Próbuję wyczyścić swojego laptopa. Jak dotąd udało mi się zredukować wykorzystanie procesora o 50% i usunąć sporo niepotrzebnych aplikacji. Mój problem polega na powolnym otwieraniu stron, częstymi komunikatami o błędu połączenia, ogólnym zamulaniu. Domyślam się, że problem może leżeć w wirusach, których istnienie podejrzewam. Nazwijcie mnie hipochondrykiem, ale jestem prawie pewien, że coś tam się dostało. Poniżej zamieszczam logi z hijack i dds i rsit. BArdzo proszę rzucić okiem:)
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:56, on 2009-10-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\Avast4\aswUpdSv.exe
D:\Avast4\ashServ.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
D:\Program Files\Analog Devices\Core\smax4pnp.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\Avast4\ashDisp.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\LightScribe\LSSrvc.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
D:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\Avast4\ashMaiSv.exe
D:\Avast4\ashWebSv.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] D:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [avast!] D:\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - D:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - D:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: SWIHPWMI - Sierra Wireless Inc. - D:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
--
End of file - 6449 bytes
- Kod: Zaznacz wszystko
info.txt logfile of random's system information tool 1.05 2009-03-11 23:37:32
======Uninstall list======
-->D:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 D:\WINDOWS\INF\PCHealth.inf
Ad-Aware 2007-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe Color EU Extra Settings-->MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings-->MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{77D2A9D3-5800-43E3-B274-87841BC87DB2}
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->D:\Program Files\Common Files\Adobe\Installers\719d6f144d0c086a0dfa7ff76bb9ac1\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Setup-->MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
ATI - Software Uninstall Utility-->D:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 D:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 D:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6-->"D:\Program Files\Audacity\unins000.exe"
avast! Antivirus-->D:\Avast4\aswRunDll.exe "D:\Avast4\Setup\setiface.dll",RunSetup
BitComet 1.03-->D:\Program Files\BitComet\uninst.exe
BitTorrent S-5.8.11 (SHAD0W's Experimental)-->D:\Program Files\BitTorrent\uninst.exe
BrainWave Generator-->D:\WINDOWS\IsUninst.exe -f"D:\Program Files\BrainWave Generator\Uninst.isu"
Broadcom 802.11 Wireless LAN Adapter-->"D:\Program Files\Broadcom\Broadcom 802.11\Driver\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="D:\Program Files\Broadcom\Broadcom 802.11\Driver"
Broadcom NetXtreme Ethernet Controller-->MsiExec.exe /X{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}
Burn4Free CD and DVD-->"D:\Program Files\Burn4Free\uninstall.exe"
Catalyst Control Center - Branding-->MsiExec.exe /I{3F93B2BA-18EC-462B-9ACD-396599353EE1}
CCleaner (remove only)-->"D:\Program Files\CCleaner\uninst.exe"
CDisplay 1.8-->"D:\Program Files\CDisplay\unins000.exe"
Convert Doc-->"D:\Program Files\Softinterface, Inc\Convert Doc\unins000.exe"
DivX Content Uploader-->D:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player-->D:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Gadu-Gadu 7.7-->D:\Program Files\Gadu-Gadu\Setup.exe
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Gmail Notifier-->"D:\Program Files\Google\Gmail Notifier\UninstallGmail.exe"
Google Updater-->"D:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
HijackThis 2.0.2-->"D:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Broadband Wireless Modules-->MsiExec.exe /X{773D6C77-4A5A-45C4-B4DE-3B6DAB4785BC}
HP Wireless Assistant-->MsiExec.exe /I{6FE30813-AC60-40A3-BE53-F6713A1F3893}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
LADSPA_plugins-win-0.4.15-->"D:\Program Files\Audacity\Plug-Ins\unins000.exe"
Macromedia Dreamweaver 8-->MsiExec.exe /I{0837A661-FEC3-48B3-876C-91E7D32048A9}
Macromedia Extension Manager-->MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"D:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual J# .NET Redistributable Package 1.1-->MsiExec.exe /X{1A655D51-1423-48A3-B748-8F5A0BE294C8}
Mozilla Firefox (3.0.7)-->D:\Program Files\Mozilla Firefox\uninstall\helper.exe
MultiRes (remove only)-->D:\Program Files\MultiRes\uninstal.exe
NAPIPROJEKT 1.0.6.0-->"D:\Program Files\NAPI-PROJEKT\unins000.exe"
Nero Suite-->D:\Program Files\Common Files\Nero\Uninstall\setupx.exe /uninstall ExtraUninstallID=""
NET Installation Assistance for VB6 App (Runtime Only)-->MsiExec.exe /I{66333C41-085E-4DA1-8273-E2BCA382D766}
OpenOffice.org 3.0-->MsiExec.exe /I{31BFEC6C-1F27-45B5-839C-BCBAE327993A}
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Port Detective-->D:\WINDOWS\iun6002.exe "D:\Program Files\Port Detective\irunin.ini"
PowerQuest DataKeeper 5.0-->D:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6C7D45F8-050B-4BF6-835A-01D8C5A48F10}
PowerQuest PartitionMagic 8.0-->D:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}
QuickTime Alternative 1.77-->"D:\Program Files\QuickTime Alternative\unins000.exe"
Radeon Omega Drivers v3.8.421 Setup Files and Tools-->"D:\WINDOWS\Radeon Omega Drivers v3.8.421 Uninstall.exe" "/U:D:\Program Files\Radeon Omega Drivers\v3.8.421\Omega Uninstall.xml"
Real Alternative 1.51-->"D:\Program Files\Real Alternative\unins000.exe"
Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SoulSeek Client 156c-->"D:\Program Files\Soulseek\uninstall.exe"
SoulSeek Client 157 test 12b-->"D:\Program Files\Soulseek-Test\uninstall.exe"
SoundMAX-->RunDll32 D:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe" -l0x15 -removeonly
Spybot - Search & Destroy-->"D:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Doctor 5.5-->D:\Program Files\Spyware Doctor\unins000.exe /LOG
SubEdit-Player-->"D:\Program Files\SubEdit-Player\unins000.exe"
Sunbelt Personal Firewall-->MsiExec.exe /X{BFD080F6-3BF0-40E1-9507-9CA969C35870}
SUPER © Version 2008.bld.25 (Feb 5, 2008)-->D:\SUPERE~1\Setup.exe /remove /q0
System Requirements Lab-->D:\Program Files\SystemRequirementsLab\Uninstall.exe
VideoLAN VLC media player 0.8.6b-->D:\Program Files\VideoLAN\VLC\uninstall.exe
WinAlarm (remove only)-->"D:\Program Files\Winamp\uninst-winalarm.exe"
Winamp-->"D:\Program Files\Winamp\UninstWA.exe"
Windows Installer 3.1 (KB893803)-->"D:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
WinISO 5.3-->"D:\Program Files\WinISO\unins000.exe"
WinRAR archiver-->D:\Program Files\WinRAR\uninstall.exe
xp-AntiSpy 3.96-6-->D:\Program Files\xp-AntiSpy\Uninstall.exe
=====HijackThis Backups=====
O4 - HKLM\..\Run: [Barsaka] explorer.exe
======Hosts File======
127.0.0.1 localhost
======Security center information======
AV: avast! antivirus 4.8.1335 [VPS 090311-0]
FW: Sunbelt Personal Firewall
System event log
Computer Name: VIDOL-1A2350CA3
Event Code: 4202
Message: The system detected that network adapter Broadcom 802.11b/g WLAN - Packet Scheduler Miniport was disconnected from the network,
and the adapter's network configuration has been released. If the network
adapter was not disconnected, this may indicate that it has malfunctioned.
Please contact your vendor for updated drivers.
Record Number: 21888
Source Name: Tcpip
Time Written: 20081016222517.000000+060
Event Type: information
User:
Computer Name: VIDOL-1A2350CA3
Event Code: 7036
Message: The IMAPI CD-Burning COM Service service entered the stopped state.
Record Number: 21887
Source Name: Service Control Manager
Time Written: 20081016204714.000000+060
Event Type: information
User:
Computer Name: VIDOL-1A2350CA3
Event Code: 7036
Message: The IMAPI CD-Burning COM Service service entered the running state.
Record Number: 21886
Source Name: Service Control Manager
Time Written: 20081016204708.000000+060
Event Type: information
User:
Computer Name: VIDOL-1A2350CA3
Event Code: 7035
Message: The IMAPI CD-Burning COM Service service was successfully sent a start control.
Record Number: 21885
Source Name: Service Control Manager
Time Written: 20081016204708.000000+060
Event Type: information
User: NT AUTHORITY\SYSTEM
Computer Name: VIDOL-1A2350CA3
Event Code: 51
Message: An error was detected on device \Device\Harddisk1\D during a paging operation.
Record Number: 21884
Source Name: Disk
Time Written: 20081016194002.000000+060
Event Type: warning
User:
Application event log
Computer Name: VIDOL-1A2350CA3
Event Code: 1002
Message: The shell stopped unexpectedly and Explorer.exe was restarted.
Record Number: 1646
Source Name: Winlogon
Time Written: 20080404073318.000000+060
Event Type: information
User:
Computer Name: VIDOL-1A2350CA3
Event Code: 1800
Message: The Windows Security Center Service has started.
Record Number: 1645
Source Name: SecurityCenter
Time Written: 20080404072950.000000+060
Event Type: information
User:
Computer Name: VIDOL-1A2350CA3
Event Code: 0
Message:
Record Number: 1644
Source Name: SWIHPWMI
Time Written: 20080404072950.000000+060
Event Type: information
User:
Computer Name: VIDOL-1A2350CA3
Event Code: 4
Message: The LightScribe Service started successfully.
Record Number: 1643
Source Name: LightScribeService
Time Written: 20080404072947.000000+060
Event Type: information
User:
Computer Name: VIDOL-1A2350CA3
Event Code: 0
Message:
Record Number: 1642
Source Name: HDDlife HDD Access service
Time Written: 20080404072947.000000+060
Event Type: information
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;d:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 104 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=6801
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
- Kod: Zaznacz wszystko
DDS (Ver_09-10-13.01) - NTFSx86
Run by autovidol at 10:35:48,78 on 2009-10-16
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_05
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1033.18.1919.1183 [GMT 1:00]
AV: avast! antivirus 4.8.1335 [VPS 091015-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sunbelt Personal Firewall *enabled* {BFD080F6-3BF0-40E1-9507-9CA969C35870}
============== Running Processes ===============
D:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
D:\WINDOWS\System32\svchost.exe -k netsvcs
D:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
D:\Avast4\aswUpdSv.exe
D:\Avast4\ashServ.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
D:\Program Files\Analog Devices\Core\smax4pnp.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\Avast4\ashDisp.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\LightScribe\LSSrvc.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
D:\WINDOWS\system32\svchost.exe -k imgsvc
D:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
D:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\Avast4\ashMaiSv.exe
D:\Avast4\ashWebSv.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
D:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\downloady\dds.scr
============== Pseudo HJT Report ===============
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - d:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - d:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
TB: {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - No File
uRun: [ccleaner] "d:\program files\ccleaner\CCleaner.exe" /AUTO
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [SoundMAXPnP] d:\program files\analog devices\core\smax4pnp.exe
mRun: [SoundMAX] d:\program files\analog devices\soundmax\Smax4.exe /tray
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] d:\program files\google\gmail notifier\gnotify.exe
mRun: [avast!] d:\avast4\ashDisp.exe
mRun: [ISUSScheduler] "d:\program files\common files\installshield\updateservice\issch.exe" -start
dRun: [CTFMON.EXE] d:\windows\system32\CTFMON.EXE
dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32
uPolicies-system: RunStartupScriptSync = 1 (0x1)
mPolicies-system: RunStartupScriptSync = 1 (0x1)
IE: E&xport to Microsoft Excel - d:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - d:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\wpdshserviceobj.dll
================= FIREFOX ===================
FF - ProfilePath -
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
============= SERVICES / DRIVERS ===============
R1 aswSP;avast! Self Protection;d:\windows\system32\drivers\aswSP.sys [2008-4-2 114768]
R1 fwdrv;Firewall Driver;d:\windows\system32\drivers\fwdrv.sys [2007-4-26 302000]
R1 khips;Kerio HIPS Driver;d:\windows\system32\drivers\khips.sys [2007-4-26 72624]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [2008-4-2 20560]
R2 SPF4;Sunbelt Personal Firewall 4;d:\program files\sunbelt software\personal firewall\kpf4ss.exe [2007-4-26 1234480]
R2 SWIHPWMI;SWIHPWMI;d:\program files\hpq\shared\sierra wireless\win32\unicode\SWIHPWMI.exe [2006-12-4 292384]
S2 PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;PowerQuest File System Monitor PQfsmonNT ABE675CA-49DF-11d3-93F6-00104B64D07B;\??\d:\program files\powerquest\datakeeper 5.0\pqfsmonnt.sys --> d:\program files\powerquest\datakeeper 5.0\PqFsmonNt.sys [?]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);d:\windows\system32\drivers\s115bus.sys [2007-4-23 83208]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);d:\windows\system32\drivers\s115mgmt.sys [2007-4-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;d:\windows\system32\drivers\s115obex.sys [2007-4-23 98568]
S3 sdAuxService;PC Tools Auxiliary Service;d:\program files\spyware doctor\pctsAuxs.exe [2008-4-20 747912]
=============== Created Last 30 ================
2009-10-13 11:52 <DIR> --d----- d:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
==================== Find3M ====================
2009-10-16 10:31 122,085 a------- d:\windows\system32\drivers\fwdrv.err
2008-08-10 12:57 32 a------- d:\docume~1\alluse~1\applic~1\ezsid.dat
2009-05-22 23:02 32,768 a--sh--- d:\windows\system32\config\systemprofile\cookies\index.dat
2009-05-22 23:02 32,768 a--sh--- d:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2007-10-16 09:59 32,768 a--sh--- d:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012007101620071017\index.dat
2009-05-22 23:02 32,768 a--sh--- d:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat
============= FINISH: 10:36:57,59 ===============
