:05 18,688 --a------ C:\WINDOWS\system32\drivers\afc.sys 2008-07-25 14:47 . 2008-07-25 14:47 <DIR> d-------- C:\Program Files\ArcSoft 2008-07-25 14:47 . 1995-08-01 04:44 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL 2008-07-23 18:06 . 2008-07-25 10:41 87,297 -r-hs---- C:\g2pfnid.com 2008-07-21 18:04 . 2008-07-22 12:43 116,906 -r-hs---- C:\e9ehn1m8.com 2008-07-19 12:40 . 2008-07-20 21:07 117,009 -r-hs---- C:\ybj8df.exe 2008-07-17 10:58 . 2008-07-18 12:46 117,757 -r-hs---- C:\ivcvknr.bat 2008-07-16 11:44 . 2008-07-16 11:43 116,492 -r-hs---- C:\33gmhso.bat 2008-07-14 12:19 . 2008-07-12 12:06 116,498 -r-hs---- C:\fi.cmd 2008-07-11 11:24 . 2008-07-11 11:53 117,053 -r-hs---- C:\[u]0[/u]gjn3yw.exe 2008-07-10 11:09 . 2008-07-10 11:38 116,414 -r-hs---- C:\mp.cmd 2008-07-08 21:16 . 2008-07-25 10:41 77,312 -r-hs---- C:\WINDOWS\system32\ckvo1.dll 2008-07-04 23:59 . 2008-07-08 20:45 118,269 -r-hs---- C:\[u]0[/u]0hoeav.com 2008-07-03 11:44 . 2008-07-03 11:44 112,585 -r-hs---- C:\xmnm2.cmd 2008-06-26 13:44 . 2008-06-26 13:44 112,070 -r-hs---- C:\r.cmd . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-25 16:17 --------- d-----w C:\Documents and Settings\Seba\Application Data\Skype 2008-07-25 12:47 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-24 20:27 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-20 22:44 --------- d-----w C:\Program Files\eMule 2008-07-20 21:35 --------- d-----w C:\Program Files\Opera 2008-06-21 09:03 110,179 --sh--r C:\udr.com 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-18 13:20 --------- d-----w C:\Program Files\Last.fm 2008-06-18 05:23 116,229 --sh--r C:\6x8be16.cmd 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-09 07:49 107,149 --sh--r C:\olb1iimw.bat 2008-06-09 07:49 107,149 --sh--r C:\e.cmd 2008-06-07 22:13 --------- d-----w C:\Program Files\Ganymede 2008-06-02 13:57 --------- d-----w C:\Program Files\RealArcade 2008-05-25 15:25 107,792 --sh--r C:\qa8sywva.cmd 2008-05-21 19:42 108,118 --sh--r C:\tfk8.exe 2008-04-25 19:16 104,161 --sh--r C:\1dg.exe 2008-04-25 19:16 104,161 --sh--r C:\[u]0[/u]n.bat 2007-09-06 11:45 251 -c--a-w C:\Program Files\wt3d.ini 2007-04-08 12:33 560 ----a-w C:\Documents and Settings\Seba\Application Data\wklnhst.dat 2007-02-26 21:39 22 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 11:12 1849032] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-01-29 16:36 25370152] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-16 06:00 15360] "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Seba\OctoshapeClient.exe" [2006-02-13 18:33 214648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 06:56 64512] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 07:58 458752] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 06:03 36975] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-18 10:00 7585792] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-18 10:00 86016] "ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-08 18:33 53096] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 07:01 761946] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-12 06:55 102400] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 08:11 49152] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-12 01:30 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-12 01:30 81920] "Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-31 01:02 40960] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 19:23 1187840] "SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-06-06 12:15 861184] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 10:55 188416] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57 282624] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 19:14 35328] "nwiz"="nwiz.exe" [2006-08-18 10:00 1617920 C:\WINDOWS\system32\nwiz.exe] "MsmqIntCert"="mqrt.dll" [2007-07-06 14:46 177152 C:\WINDOWS\system32\mqrt.dll] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 02:02 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-16 06:00 15360] C:\Documents and Settings\Seba\Start Menu\Programs\Startup\ WinExit.lnk - C:\Program Files\WinExit\WinExit2Tray.exe [2007-12-02 02:55:16 9216] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] AVerQuick.lnk - C:\Program Files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2007-11-05 15:24:18 618496] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-09-28 19:54:58 962661] HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 18:39:30 73728] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 19:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codecp"= l3codecp.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\mqsvc.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Last.fm\\LastFM.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\Program Files\\Snikers\\Snikers.exe"= "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\Octoshape Streaming Services\\Seba\\OctoshapeClient.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 17:11] S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;C:\WINDOWS\system32\Drivers\5U870CAP.sys [2006-06-06 22:39] S3 aver7700;AVerMedia aver7700 DVB-T;C:\WINDOWS\system32\Drivers\aver7700.sys [2006-10-24 10:50] S3 GameConsoleService;GameConsoleService;C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe [2008-01-29 19:09] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{384044d9-120d-11dd-8b0e-0016367b82d2}] \Shell\AutoRun\command - H:\t9peum02.exe \Shell\explore\Command - H:\t9peum02.exe \Shell\open\Command - H:\t9peum02.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46d4bb8e-682c-11dc-89dd-0090d0a5a08f}] \Shell\AutoRun\command - H:\ser.com \Shell\explore\Command - H:\ser.com \Shell\open\Command - H:\ser.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76bd6f00-f5b7-11dc-8adf-0016367b82d2}] \e\Command - H:\xp19.com \Shell\AutoRun\command - qa8sywva.cmd \Shell\explore\Command - qa8sywva.cmd \Shell\open\Command - qa8sywva.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e04cbb7f-c1c4-11db-8898-0090d0a5a08f}] \Shell\AutoRun\command - F:\install.exe *Newly Created Service* - COMHOST *Newly Created Service* - ERASERUTILREBOOTDRV [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{472C4BB1-2875-2C69-64C3-288F3C4957E4}] C:\WINDOWS\system32:svchosts.exe . Contents of the 'Scheduled Tasks' folder "2007-02-04 19:24:20 C:\WINDOWS\Tasks\Low Battery Alarm Program.job" "2006-12-13 20:15:26 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - owner.job" - c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK: "2008-07-18 18:42:06 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Seba.job" - c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK: "2006-12-13 20:13:44 C:\WINDOWS\Tasks\Norton AntiVirus - Run Norton QuickScan - owner.job" - c:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.EXEg/TASK: . - - - - ORPHANS REMOVED - - - - HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe HKCU-Run-Uniblue RegistryBooster 2 - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe HKLM-Run-CorelDRAW Graphics Suite 11b - C:\Program Files\Corel\Corel Graphics 12\Languages\PL\Programs\Registration.exe HKLM-Run-svchosts - C:\WINDOWS\system32:svchosts.exe . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = about:blank R1 -: HKCU-Internet Settings,ProxyServer = http=: O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-25 18:16:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????<?@? ????Z??????Y?@?????<?@ scanning hidden files ... ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\msdtc.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\YDP\UserAccessManager\useraccess.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\WINDOWS\system32\mqsvc.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\mqtgsvc.exe C:\WINDOWS\ehome\ehmsas.exe C:\Program Files\WinExit\WinExit.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe . ************************************************************************** . Completion time: 2008-07-25 18:25:27 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-25 16:24:21 Pre-Run: 3,116,310,528 bytes free Post-Run: 4,077,744,128 bytes free 233 --- E O F --- 2008-07-11 09:31:14

**Posty:** 7956 · przez **Magik** 25 Lip 2008, 19:13

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{384044d9-120d-11dd-8b0e-0016367b82d2}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46d4bb8e-682c-11dc-89dd-0090d0a5a08f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76bd6f00-f5b7-11dc-8adf-0016367b82d2}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e04cbb7f-c1c4-11db-8898-0090d0a5a08f}]

zapisz jako fix.reg i odpal

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\g2pfnid.com C:\e9ehn1m8.com C:\ybj8df.exe C:\ivcvknr.bat C:\33gmhso.bat C:\fi.cmd C:\[u]0[/u]gjn3yw.exe C:\mp.cmd C:\WINDOWS\system32\ckvo1.dll C:\[u]0[/u]0hoeav.com C:\xmnm2.cmd C:\r.cmd

zapisz jako CFScript.txt, przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

zwieszka podczas pogłaszania

Zwieszka podczas pogłaszania

Kto jest na forum