prosze o sprawdzenie loga

**Posty:** 3 · przez **R3X** 22 Sie 2007, 11:13

Witam,
mam problem. Po raz kolejny przytrafiło mi się, że komputer sam się wyłącza bądź nie reaguje na mysz/klawiaturę i zmusza mnie do naciśnięcia reset. Być może przypadek, ale zawsze w tym czasie pracuje z edytorem tekstu Fox Edit. W zasadzie chodzi o to, że potem nie mogę uruchomić systemu przez parę minut. Wyskakuje plansza z możliwościami uruchomienia. Gdy wybieram 'normalny' system restartuje i znów pojawia się owa plansza. Inne opcje zwieszają się, jednak po paru próbach udaje się odpalić go w trybie awaryjnym, a ponowne uruchomienie komputera następuje już pomyślnie.
Oto log.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 10:44:51, on 2007-08-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\program files\steam\steam.exe C:\Program Files\Apache Group\Apache2\bin\Apache.exe C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe C:\Program Files\Apache Group\Apache2\bin\Apache.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\mysql\bin\mysqld-nt.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\R3X\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/english R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: Babylon - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Program Files\Babylon\Babylon-Pro\Babylon Toolbar\BabylonIEToolBar.dll O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: MySQL - Unknown owner - C:\mysql\bin\mysqld-nt".exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Czy usunięcie któregoś z tych wpisów mogłoby naprawić problem?
Z góry dziękuje.

**Posty:** 18165 · przez **wojtas** 22 Sie 2007, 11:22

skasuj:

F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

daj loga z combofixa

**Posty:** 3 · przez **R3X** 22 Sie 2007, 11:40

To zostały mi te wpisy do usunięcia. (NetBIOS jest żółty

)
ComboFix.txt:

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "R3X" 2007-08-22 11:25:58.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.132 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 ))))))))))))))))))))))))))))))) 2007-08-22 11:24 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-19 23:54 14 --a------ C:\WINDOWS\popcinfo.dat 2007-08-19 23:54 <DIR> d-------- C:\Program Files\Babylon 2007-08-19 23:53 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\Babylon 2007-08-19 23:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Babylon 2007-08-19 23:43 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-08-19 23:43 <DIR> d-------- C:\Program Files\Oberon Media 2007-08-19 23:08 <DIR> d-------- C:\Program Files\IncrediMail 2007-08-17 12:35 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\Teleca 2007-08-17 12:33 <DIR> d-------- C:\Program Files\Sony Ericsson 2007-08-17 12:33 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-08-17 12:33 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared 2007-08-17 12:33 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\Sony Ericsson 2007-08-17 12:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca 2007-08-17 12:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson 2007-08-15 11:43 <DIR> d-------- C:\Program Files\PSPad editor 2007-08-15 11:43 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\PSpad 2007-08-09 13:27 <DIR> d-------- C:\Program Files\Robster Productions 2007-08-05 23:56 <DIR> d-------- C:\Program Files\Winamp 2007-08-05 23:56 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\MusicIP 2007-08-04 12:56 <DIR> d-------- C:\Program Files\Valve 2007-08-02 14:01 <DIR> d-------- C:\Program Files\Steam 2007-08-01 19:52 <DIR> d-------- C:\Program Files\sXe Injected 2007-07-28 20:58 <DIR> d-------- C:\Program Files\mIRC 2007-07-28 16:24 77,824 --a------ C:\WINDOWS\system32\mplaw7.dll 2007-07-28 16:24 77,824 --a------ C:\WINDOWS\system32\mplaa6.dll 2007-07-28 16:24 761,856 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-07-28 16:24 65,536 --a------ C:\WINDOWS\system32\mplapx.dll 2007-07-28 16:24 65,536 --a------ C:\WINDOWS\system32\mplam6.dll 2007-07-28 16:24 19,968 --a------ C:\WINDOWS\system32\cpuinf32.dll 2007-07-28 16:24 1,650,688 --a------ C:\WINDOWS\system32\mplva6.dll 2007-07-28 16:24 1,581,056 --a------ C:\WINDOWS\system32\mplvw7.dll 2007-07-28 16:24 1,552,384 --a------ C:\WINDOWS\system32\mplvm6.dll 2007-07-28 16:24 1,122,304 --a------ C:\WINDOWS\system32\mplvpx.dll 2007-07-28 16:23 <DIR> d-------- C:\Program Files\ACE Mega CoDecS Pack 2007-07-28 12:09 33 --a------ C:\WINDOWS\system32\mysql.bat 2007-07-26 23:33 109,568 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-07-26 23:33 108,544 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-07-26 23:32 <DIR> d-------- C:\Program Files\AVIcodec 2007-07-26 23:30 <DIR> d-------- C:\Program Files\MarBit 2007-07-24 17:58 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\Dev-Cpp 2007-07-24 17:58 <DIR> d-------- C:\Dev-Cpp 2007-07-22 22:40 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\Media Player Classic 2007-07-22 22:39 <DIR> d-------- C:\Program Files\Real Alternative 2007-07-22 22:39 <DIR> d-------- C:\Program Files\Media Player Classic 2007-07-22 22:39 <DIR> d-------- C:\DOCUME~1\R3X\DANEAP~1\Real 2007-07-22 22:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-22 19:04 <DIR> d-------- C:\Program Files\Ventrilo 2007-07-22 19:04 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-22 11:01 --------- d-------- C:\Program Files\Spyware Terminator 2007-08-21 20:21 --------- d-------- C:\DOCUME~1\R3X\DANEAP~1\foobar2000 2007-08-21 20:20 --------- d-------- C:\Program Files\eMule 2007-08-21 16:22 --------- d-------- C:\DOCUME~1\R3X\DANEAP~1\teamspeak2 2007-08-16 13:03 --------- d-------- C:\DOCUME~1\R3X\DANEAP~1\Tlen.pl 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-28 00:02 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-28 00:02 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-28 00:00 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-27 23:59 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-27 23:58 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-26 23:34 --------- d-------- C:\Program Files\NimoCodec Pack 2007-07-26 23:34 --------- d-------- C:\Program Files\DivX 2007-07-22 22:16 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-22 19:05 --------- d-------- C:\DOCUME~1\R3X\DANEAP~1\Ventrilo 2007-07-22 11:23 --------- d-------- C:\Program Files\Hewlett-Packard 2007-07-16 17:17 --------- d-------- C:\Program Files\AIDA32 - Personal System Information 2007-07-11 15:47 --------- d-------- C:\DOCUME~1\R3X\DANEAP~1\BitTorrent 2007-07-11 15:46 --------- d-------- C:\Program Files\BitTorrent 2007-07-11 15:34 --------- d-------- C:\Program Files\FlashGet 2007-07-11 14:18 138368 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2007-06-24 13:37 --------- d-------- C:\Program Files\FOX Edit 2007-06-09 14:21 0 -ra------ C:\logwmemory.bin ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{965B54B0-71E0-4611-8DE7-F73FA0B20E26}"= C:\Program Files\Babylon\Babylon-Pro\Babylon Toolbar\BabylonIEToolBar.dll [2007-07-16 15:49 264416] [HKEY_CLASSES_ROOT\CLSID\{965B54B0-71E0-4611-8DE7-F73FA0B20E26}] [HKEY_CLASSES_ROOT\BabylonTBLib.BabylonTB.1] [HKEY_CLASSES_ROOT\TypeLib\{162484B8-B114-453f-A344-C0B24B0F1D99}] [HKEY_CLASSES_ROOT\BabylonTBLib.BabylonTB] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "iKeyWorks"="C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" [2003-07-29 05:31] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2007-07-11 14:18] "NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [2001-07-09 12:50] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 13:27] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 10:14] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "Steam"="c:\program files\steam\steam.exe" [2007-08-02 14:02] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog C:\Documents and Settings\R3X\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Monitor Apache Servers.lnk - C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe [2006-07-27 15:59:08] R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys R3 FETNDIS;VIA Rhine Family Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\fetnd5b.sys R3 MA-620;Mobile Action MA-668 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\MA-620.sys S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5e79ec8-f702-11db-b008-000d870befe3}] AutoRun\command- H:\EXPLORER.EXE explore\Command- H:\EXPLORER.EXE open\Command- H:\EXPLORER.EXE ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-22 11:28:27 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-22 11:29:15 --- E O F ---

**Posty:** 18165 · przez **wojtas** 22 Sie 2007, 11:46

system masz czysty nie jest to wina wirusow

**Posty:** 3 · przez **R3X** 22 Sie 2007, 11:54

ok dzięki za pomoc, a te wpisy co je miałem usunąć odeszły same

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum