Witam.
Ja już tego systemu nie czaje.Dzisiaj miałem błąd R2R.exe (pierwszy raz=zjadał masę pamięci)
Więc poszukałem że to system wariuje=ma błędy ma wiec przeslakowałem go Run XP Repair Pro 2007 troszke tego było ale tak zawsze bywa.
Co jeszcze znalazłem:
Witam,
Na komputerze z systemem XP PRO występują problemy typu: zawieszenie, restart. Jest to komputer IBM Lenovo.
Błędy jakie się pojawiały do tej pory to:
- Aplikacja powodująca błąd R2R.exe, wersja 0.0.0.0, moduł powodujący błąd SMA5.dll, wersja 0.0.0.0, adres błędu 0x0001237a,
- Aplikacja powodująca błąd msohelp.exe, wersja 11.0.5510.0, moduł powodujący błąd urlmon.dll, wersja 6.0.2900.3231, adres błędu 0x0003b5ce,
- Aplikacja powodująca błąd nbj.exe, wersja 1.2.0.61, moduł powodujący błąd advrcntr.dll, wersja 1.2.12.2315, adres błędu 0x0001d144,
a ostatnio dużo miesza coś takiego:
- Aplikacja zawieszająca iexplore.exe, wersja 7.0.6000,16574, moduł zawieszający hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
hungapp miesza nie tylko w iexplore, który jest przeglądarką drugą w kolejności używania, ale również w winword.exe i outlook.exe.
Jest to ten sam komp Lenovo co ja mam i te same objawy R2R , iexplore (potrzebuje 200 fizycznej i do 200 wirtualnej pamieci przy 5 -8 otwartych stronach no i wiesza sie.
Nie miałem takich problemów z wcześniejszym stajonarnym kompem no i piratem XP
Ale zgodnie z rada umieszczam logi
ComboFix 08-03-10.1 - PICIA 2008-03-12 15:44:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.442 [GMT 0:00]
Running from: D:\Instalki\Naprawianie systemu\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-02-12 to 2008-03-12 )))))))))))))))))))))))))))))))
.
2008-03-12 15:19 . 2008-03-12 15:24 <DIR> d-------- C:\Program Files\XP Repair Pro 2007
2008-03-12 12:00 . 2008-03-12 12:02 <DIR> d-------- C:\_SMA
2008-03-12 01:14 . 2008-03-12 08:05 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\AVG7
2008-03-12 01:13 . 2008-03-12 01:13 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2008-03-12 01:12 . 2008-03-12 01:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2008-03-12 01:12 . 2008-03-12 03:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\avg7
2008-03-11 16:48 . 2008-03-11 16:50 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-03-11 16:48 . 2008-03-11 16:48 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\PC Tools
2008-03-11 16:48 . 2008-03-12 01:54 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-03-11 16:48 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-11 16:48 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-11 16:48 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-11 16:48 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-03-11 16:40 . 2008-03-11 16:40 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\TransAng3
2008-03-11 13:52 . 2008-03-11 13:52 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-11 13:51 . 2008-03-11 13:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-11 13:34 . 2008-03-11 13:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-03-06 23:54 . 2008-03-06 23:54 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\Media Player Classic
2008-03-06 23:47 . 2008-03-06 23:47 <DIR> d-------- C:\Program Files\Real Alternative
2008-03-04 23:57 . 2008-03-05 00:07 <DIR> d-------- C:\Program Files\Opera7
2008-03-04 23:57 . 2008-03-04 23:57 1,783 --a------ C:\WINDOWS\nsreg.dat
2008-03-03 20:51 . 2008-03-12 15:45 <DIR> d-------- C:\Program Files\FlashGet
2008-03-03 10:23 . 2008-03-03 10:23 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\BESTplayer
2008-02-28 18:01 . 2008-02-28 18:01 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\Gadu-Gadu
2008-02-28 17:29 . 2008-02-28 17:29 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-28 17:29 . 2008-02-28 17:50 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-02-28 17:19 . 2008-03-11 09:16 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\skypePM
2008-02-28 17:19 . 2008-02-28 17:19 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-02-28 17:18 . 2008-03-11 15:35 <DIR> d-------- C:\Documents and Settings\PICIA\Dane aplikacji\Skype
2008-02-28 17:17 . 2008-02-28 17:17 <DIR> d-------- C:\Program Files\Skype
2008-02-28 17:17 . 2008-02-28 17:17 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-02-28 17:15 . 2008-02-28 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-02-28 16:21 . 2008-02-28 16:28 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-02-28 16:21 . 2008-02-28 16:34 <DIR> d-------- C:\Documents and Settings\PICIA\Gadu-Gadu
2008-02-28 16:18 . 2008-03-11 15:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SITEguard
2008-02-28 16:17 . 2008-02-28 16:17 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-02-28 16:17 . 2008-03-12 12:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla!
2008-02-25 12:15 . 2008-02-25 12:15 156 --a------ C:\WINDOWS\mistrz.ini
2008-02-25 12:10 . 2008-02-25 12:10 0 --a------ C:\WINDOWS\mtstack.INI
2008-02-25 12:04 . 2008-02-25 12:04 <DIR> d-------- C:\WINDOWS\OCCACHE
2008-02-25 12:04 . 1999-02-04 22:56 148,480 --a------ C:\WINDOWS\fsivba.dll
2008-02-25 12:04 . 1996-12-12 14:30 64,512 --a------ C:\WINDOWS\system32\drivers\SENTINEL.SYS
2008-02-25 12:04 . 1996-12-12 14:30 38,400 --------- C:\WINDOWS\system32\SNTI386.DLL
2008-02-25 12:04 . 1997-07-11 00:00 31,744 --a------ C:\WINDOWS\system32\HLP95EN.DLL
2008-02-25 12:04 . 1996-12-12 14:30 16,896 --a------ C:\WINDOWS\system32\RNBOVDD.DLL
2008-02-25 12:04 . 1996-12-12 14:30 10,929 --------- C:\WINDOWS\system32\SENTINEL.HLP
2008-02-25 12:03 . 2008-02-25 12:04 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-02-25 12:01 . 2008-02-25 12:24 <DIR> d-------- C:\Program Files\ACAD2000
2008-02-25 11:59 . 1996-11-06 12:07 302,080 --a------ C:\WINDOWS\unin0415.exe
2008-02-20 20:40 . 2008-02-20 20:40 <DIR> d-------- C:\Program Files\Common Files\SupportSoft
2008-02-16 16:15 . 2008-02-16 16:15 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-12 15:36 18 ----a-w C:\Program Files\XP Repair Pro 2007ERR_Item0-3-12-2008_15-34-59_9610632.dnp
2008-03-12 15:25 18 ----a-w C:\Program Files\XP Repair Pro 2007ERR_Item0-3-12-2008_15-24-9_9792630.dnp
2008-03-12 11:29 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-11 22:57 --------- d-----w C:\Program Files\English Translator 3
2008-03-11 16:45 --------- d-----w C:\Documents and Settings\PICIA\Dane aplikacji\uTorrent
2008-03-09 19:39 5,427 ----a-w C:\WINDOWS\system32\EGATHDRV.SYS
2008-03-04 23:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-04 23:57 --------- d-----w C:\Program Files\Java
2008-02-29 17:48 --------- d-----w C:\Program Files\Norton SystemWorks
2008-02-29 17:47 --------- d-----w C:\Documents and Settings\PICIA\Dane aplikacji\Symantec
2008-02-25 19:07 5,018 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-02-25 19:06 --------- d-----w C:\Documents and Settings\PICIA\Dane aplikacji\Corel
2008-02-25 18:00 57,464 ----a-w C:\Documents and Settings\PICIA\Dane aplikacji\GDIPFONTCACHEV1.DAT
2008-02-24 18:50 --------- d-----w C:\Program Files\Corel
2008-02-24 18:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel
2008-02-24 11:59 --------- d-----w C:\Documents and Settings\PICIA\Dane aplikacji\Lenovo
2008-02-09 20:34 --------- d-----w C:\Program Files\uTorrent
2008-02-09 20:28 --------- d-----w C:\Program Files\Symantec
2008-02-09 20:24 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-02-09 18:11 --------- d-----w C:\Program Files\Idyle Software
2008-02-04 20:02 17,408 ----a-w C:\WINDOWS\system32\rpcnetp.dll
2008-02-04 20:01 17,408 ----a-w C:\WINDOWS\system32\rpcnetp.exe
2008-02-01 14:36 229,376 ----a-r C:\WINDOWS\system32\SZBase5.dll
2008-01-31 12:16 34,944 ----a-r C:\WINDOWS\system32\drivers\SZKG.sys
2008-01-30 17:53 126,976 ----a-r C:\WINDOWS\system32\IS3HTUI5.dll
2008-01-30 17:52 61,440 ----a-r C:\WINDOWS\system32\IS3Hks5.dll
2008-01-30 17:52 372,736 ----a-r C:\WINDOWS\system32\IS3UI5.dll
2008-01-30 17:52 364,544 ----a-r C:\WINDOWS\system32\IS3DBA5.dll
2008-01-30 17:51 23,040 ----a-r C:\WINDOWS\system32\IS3XDat5.dll
2008-01-30 17:51 192,512 ----a-r C:\WINDOWS\system32\IS3Win325.dll
2008-01-30 17:50 94,208 ----a-r C:\WINDOWS\system32\IS3Inet5.dll
2008-01-30 17:50 90,112 ----a-r C:\WINDOWS\system32\IS3Svc5.dll
2008-01-30 17:47 704,512 ----a-r C:\WINDOWS\system32\IS3Base5.dll
2008-01-08 21:05 155,995 ----a-w C:\WINDOWS\java\Packages\Y09JLVF1.ZIP
2007-12-14 18:49 27,262,976 ----a-w C:\VIRTPART.DAT
2007-12-14 11:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-13 16:51 94,636 ----a-w C:\WINDOWS\dropcpyr.dll
2007-12-13 16:51 73,728 ----a-w C:\WINDOWS\copyfstq.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 10:54 2131392]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-19 05:51 774233]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 04:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 04:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 04:17 118784]
"Resume copy"="copyfstq.exe" [2007-12-13 16:51 73728 C:\WINDOWS\copyfstq.exe]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2002-08-19 22:22 50880]
"ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 22:23 34504]
"ISUSPM Startup"="C:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe" [2005-08-11 16:30 249856]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-12 01:13 579072]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2004-08-04 21:00 159744]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-12 01:13 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
C:\Program Files\Softex\OmniPass\opxpgina.dll 2006-10-16 13:30 49152 C:\Program Files\Softex\OmniPass\OPXPGina.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2006-01-11 06:05 13824 C:\WINDOWS\system32\tphklock.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^PICIA^Menu Start^Programy^Autostart^ctfmon.exe]
[HKLM\~\startupfolder\C:^Documents and Settings^PICIA^Menu Start^Programy^Autostart^TomTom HOME.lnk]
backup=C:\WINDOWS\pss\TomTom HOME.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACTray]
--a------ 2006-10-05 18:57 409600 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACWLIcon]
--a------ 2006-10-05 18:53 110592 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2006-08-30 07:40 89542 C:\WINDOWS\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 09:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG]
--a------ 2005-11-22 11:36 507904 C:\PROGRA~1\THINKV~1\AMSG\amsg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
--a------ 2006-01-25 09:45 53248 C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-12-16 11:57 94208 C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
--a------ 2002-08-19 22:22 50880 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
--a------ 2006-11-13 10:10 478800 C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth]
--a------ 2006-07-14 17:13 2341632 C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 12:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
--a------ 2006-05-18 15:24 196696 C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro]
--a------ 2006-01-05 20:04 278528 C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostStartTrayApp]
--a------ 2007-12-14 18:41 94208 C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IS CfgWiz]
C:\Program Files\Norton Internet Security\cfgwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-08-11 16:30 249856 C:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-08-11 16:30 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
--------- 2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]
--a------ 2006-07-03 16:11 110592 C:\PROGRA~1\Lenovo\LENOVO~2\LPMGR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OmniPass]
--a------ 2006-10-16 13:36 2502656 C:\Program Files\Softex\OmniPass\scureapp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2006-03-15 23:07 421888 C:\Program Files\Picasa2\PicasaMediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMHandler]
--a------ 2006-08-21 22:54 33128 C:\PROGRA~1\Lenovo\PMDRIV~1\PMHandler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-10-11 09:36 16267776 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-06 18:21 21898024 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 09:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
--a------ 2004-11-02 16:59 218240 C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 12:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPHOTKEY]
--a------ 2006-05-08 01:34 94208 C:\Program Files\Lenovo\HOTKEY\TPHKMGR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPWAUDAP]
--a------ 2006-04-19 22:29 24576 C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]
--a------ 2006-07-14 17:05 503808 C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\URLLSTCK.exe]
C:\Program Files\Norton Internet Security\UrlLstCk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XPRepairPro2007]
--a------ 2007-04-06 23:12 1015808 C:\Program Files\XP Repair Pro 2007\XPRepairPro.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"omniserv"=2 (0x2)
"navapsvc"=3 (0x3)
"helpsvc"=2 (0x2)
"Diskeeper"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
R0 szkg5;szkg;C:\WINDOWS\system32\DRIVERS\szkg.sys [2008-01-31 12:16]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-11-08 08:27]
R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2002-08-14 14:11]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2006-01-12 23:33]
R1 PMHler;PMHler;C:\WINDOWS\system32\drivers\PMHler.sys [2006-05-24 10:48]
R2 smi2;smi2;C:\Program Files\SMI2\smi2.sys [2006-07-14 14:55]
R2 srvBWMNT;Bandwidth Monitor Service;C:\PROGRA~1\IDYLES~1\BANDWI~1\BWMNT.exe [2000-05-21 12:28]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-07 20:00:17 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\DANEAP~1\Symantec\NORTON~1\Tasks\mycomp.sca
"2008-03-01 07:52:02 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job"
- C:\Program Files\Norton SystemWorks\OBC.exe
"2008-03-12 15:09:00 C:\WINDOWS\Tasks\Sprawdź aktualizacje paska narzędzi Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-12 15:47:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\Softex\OmniPass\opxpgina.dll
-> C:\WINDOWS\system32\tphklock.dll
.
Completion time: 2008-03-12 15:49:09
ComboFix-quarantined-files.txt 2008-03-12 15:49:04
.
2007-12-25 11:56:29 --- E O F ---
i drugi
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51:37, on 2008-03-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Lenovo\PM Driver\PMSveH.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\PROGRA~1\IDYLES~1\BANDWI~1\BWMNT.exe
c:\program files\lenovo\system update\suservice.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Idyle Software\Bandwidth Monitor\BandwidthMonitor.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\English Translator 3\ET.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\FlashGet\flashget.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
D:\Instalki\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com.pl/0SEPLPL/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch_1.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [BandwidthMonitor.exe -CFG0] C:\Program Files\Idyle Software\Bandwidth Monitor\BandwidthMonitor.exe -CFG0
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: System Update - {DA320635-F48C-4613-8325-D75A933C549E} - C:\Program Files\Lenovo\System Update\sulauncher.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: PMSveH - Lenovo - C:\Program Files\Lenovo\PM Driver\PMSveH.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Bandwidth Monitor Service (srvBWMNT) - Idyle Software - C:\PROGRA~1\IDYLES~1\BANDWI~1\BWMNT.exe
O23 - Service: System Update (SUService) - - c:\program files\lenovo\system update\suservice.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: ThinkVantage Registry Monitor Service - Unknown owner - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
--
End of file - 13076 bytes
Jak juz pisze zadam jeszcze inne pytanie:
Czy te problemy mogą być po długim działaniu wirusa bo z 2-3 miesięcy go nie wywalałem
A po drugie na przyszłość jak i czym sie zabezpieczyć.
Do tej pory na Starym kompie zawsze urzywałem
Norton SystemWorks i nie miałem takich problemów. Tylko że teraz zainstalowałem i ściągnołem go za późno (brak netu a pendrajwem syf na kompa nosiłem.
Co polecacie teraz zainstalowane mam :
AVG 7.5
Spyware Doctor
Spybot - Search & Destroy
Run XP Repair Pro 2007
Ad-Aware 2007 no i
Norton SystemWorks za antywiram oczywiście
Wiem że te wcześniejsze programy to nie antywiry do końca.
Jednak co zapodać na przyszłość na świerzego kopma (system) .?????
Pozdrawiam i Dzięki
Piotr
p.s. Czy na innych partycjach może być ten wirus i czym go wywalić z pendrajfów
bo zamulaja kompa 
