Dwwin.dll ; dwwin.exe

**Posty:** 22 · przez **pypsior** 20 Paź 2008, 19:51

Witam od jakiegos czasu podczas samykania miga mi natepujący błąd dwwin.dll lub dwwin.exe
Mógłby ktoś rzucić okiem??
log z hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:01:30, on 2008-10-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Programy\Avast4\aswUpdSv.exe C:\Programy\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\IPSSVC.EXE C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\WINDOWS\System32\TPHDEXLG.exe C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe C:\Programy\Avast4\ashMaiSv.exe C:\Programy\Avast4\ashWebSv.exe C:\Program Files\Common Files\Lenovo\Logger\logmon.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe C:\WINDOWS\system32\wscript.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programy\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Programy\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ntvdm.exe C:\Programy\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com.pl/0SEPLPL/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\AVG.vbs O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programy\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe /r O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = C:\Programy\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\Programy\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.line6.net O17 - HKLM\System\CCS\Services\Tcpip\..\{84A2EEA1-63BD-4D72-AFEE-5561B7B8BABD}: NameServer = 194.204.159.1,194.204.152.35 O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programy\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programy\MICROS~1\Office12\GR99D3~1.DLL O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing) O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programy\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Programy\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programy\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programy\Avast4\ashWebSv.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe -- End of file - 10537 bytes

**Posty:** 7956 · przez **Magik** 20 Paź 2008, 19:54

do tego log z combofixa

Kod: Zaznacz wszystko: O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)

czysta kosmetyka

**Posty:** 22 · przez **pypsior** 20 Paź 2008, 20:14

Kod: Zaznacz wszystko: ComboFix 08-10-19.04 - Piotrek 2008-10-20 20:03:12.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2273 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Piotrek\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-20 do 2008-10-20 ))))))))))))))))))))))))))))))) . 2008-10-16 09:13 . 2007-02-27 21:26 609,280 --a------ C:\WINDOWS\system32\drivers\L6TPortGX.sys 2008-10-16 09:13 . 2007-02-27 21:23 118,784 --a------ C:\WINDOWS\system32\L6tpgx.dll 2008-10-13 15:12 . 2008-10-13 15:12 <DIR> d-------- C:\Program Files\Common Files\Digidesign 2008-10-13 15:12 . 2008-10-16 09:14 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Line 6 2008-10-13 15:12 . 2008-10-13 15:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Line 6 2008-10-09 17:10 . 2008-10-09 17:10 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\Media Player Classic 2008-10-05 16:19 . 2008-10-05 16:19 17,408 --a------ C:\WINDOWS\system32\drivers\aksusb.sys 2008-10-05 16:19 . 2008-09-10 22:42 2,636 --a------ C:\WINDOWS\system32\config.hsp 2008-10-05 16:19 . 2008-10-05 16:19 135 --a------ C:\WINDOWS\splendor.ini 2008-10-05 16:18 . 1996-12-18 09:11 284,160 --a------ C:\WINDOWS\unin0415.exe 2008-10-05 14:50 . 2008-10-05 14:50 <DIR> d-------- C:\Program Files\Common Files\Zinio 2008-10-05 14:50 . 2008-10-05 14:50 <DIR> d-------- C:\Documents and Settings\Piotrek\Dane aplikacji\ContentGuard . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-20 18:03 270,936 --sha-r C:\WINDOWS\system32\AVG.vbs 2008-10-09 12:27 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\PC Suite 2008-09-21 11:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-21 11:29 --------- d-----w C:\Program Files\Windows Live Toolbar 2008-09-14 11:08 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Sonic 2008-09-13 13:53 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Logitech 2008-09-13 13:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Logitech 2008-09-13 13:52 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe 2008-09-13 13:52 --------- d-----w C:\Program Files\Common Files\Logishrd 2008-09-13 13:51 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-09-13 13:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LogiShrd 2008-09-12 20:23 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Intel 2008-09-12 20:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lenovo 2008-09-11 18:24 --------- d-----w C:\Program Files\Trend Micro 2008-09-10 20:12 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\BSplayer 2008-09-10 20:05 --------- d-----w C:\Program Files\Java 2008-09-10 16:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-09-10 13:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-10 11:56 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-09-10 11:48 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\OpenOffice.org2 2008-09-10 11:31 --------- d-----w C:\Program Files\Nokia 2008-09-09 17:23 --------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-09-08 07:42 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\HP 2008-09-08 07:31 --------- d-----w C:\Program Files\HP 2008-09-08 07:31 --------- d-----w C:\Program Files\Common Files\HP 2008-09-08 07:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-09-08 07:27 --------- d-----w C:\Program Files\Hewlett-Packard 2008-09-08 07:26 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2008-09-06 11:21 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Nowe Gadu-Gadu 2008-09-05 18:35 --------- d-----w C:\Program Files\PCDR5 2008-09-05 17:12 --------- d-----w C:\Program Files\Common Files\Autodesk Shared 2008-09-05 17:12 --------- d-----w C:\Program Files\AnswerWorks 4.0 2008-09-05 17:11 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Autodesk 2008-09-05 17:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Autodesk 2008-09-05 17:09 --------- d-----w C:\Program Files\Autodesk 2008-09-05 15:09 --------- d-----w C:\Program Files\MSXML 4.0 2008-09-04 19:44 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-09-04 19:44 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-09-04 19:44 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Nokia 2008-09-04 18:00 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-09-04 18:00 --------- d-----w C:\Program Files\Common Files\Nokia 2008-09-04 18:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-09-04 17:59 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-09-04 17:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-09-04 17:42 --------- d-----w C:\Program Files\MSXML 6.0 2008-09-04 16:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-09-04 07:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-04 06:41 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Leadertech 2008-09-04 06:19 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Gadu-Gadu 2008-09-04 05:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-09-04 05:38 --------- d-----w C:\Program Files\DIFX 2008-09-04 05:33 --------- d-----w C:\Program Files\MSBuild 2008-09-04 05:33 --------- d-----w C:\Program Files\Microsoft Works 2008-09-04 05:31 --------- d-----w C:\Program Files\Microsoft.NET 2008-09-04 05:28 --------- d-----w C:\Program Files\Microsoft Visual Studio 8 2008-09-03 21:02 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Winamp 2008-09-03 19:29 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Talkback 2008-09-03 18:53 50 ----a-w C:\WINDOWS\system32\drivers\LENOVO_7664_1KU.MRK 2008-09-03 18:53 --------- d-----w C:\Program Files\ThinkVantage Fingerprint Software 2008-09-03 18:47 --------- d-----w C:\Program Files\microsoft frontpage 2008-09-03 18:39 --------- d-----w C:\Program Files\Common Files\ThinkVantage Fingerprint Software 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\Lenovo 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\UIB 2008-09-03 18:39 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Lenovo 2008-09-03 18:34 33,536 ----a-w C:\WINDOWS\system32\drivers\tvtfilter.sys 2008-09-03 18:34 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-09-03 18:34 115,960 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-09-03 18:34 --------- d-----w C:\Program Files\Lenovo 2008-09-03 18:34 --------- d-----w C:\Program Files\Common Files\Lenovo 2008-09-03 18:33 7,012 ----a-w C:\WINDOWS\system32\drivers\pmemnt.sys 2008-09-03 18:33 --------- d-----w C:\Program Files\ThinkPad 2008-09-03 18:33 --------- d-----w C:\Program Files\Google 2008-09-03 18:32 --------- d-----w C:\Program Files\Diskeeper Corporation 2008-09-03 18:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC-Doctor 2008-09-03 18:28 --------- d-----w C:\Program Files\ThinkVantage 2008-09-03 18:28 --------- d-----w C:\Program Files\Lenovo Registration 2008-09-03 18:27 --------- d-----w C:\Program Files\Common Files\Installshield 2008-09-03 18:26 --------- d-----w C:\Program Files\Sonic Icons for Lenovo 2008-09-03 18:26 --------- d-----w C:\Program Files\Sonic 2008-09-03 18:26 --------- d-----w C:\Program Files\Multimedia Center for Think Offerings 2008-09-03 18:26 --------- d-----w C:\Program Files\Common Files\SureThing Shared 2008-09-03 18:26 --------- d-----w C:\Program Files\Common Files\Sonic Shared 2008-09-03 18:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-09-03 18:25 --------- d-----w C:\Program Files\InterVideo 2008-09-03 18:25 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-09-03 18:23 --------- d-----w C:\Program Files\Common Files\Java 2008-09-03 18:18 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\Intel 2008-09-03 18:17 --------- d-----w C:\Program Files\Analog Devices 2008-09-03 18:15 --------- d-----w C:\Program Files\NetWaiting 2008-09-03 18:15 --------- d-----w C:\Program Files\Digital Line Detect 2008-09-03 18:15 --------- d-----w C:\Program Files\CONEXANT 2008-09-03 18:12 21,393 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2008-09-03 18:12 21,393 ----a-w C:\WINDOWS\AegisP.sys 2008-09-03 18:12 --------- d-----w C:\Program Files\Common Files\snp2uvc 2008-09-03 18:12 --------- d-----w C:\Documents and Settings\Piotrek\Dane aplikacji\InstallShield 2008-09-03 18:12 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\InstallShield 2008-09-03 18:11 --------- d-----w C:\Program Files\Synaptics 2008-09-03 18:11 --------- d-----w C:\Program Files\Intel 2008-09-03 18:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Intel 2008-09-03 18:05 --------- d-----w C:\Program Files\Windows Media Connect 2 . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000] "PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2007-06-17 200704] "BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2007-06-17 208896] "TPFNF7"="C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2007-04-09 58416] "TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2007-03-09 66176] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-17 8433664] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-17 81920] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940] "nwiz"="nwiz.exe" [2007-05-17 C:\WINDOWS\system32\nwiz.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 C:\WINDOWS\KHALMNPR.Exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - C:\Programy\Logitech\SetPoint\SetPoint.exe [2008-09-21 784912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2007-03-14 22:17 89600 C:\WINDOWS\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2] 2006-09-06 09:37 34344 C:\Program Files\Lenovo\HOTKEY\notifyf2.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2006-12-14 04:06 28672 C:\Program Files\Lenovo\HOTKEY\tphklock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify] 2007-07-05 14:52 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Digital Line Detect.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Digital Line Detect.lnk backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG] --a------ 2007-02-01 20:00 419376 C:\Program Files\ThinkVantage\AMSG\Amsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AwaySch] --a------ 2006-11-07 12:51 91688 C:\Program Files\Lenovo\AwayTask\AwaySch.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth] --a------ 2007-01-30 19:01 2618944 C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray] --a------ 2006-05-18 16:24 196696 C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EZEJMNAP] --a------ 2007-03-28 19:32 243248 C:\PROGRA~1\ThinkPad\UTILIT~1\EZEJMNAP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 C:\Programy\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2006-02-19 02:41 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2004-07-27 16:50 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2004-07-27 16:50 81920 C:\Program Files\Common Files\Installshield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager] --a------ 2007-03-22 19:02 120368 C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] ---hs---- 2004-08-04 01:55 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2007-04-09 09:23 1015808 C:\Program Files\Analog Devices\Core\smax4pnp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy] --a------ 2007-02-08 13:19 536576 C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-08-04 01:02 36352 C:\Programy\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TpShocks] --a------ 2007-03-29 18:40 181808 C:\WINDOWS\system32\TpShocks.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "SUService"=2 (0x2) "ose"=3 (0x3) "odserv"=3 (0x3) "Microsoft Office Groove Audit Service"=3 (0x3) "gusvc"=3 (0x3) "wuauserv"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Programy\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "C:\\Programy\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "C:\\Programy\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= R0 Shockprf;Shockprf;C:\WINDOWS\system32\DRIVERS\Apsx86.sys [2007-03-02 100656] R0 TPDIGIMN;TPDIGIMN;C:\WINDOWS\system32\DRIVERS\ApsHM86.sys [2007-03-02 19760] R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 11520] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2007-04-02 4224] R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2007-06-17 4442] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2007-03-14 11152] R2 TVT Backup Protection Service;TVT Backup Protection Service;C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-02-08 569344] R3 TVTI2C;Lenovo SM bus driver;C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2006-09-13 35264] S3 L6TPortGX;Service - Line 6 TonePort GX;C:\WINDOWS\system32\Drivers\L6TPortGX.sys [2007-02-27 609280] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17e79a18-8037-11dd-822a-001c25727706}] \Shell\AutoRun\command - wscript.exe AVG.vbs \Shell\open\Command - wscript.exe AVG.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4e21f36-80cd-11dd-822e-001c25727706}] \Shell\AutoRun\command - wscript.exe AVG.vbs \Shell\open\Command - wscript.exe AVG.vbs . Zawartość folderu 'Zaplanowane zadania' 2008-10-20 C:\WINDOWS\Tasks\PMTask.job - C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2007-06-17 18:16] 2008-10-02 C:\WINDOWS\Tasks\Sprawdź aktualizacje paska narzędzi Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [] . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-NDPS - C:\WINDOWS\system32\dpmw32.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Piotrek\Dane aplikacji\Mozilla\Firefox\Profiles\sufxto4g.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl FF -: plugin - C:\Programy\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - C:\Programy\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nppdf32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nppl3260.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-20 20:07:16 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Lenovo\HOTKEY\tphklock.dll PROCES: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\nview.dll . Czas ukończenia: 2008-10-20 20:07:59 ComboFix-quarantined-files.txt 2008-10-20 18:07:54 Przed: 129 205 448 704 bajtów wolnych Po: 129,195,151,360 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 317 --- E O F --- 2008-09-05 15:15:04

w ramach przypomnienia co mam z tamtym zrobić?? bo w tych sprawach to jestem nie reformowalny. Wiem tyle że trzeba się zapytać kogoś kto się zna i użyć do tego odpowiednich programów a co dalej.............

**Posty:** 7956 · przez **Magik** 20 Paź 2008, 20:19

tamten wpis mozesz dac na FIX, ale to pusty wpis wiec....

ale jak cos

hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html

popunkt4-->usuwanie i Fix Checked

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17e79a18-8037-11dd-822a-001c25727706}] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4e21f36-80cd-11dd-822e-001c25727706}]

zapisz jako fix.reg i odpal plik

co do tych bledow zajrzyj do panelu sterowania/narzedzia admin i podglad zdarzen i wstaw bledy ktore tam sa wyszczegolnione