prosze szanownych kolegów o sprawdzenie czy mam coś w moim komputerze, problem polega na tym, że wywala mnie co jakiś czas z Internet Expl oraz po zamknięciu "klapy" w laptopie nie przechodzi on w tryb czywania lecz wisi bez końca próbując, po otwarciu klapy jest info, że system próbuje przjść w stan czuwania ale nic z tego
załączam loga i proszę o pomoc, dzięki!! Mój komputer to: FUJITSU SIEMENS, AMILO Pa 1538, system Windows XP
ComboFix 09-01-01.02 - mit 2009-01-02 21:13:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.1023.557 [GMT 1:00]
Uruchomiony z: c:\documents and settings\mit\Desktop\ComboFix.exe
* Utworzono nowy punkt przywracania
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\INSTALL.LOG
.
((((((((((((((((((((((((( Pliki utworzone od 2008-12-02 do 2009-01-02 )))))))))))))))))))))))))))))))
.
2009-01-02 10:34 . 2007-10-21 11:54 289,060 --a------ c:\windows\hplj1010.hi1
2009-01-02 10:34 . 2007-10-21 11:54 19,016 --a------ c:\windows\hplj1010.bu1
2008-12-27 14:44 . 2004-08-04 00:56 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-12-27 14:44 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-12-27 14:44 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2008-12-27 14:44 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-12-27 14:12 . 2008-12-27 14:12 <DIR> d-------- c:\documents and settings\mit\Application Data\ConvertTemp
2008-12-27 14:11 . 2008-12-27 20:25 <DIR> d-------- c:\documents and settings\mit\Application Data\Samsung
2008-12-27 13:50 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll
2008-12-27 13:49 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys
2008-12-27 13:41 . 2008-12-27 13:50 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers
2008-12-27 13:41 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico
2008-12-04 20:19 . 2008-12-04 20:19 <DIR> d-------- c:\program files\ANSYS_DesignSpace100PL
2008-12-04 20:19 . 2000-10-19 20:14 121,856 --a------ c:\windows\UnGins.exe
2008-12-04 20:15 . 2008-12-04 20:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Macrovision
2008-12-04 20:08 . 2008-12-04 20:08 <DIR> d-------- c:\documents and settings\mit\Application Data\Ansys
2008-12-04 20:03 . 2005-03-03 22:09 389,120 --------- c:\windows\system32\Codejock.DockingPane.Unicode.9601.ocx
2008-12-04 19:52 . 2008-12-04 20:10 <DIR> d-------- c:\program files\ANSYS Inc
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-02 18:40 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-02 18:26 --------- d-----w c:\program files\Spyware Doctor
2009-01-02 09:42 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-02 09:42 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-01-02 09:39 --------- d-----w c:\program files\Java
2009-01-02 09:35 --------- d-----w c:\program files\Hewlett-Packard
2009-01-02 09:32 --------- d-----w c:\program files\Common Files\eDrawings2007
2008-12-31 08:01 --------- d-----w c:\program files\eMule
2008-12-27 12:49 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-10 20:53 --------- d-----w c:\documents and settings\mit\Application Data\SolidWorks
2008-11-02 15:35 --------- d-----w c:\program files\SolidWorks
2008-10-25 11:55 19,067 ----a-w C:\0xf9.exe
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:07 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2007-03-19 18:13 6,422,611 -c--a-w c:\program files\frostwire-4.13.1.6.windows.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2008-02-14 13:54 1555480 --a------ c:\program files\free-downloads.net\tbfree.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 68856]
"Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2007-04-16 2115728]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-02-22 216520]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7585792]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 53248]
"fscp"="c:\program files\AVC Finger-sensing Pad Driver\fscp.exe" [2006-09-18 995328]
"PowerManager"="c:\program files\Power Manager\PM.exe" [2006-09-06 151552]
"FuncKey"="c:\program files\Hotkey Management\FuncKey.exe" [2006-09-05 139264]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-04-15 45056]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-01-10 949376]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
"Spyware Doctor"="c:\program files\Spyware Doctor\swdoctor.exe" [2007-04-16 2115728]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe"=
"c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe"=
"c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe"=
"c:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\CEExeServerU.exe"=
"c:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe"=
"c:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-01-10 15424]
R2 ANSYS FLEXlm license manager;ANSYS FLEXlm license manager;c:\progra~1\ANSYSI~1\SHARED~1\LICENS~1\Intel\lmgrd.exe [2008-12-04 909312]
R2 FspadSvc;FspadSvc;c:\program files\AVC Finger-sensing Pad Driver\fspadsvr.exe [2007-01-26 520704]
R3 fspad;AVC Finger-sensing Pad Driver for Windows 2000/XP;c:\windows\system32\DRIVERS\fspad.sys [2007-01-26 22912]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a15c7952-a68e-11dc-a7fc-00140b05b4f4}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1f5f372-c233-11dd-a9c6-00c0a8ccabbe}]
\Shell\AutoRun\command - G:\WDSetup.exe
*Newly Created Service* - PROCEXP90
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
c:\windows\Downloaded Program Files\SignActivX.ocx - O16 -: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43}
hxxps://www.bph.pl/pi/components/SignActivX.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-02 21:16:50
Windows 5.1.2600 Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\windows\TEMP\mc21.tmp"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'lsass.exe'(784)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Czas ukończenia: 2009-01-02 21:18:31
ComboFix-quarantined-files.txt 2009-01-02 20:18:28
Przed: 87 318 159 360 bytes free
Po: 88,957,972,480 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
175 --- E O F --- 2008-12-19 16:08:02
