Windows nie uruchamia sie zacina sie przy ładowaniu

[jankes90]

Poniżej log z HijackThis podejzewam ze przyczyna lezy w pliku boot.ini robilem juz fixboot w konsoli naprawczej i takze inne rzeczy na forum byc moze jest cos w logu.

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:57:44, on 2009-01-27
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "E:\PROGRAM FILES\Winamp\winampa.exe"
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [MSConfig] C:\windows\system32\msconfig.exe /auto
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Usługa bramy warstwy aplikacji (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)

--
End of file - 5161 bytes

[sgsman]

Wrzuć loga z Combofixa.

[Okocza]

Kod: Zaznacz wszystko

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

fix w hj i log z combofixa wstaw

[jankes90]

Logi combofixa

Kod: Zaznacz wszystko

ComboFix 09-01-21.04 - User 2009-01-27 17:02:04.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professional  5.1.2600.3.1250.1.1045.18.2047.1810 [GMT 1:00]
Uruchomiony z: c:\documents and settings\User\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.

(((((((((((((((((((((((((   Pliki utworzone od 2008-12-27 do 2009-01-27  )))))))))))))))))))))))))))))))
.

2009-01-27 16:12 . 2009-01-27 16:12   <DIR>   d--------   C:\lspfix
2009-01-27 15:55 . 2009-01-27 16:09   <DIR>   d--------   C:\HiJackThis
2009-01-27 15:32 . 2009-01-27 15:58   664   --a------   c:\windows\system32\d3d9caps.dat
2009-01-24 12:54 . 2009-01-25 11:39   <DIR>   d--------   c:\program files\uTorrent
2009-01-24 12:54 . 2009-01-25 20:30   <DIR>   d--------   c:\documents and settings\User\Dane aplikacji\uTorrent
2009-01-24 12:39 . 2009-01-24 12:39   108,293   -r-hs----   c:\windows\system32\olhrwef.exe
2009-01-24 12:39 . 2009-01-24 12:39   95,744   -r-hs----   c:\windows\system32\nmdfgds1.dll
2009-01-24 12:39 . 2009-01-27 12:58   95,744   -r-hs----   c:\windows\system32\nmdfgds0.dll
2009-01-13 21:41 . 2009-01-13 21:41   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Codemasters
2009-01-10 22:23 . 2009-01-10 22:23   <DIR>   d--------   c:\program files\SimBin
2009-01-10 22:03 . 2009-01-27 13:16   <DIR>   d--------   c:\program files\Steam
2009-01-10 20:47 . 2009-01-27 13:16   <DIR>   d--------   C:\GTL
2009-01-10 17:02 . 2009-01-10 17:02   <DIR>   d--------   c:\documents and settings\User\Dane aplikacji\Media Player Classic
2009-01-10 15:06 . 2009-01-24 12:45   <DIR>   d--------   c:\program files\Real Alternative
2009-01-10 15:06 . 2009-01-10 15:06   <DIR>   d--------   c:\program files\On2 Technologies
2009-01-10 15:06 . 2009-01-24 12:45   <DIR>   d--------   c:\program files\Media Player Classic
2009-01-10 15:06 . 2004-02-12 09:39   438,272   --a------   c:\windows\system32\vp6vfw.dll
2009-01-10 15:06 . 2004-02-17 10:10   327,680   --a------   c:\windows\system32\vp6dec.ax
2009-01-10 15:06 . 2004-02-17 10:11   53,248   --a------   c:\windows\system32\vp6dec_settings.cpl
2009-01-10 15:06 . 2009-01-24 12:40   36,734   --a------   c:\windows\system32\OggDSuninst.exe
2009-01-10 15:05 . 2009-01-10 15:05   <DIR>   d--------   c:\program files\K-Lite Codec Pack
2009-01-10 15:05 . 2008-05-22 23:22   3,596,288   --a------   c:\windows\system32\qt-dx331.dll
2009-01-10 15:05 . 2008-07-04 07:34   860,160   --a------   c:\windows\system32\lameACM.acm
2009-01-10 15:05 . 2008-01-10 13:15   755,027   --a------   c:\windows\system32\xvidcore.dll
2009-01-10 15:05 . 2008-05-31 00:22   683,520   --a------   c:\windows\system32\divx.dll
2009-01-10 15:05 . 2004-01-25 17:18   217,088   --a------   c:\windows\system32\yv12vfw.dll
2009-01-10 15:05 . 2007-09-04 17:56   164,352   --a------   c:\windows\system32\unrar.dll
2009-01-10 15:05 . 2008-01-10 13:16   159,839   --a------   c:\windows\system32\xvidvfw.dll
2009-01-10 15:05 . 2007-09-21 01:52   118,784   --a------   c:\windows\system32\ac3acm.acm
2009-01-10 15:05 . 2008-05-22 23:19   81,920   --a------   c:\windows\system32\dpl100.dll
2009-01-10 15:05 . 2008-06-12 19:36   7,680   --a------   c:\windows\system32\ff_vfw.dll
2009-01-10 15:05 . 2007-07-10 17:10   547   --a------   c:\windows\system32\ff_vfw.dll.manifest
2009-01-10 15:05 . 2007-10-03 16:03   414   --a------   c:\windows\system32\lame_acm.xml
2009-01-10 15:03 . 2009-01-10 15:03   <DIR>   d--------   c:\program files\MarBit
2009-01-08 23:24 . 2009-01-08 23:34   <DIR>   d--------   c:\program files\F1 Challenge 2007
2009-01-08 18:08 . 2009-01-10 17:02   49   --a------   c:\windows\NeroDigital.ini
2009-01-07 22:57 . 2009-01-08 16:37   54,156   --ah-----   c:\windows\QTFont.qfn
2009-01-07 22:57 . 2009-01-07 22:57   1,409   --a------   c:\windows\QTFont.for
2009-01-01 02:27 . 2009-01-01 02:27   <DIR>   d--------   c:\documents and settings\User\Dane aplikacji\Teleca
2009-01-01 02:27 . 2009-01-01 02:27   <DIR>   d--------   c:\documents and settings\All Users\Documents
2009-01-01 02:27 . 2009-01-01 02:27   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Sony Ericsson
2009-01-01 02:26 . 2009-01-01 02:26   <DIR>   d--------   c:\program files\Sony Ericsson
2009-01-01 02:26 . 2009-01-01 02:27   <DIR>   d--------   c:\program files\Common Files\Teleca Shared
2009-01-01 02:26 . 2009-01-01 02:27   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Teleca
2009-01-01 02:25 . 2009-01-01 02:25   <DIR>   d--------   c:\documents and settings\User\Dane aplikacji\AdobeUM
2009-01-01 02:23 . 2009-01-01 02:23   <DIR>   d--------   c:\windows\Downloaded Installations
2009-01-01 02:21 . 2009-01-01 02:21   <DIR>   d--------   c:\program files\Disc2Phone
2009-01-01 02:15 . 2009-01-01 02:16   <DIR>   d--------   c:\windows\system32\URTTemp
2009-01-01 02:13 . 2009-01-01 02:13   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2009-01-01 02:09 . 2005-07-07 15:25   89,872   -ra------   c:\windows\system32\drivers\k750mdm.sys
2009-01-01 02:09 . 2005-07-07 15:25   81,728   -ra------   c:\windows\system32\drivers\k750mgmt.sys
2009-01-01 02:09 . 2005-07-07 15:25   79,488   -ra------   c:\windows\system32\drivers\k750obex.sys
2009-01-01 02:09 . 2005-07-07 15:26   6,576   -ra------   c:\windows\system32\drivers\k750mdfl.sys
2009-01-01 02:09 . 2005-07-07 15:26   6,144   -ra------   c:\windows\system32\drivers\k750cmnt.sys
2009-01-01 02:09 . 2005-07-07 15:26   6,144   -ra------   c:\windows\system32\drivers\k750cm.sys
2009-01-01 02:08 . 2005-07-07 15:26   55,216   -ra------   c:\windows\system32\drivers\k750bus.sys
2009-01-01 02:08 . 2005-07-07 15:25   5,744   -ra------   c:\windows\system32\drivers\k750whnt.sys
2009-01-01 02:08 . 2005-07-07 15:25   5,744   -ra------   c:\windows\system32\drivers\k750wh.sys
2008-12-28 18:00 . 2008-12-28 18:00   <DIR>   d--------   c:\windows\system32\embedded
2008-12-28 18:00 . 2008-12-28 18:03   <DIR>   d--------   C:\GTR2

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-27 12:23   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\Skype
2009-01-27 11:59   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\skypePM
2009-01-25 16:41   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Test Drive Unlimited
2009-01-10 19:59   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-01-10 14:06   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-09 17:37   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\HPAppData
2009-01-09 17:19   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\Winamp
2008-12-28 16:00   ---------   d-----w   c:\program files\Codemasters
2008-12-19 15:08   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\WEBREG
2008-12-19 15:07   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\HP
2008-12-19 14:59   ---------   d-----w   c:\program files\HP
2008-12-19 14:59   ---------   d-----w   c:\program files\Common Files\HP
2008-12-19 14:59   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant
2008-12-19 14:59   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\HP
2008-12-19 14:45   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard
2008-12-16 16:45   ---------   d-----w   c:\program files\Common Files\DirectX
2008-12-16 16:38   ---------   d-----w   c:\program files\EA Games
2008-12-16 16:33   ---------   d-----w   c:\program files\Common Files\EasyInfo
2008-12-15 15:29   ---------   d-----w   c:\program files\Atari
2008-12-14 17:49   ---------   d-----w   c:\program files\Electronic Arts
2008-12-14 15:36   138,184   ----a-w   c:\windows\system32\drivers\PnkBstrK.sys
2008-12-14 15:35   183,112   ----a-w   c:\windows\system32\PnkBstrB.exe
2008-12-13 12:23   ---------   d-----w   c:\program files\Common Files\Ahead
2008-12-13 12:22   ---------   d-----w   c:\program files\Ahead
2008-12-13 12:09   ---------   d-----w   c:\program files\Winamp Toolbar
2008-12-13 12:09   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar
2008-12-12 14:01   348,160   ----a-w   c:\windows\system32\Msvcr71.dll
2008-12-12 14:01   1,700,352   ----a-w   c:\windows\system32\gdiplus.dll
2008-12-12 14:01   1,060,864   ----a-w   c:\windows\system32\mfc71.dll
2008-12-12 14:01   ---------   d-----w   c:\program files\ipla
2008-12-12 14:01   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\ipla
2008-12-12 14:01   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\ipla
2008-12-11 15:41   ---------   d-----w   c:\program files\Cenega
2008-12-09 19:26   ---------   d-----w   c:\program files\Microsoft Games for Windows - LIVE
2008-12-09 18:26   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\THQ
2008-12-09 18:25   107,888   ----a-w   c:\windows\system32\CmdLineExt.dll
2008-12-09 18:25   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\InstallShield
2008-12-09 18:14   ---------   d-----w   c:\program files\THQ
2008-12-08 22:09   66,872   ----a-w   c:\windows\system32\PnkBstrA.exe
2008-12-08 18:58   ---------   d--h--r   c:\documents and settings\User\Dane aplikacji\SecuROM
2008-12-06 15:36   ---------   d-----w   c:\program files\RACE 07
2008-12-06 15:12   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\Leadertech
2008-12-06 14:45   444,952   ----a-w   c:\windows\system32\wrap_oal.dll
2008-12-06 14:45   109,080   ----a-w   c:\windows\system32\OpenAL32.dll
2008-12-06 14:45   ---------   d-----w   c:\program files\OpenAL
2008-12-06 13:30   ---------   d-----w   c:\program files\Skype
2008-12-06 13:30   ---------   d-----w   c:\program files\Common Files\Skype
2008-12-06 13:30   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Skype
2008-12-06 12:56   ---------   d-----w   c:\program files\Common Files\Reallusion
2008-12-06 12:53   ---------   d-----w   c:\program files\KYE
2008-12-06 12:53   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\InstallShield
2008-12-06 12:49   ---------   d-----w   c:\documents and settings\User\Dane aplikacji\Gadu-Gadu
2008-12-06 11:51   ---------   d-----w   c:\program files\Common Files\Adobe
2008-12-06 11:45   ---------   d-----w   c:\program files\SubEdit-Player
2008-12-06 11:33   319,488   ----a-w   c:\windows\HideWin.exe
2008-12-06 11:33   ---------   d-----w   c:\program files\Realtek
2008-12-06 11:25   ---------   d-----w   c:\program files\Intel
2008-12-06 11:06   ---------   d-----w   c:\program files\Usługi online
2008-12-06 11:04   ---------   d-----w   c:\program files\Windows Media Connect 2
2008-11-17 17:38   453,152   ----a-w   c:\windows\system32\NVUNINST.EXE
2008-10-28 16:41   14,303,392   ----a-w   c:\windows\system32\xlive.dll
2008-10-28 16:41   13,643,936   ----a-w   c:\windows\system32\xlivefnt.dll
2008-10-27 09:04   70,992   ----a-w   c:\windows\system32\XAPOFX1_2.dll
2008-10-27 09:04   514,384   ----a-w   c:\windows\system32\XAudio2_3.dll
2008-10-27 09:04   235,856   ----a-w   c:\windows\system32\xactengine3_3.dll
2008-10-27 09:04   23,376   ----a-w   c:\windows\system32\X3DAudio1_5.dll
2008-07-19 00:28   113,664   ----a-w   c:\windows\inf\hdaudio.sys
2006-06-23 06:48   32,768   ----a-r   c:\windows\inf\UpdateUSB.exe
2006-06-15 19:33   233,472   ----a-w   c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 17:43   204,895   ----a-w   c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41   77,824   ----a-w   c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 12:10   426,081   ----a-w   c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19   458,752   ----a-w   c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35   139,264   ----a-w   c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10   204,800   ----a-w   c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42   106,496   ----a-w   c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22   212,992   ----a-w   c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21   167,936   ----a-w   c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
.

------- Sigcheck -------

2007-07-11 06:06  642560  ce594e18fe0d0af804f1f3694921ce62   c:\windows\system32\user32.dll

2008-06-16 14:28  361344  030dc4d48cc2b894fee2f390d8e66ad5   c:\windows\system32\drivers\tcpip.sys

2008-06-16 14:28  549888  335813eacd16e84f3047a3326f6e5473   c:\windows\system32\winlogon.exe

2008-07-19 01:33  2032128  2bc05e243b86aa8e569ee3c5d8b3c424   c:\windows\system32\ntkrnlpa.exe

2008-07-07 10:44  2153472  04404b7f25984558ad3390bf84c4eb95   c:\windows\system32\ntoskrnl.exe

2008-06-27 16:36  1424896  4ec7ed41d95d18b3cd1a2bd9dfefb591   c:\windows\explorer.exe

2008-06-16 14:28  112128  37ed43f3dec4400586554d61c3129478   c:\windows\system32\wuauclt.exe
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="e:\gadu-gadu\gg.exe" [2008-03-20 2127296]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992]
"IPLA!"="c:\program files\ipla\ipla.exe" [2008-12-08 2732792]
"Steam"="c:\program files\Steam\Steam.exe" [2009-01-10 1410296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-18 13680640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-18 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"WinampAgent"="e:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"MSConfig"="c:\windows\system32\msconfig.exe" [2008-06-16 196096]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-30 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-11-18 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-06-16 c:\windows\system32\advpack.dll]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.VP40"= vp4vfw.dll
"vidc.VP50"= vp5vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdoosoft]
-r-hs---- 2009-01-24 12:39 108293 c:\windows\system32\olhrwef.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-01 02:14 155648 E:\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"e:\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\EA Games\\Need for Speed Undercover\\nfs.exe"=
"c:\\Program Files\\THQ\\Juiced2_HIN\\Juiced2_HIN.exe"=
"c:\\Program Files\\Cenega\\Race - The WTCC Game PL\\Race_Steam.exe"=
"c:\\Program Files\\Electronic Arts\\Need for Speed Carbon\\NFSC.exe"=
"c:\\Program Files\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"=
"c:\\Program Files\\EA Games\\Need for Speed Underground 2\\speed2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\GTL\\GTLDedicated.exe"=
"c:\\Program Files\\Codemasters\\ToCA Race Driver 3\\RD3.exe"=
"c:\\Program Files\\Steam\\SteamApps\\darex2521\\race 07 demo crowne plaza raceway edition\\RaceDemo_Steam.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port

S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l151x86.sys [2008-06-16 36864]
S3 PAC7302;iSlim 310;c:\windows\system32\drivers\PAC7302.SYS [2008-12-06 458112]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{595e83bc-c54f-11dd-a454-001e8c072b7b}]
\Shell\AutoRun\command - H:\uvsqfgwd.cmd
\Shell\open\Command - H:\uvsqfgwd.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efe0aef9-c90e-11dd-a465-001e8c072b7b}]
\Shell\AutoRun\command - G:\uvsqfgwd.cmd
\Shell\open\Command - G:\uvsqfgwd.cmd
.
.
------- Skan uzupełniający -------
.
uStart Page = about:blank
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\9an3wmt5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\9an3wmt5.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: e:\plugins\npqtplugin.dll
FF - plugin: e:\plugins\npqtplugin2.dll
FF - plugin: e:\plugins\npqtplugin3.dll
FF - plugin: e:\plugins\npqtplugin4.dll
FF - plugin: e:\plugins\npqtplugin5.dll
FF - plugin: e:\plugins\npqtplugin6.dll
FF - plugin: e:\plugins\npqtplugin7.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-27 17:04:15
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-57989841-1770027372-682003330-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:be,1d,9c,aa,b0,8c,04,91,66,ef,d0,29,8c,8d,f8,17,5c,1d,b2,9a,22,92,2c,
   60,39,66,7b,a5,ed,10,1f,e3,d8,0c,a9,91,dc,f4,d5,68,16,d4,e8,7a,63,f2,e5,8f,\
"??"=hex:59,e5,97,70,47,08,a5,1e,f6,13,83,cc,52,0d,a6,6c

[HKEY_USERS\S-1-5-21-57989841-1770027372-682003330-1001\Software\SecuROM\License information*]
"datasecu"=hex:83,e1,4e,e4,7e,e4,54,4d,74,59,a6,f9,fa,4c,d2,b0,9f,72,1c,02,7e,
   7b,20,af,2e,00,07,84,b6,dd,ec,3d,6e,de,5c,82,7f,f1,c7,e6,09,1b,35,dc,1d,be,\
"rkeysecu"=hex:90,76,e5,a0,0b,e5,33,25,6a,3d,14,0d,56,cc,aa,bd
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(244)
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll

- - - - - - - > 'lsass.exe'(300)
c:\windows\system32\scecli.dll
.
Czas ukończenia: 2009-01-27 17:05:11
ComboFix-quarantined-files.txt  2009-01-27 16:05:10
ComboFix2.txt  2009-01-27 13:44:30

Przed: 34 188 525 568 bajtów wolnych
Po: 34,178,670,592 bajtów wolnych

303


[wojtas]

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\olhrwef.exe
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\nmdfgds0.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdoosoft]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{595e83bc-c54f-11dd-a454-001e8c072b7b}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efe0aef9-c90e-11dd-a465-001e8c072b7b}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.