Zawieszanie systemu

**Posty:** 10 · przez **Angare** 02 Kwi 2009, 09:50

Witam,
Ostatnio wolno coś mi chodzi system i zawiesza po ok 10-15 min. użytkowania.
Proszę o sprawdzenie loga.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:48:33, on 2009-04-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\Explorer.EXE D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Windows\serviceslogg.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Win2k ServicesLogg] C:\Windows\serviceslogg.exe O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: hpdj - HP - C:\DOCUME~1\Arek\USTAWI~1\Temp\hpdj.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5174 bytes

**Posty:** 8001 · przez **Okocza** 02 Kwi 2009, 13:29

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 10 · przez **Angare** 02 Kwi 2009, 15:43

SDix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Arek on 2009-04-02 at 14:33 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\Temp\bca4e2da.$$$ - Deleted C:\WINDOWS\Temp\ed47fa.$ - Deleted C:\WINDOWS\Temp\fa56d7ec.$$$ - Deleted [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/mbr.exe]MBR Rootkit Detector[/url] by Gmer[/color] Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-02 14:38:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:f6c0a369 "s2"=dword:10c4b07a "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="d:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:a9,59,d4,b6,08,4e,3c,1d,22,9e,2a,3c,c7,16,28,dd,04,6c,04,37,08,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,ac,bb,9b,4e,9d,72,82,1a,8c,4a,8d,42,70,e8,db,6a,e2,.. "khjeh"=hex:0e,3b,62,1c,1c,e1,17,b5,f9,62,7a,77,7d,24,4d,e1,c2,74,91,35,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d1,f3,62,4f,90,c8,b2,73,13,45,0f,2e,ec,f0,0d,d0,70,f7,b3,56,50,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:3a,da,a1,02,e8,05,2e,a2,5e,19,ad,f8,17,84,1f,62,02,a4,59,1f,4e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="d:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:a9,59,d4,b6,08,4e,3c,1d,22,9e,2a,3c,c7,16,28,dd,04,6c,04,37,08,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,ac,bb,9b,4e,9d,72,82,1a,8c,4a,8d,42,70,e8,db,6a,e2,.. "khjeh"=hex:0e,3b,62,1c,1c,e1,17,b5,f9,62,7a,77,7d,24,4d,e1,c2,74,91,35,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d1,f3,62,4f,90,c8,b2,73,13,45,0f,2e,ec,f0,0d,d0,70,f7,b3,56,50,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:3a,da,a1,02,e8,05,2e,a2,5e,19,ad,f8,17,84,1f,62,02,a4,59,1f,4e,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\Program Files\\uTorrent\\uTorrent.exe"="D:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "D:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"="D:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe:*:Enabled:FIFA09" "D:\\Program Files\\totalcmd\\TOTALCMD.EXE"="D:\\Program Files\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "D:\\Program Files\\Gadu-Gadu\\gg.exe"="D:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "D:\\Program Files\\BearShare\\BearShare.exe"="D:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "D:\\Program Files\\Hamachi\\hamachi.exe"="D:\\Program Files\\Hamachi\\hamachi.exe:*:Enabled:Hamachi" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "D:\\Program Files\\SopCast\\SopCast.exe"="D:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application" "D:\\Program Files\\SopCast\\adv\\SopAdver.exe"="D:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver" "D:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"="D:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe:*:Enabled:Unreal Tournament 3" "C:\\WINDOWS\\pppp.exe"="C:\\WINDOWS\\pppp.exe:*:Enabled:pppp" "C:\\WINDOWS\\serviceslogg.exe"="C:\\WINDOWS\\serviceslogg.exe:*:Disabled:serviceslogg" "D:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"="D:\\Program Files\\Nowe Gadu-Gadu\\gg.exe:*:Enabled:Nowe Gadu-Gadu" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 3 Mar 2008 568 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg" Mon 3 Mar 2008 5,702 A..H. --- "C:\WINDOWS\nod32restoretemdono.reg" Wed 25 Feb 2009 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 2 Apr 2009 26,112 ...H. --- "C:\Documents and Settings\Arek\Pulpit\~WRL0005.tmp" [b]Finished![/b]

Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:39:01, on 2009-04-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\notepad.exe D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Windows\serviceslogg.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Arek\Pulpit\ComboFix.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Win2k ServicesLogg] C:\Windows\serviceslogg.exe O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Arek\USTAWI~1\Temp\hpdj.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5184 bytes

Combofix:

Kod: Zaznacz wszystko: ComboFix 09-04-01.01 - Arek 2009-04-02 15:41:29.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.3007.2491 [GMT 2:00] Uruchomiony z: c:\documents and settings\Arek\Pulpit\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-02 do 2009-04-02 ))))))))))))))))))))))))))))))) . 2009-04-02 14:31 . 2009-04-02 14:31 <DIR> d-------- c:\windows\ERUNT 2009-04-02 14:24 . 2009-04-02 14:24 <DIR> d-------- C:\SDFix 2009-04-02 09:48 . 2009-04-02 09:48 <DIR> d-------- c:\program files\Trend Micro 2009-04-01 22:27 . 2009-04-01 21:01 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-04-01 21:11 . 2009-04-01 21:11 <DIR> d-------- c:\documents and settings\LocalService\Pulpit 2009-04-01 21:01 . 2009-04-01 20:59 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-04-01 20:53 . 2009-04-01 20:53 <DIR> d--h-c--- c:\documents and settings\All Users\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-04-01 20:52 . 2009-04-01 20:52 <DIR> d-------- c:\program files\Lavasoft 2009-04-01 20:52 . 2009-04-01 21:01 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-03-15 20:47 . 2004-08-04 01:44 16,384 --a------ c:\windows\system32\ipsink.ax 2009-03-15 20:47 . 2004-08-04 01:44 16,384 --a--c--- c:\windows\system32\dllcache\ipsink.ax 2009-03-15 20:47 . 2004-08-04 00:10 15,360 --a------ c:\windows\system32\drivers\StreamIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 15,360 --a--c--- c:\windows\system32\dllcache\streamip.sys 2009-03-15 20:47 . 2004-08-04 00:10 11,136 --a------ c:\windows\system32\drivers\SLIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 11,136 --a--c--- c:\windows\system32\dllcache\slip.sys 2009-03-15 20:47 . 2004-08-04 00:10 10,880 --a------ c:\windows\system32\drivers\NdisIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 10,880 --a--c--- c:\windows\system32\dllcache\ndisip.sys 2009-03-15 20:47 . 2004-08-03 23:58 5,504 --a------ c:\windows\system32\drivers\MSTEE.sys 2009-03-15 20:47 . 2004-08-03 23:58 5,504 --a--c--- c:\windows\system32\dllcache\mstee.sys 2009-03-10 21:15 . 2009-03-10 21:15 <DIR> d-------- c:\program files\Opera 2009-03-07 14:42 . 2009-03-07 14:55 64 --a------ c:\windows\configspam.ini 2009-03-07 10:57 . 2009-03-10 12:41 <DIR> d-------- c:\program files\SkanerOnline . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-01 18:53 --------- d--h--w c:\program files\InstallShield Installation Information 2009-04-01 18:52 --------- d-----w c:\program files\Common Files\InstallShield 2009-04-01 18:44 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\uTorrent 2009-03-13 17:51 --------- d-----w c:\program files\Common Files\Adobe 2009-03-10 20:19 --------- d-----w c:\program files\Java 2009-02-28 19:49 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\BESTplayer 2009-02-22 19:53 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Hamachi 2009-02-15 11:43 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Nowe Gadu-Gadu 2009-02-14 19:10 --------- d-----w c:\program files\Sprytne Katalogowanie (demo) 2009-02-09 14:19 1,846,528 ----a-w c:\windows\system32\win32k.sys 2009-02-02 22:05 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Micro-Sys 2009-02-02 21:58 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Tonbrand 2009-01-17 12:29 410,984 ----a-w c:\windows\system32\deploytk.dll 2006-06-23 06:48 32,768 -c--a-r c:\windows\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-06-02 385024] "egui"="d:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-09 13529088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-09 86016] "Win2k ServicesLogg"="c:\windows\serviceslogg.exe" [2008-12-30 764928] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-01 515416] "nwiz"="nwiz.exe" [2008-05-09 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^Arek^Menu Start^Programy^Autostart^hamachi.lnk] path=c:\documents and settings\Arek\Menu Start\Programy\Autostart\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2009-02-27 18:10 35696 d:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 15:35 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2006-11-12 12:48 157592 d:\program files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-27 01:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a--c--- 2007-09-20 09:51 1836328 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2007-03-01 15:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2006-04-10 09:19 729088 c:\program files\Analog Devices\SoundMAX\SMax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] -ra--c--- 2006-05-01 12:07 843776 c:\program files\Analog Devices\Core\smax4pnp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2009-01-17 14:30 148888 c:\program files\Java\jre6\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"= "d:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "d:\\Program Files\\Gadu-Gadu\\gg.exe"= "d:\\Program Files\\BearShare\\BearShare.exe"= "d:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\Program Files\\SopCast\\SopCast.exe"= "d:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "d:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"= "c:\\WINDOWS\\pppp.exe"= "c:\\WINDOWS\\serviceslogg.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-04-01 64160] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800] R2 ekrn;Eset Service;d:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632] S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\PrawkoB.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0e93bd9-feb8-11d5-aa80-806d6172696f}] \Shell\AutoRun\command - F:\ASUSACPI.exe . Zawartość folderu 'Zaplanowane zadania' 2009-04-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-04-01 20:55] . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe MSConfigStartUp-Prec - d:\program files\Prec\PrecStarter.exe MSConfigStartUp-RivaTunerStartupDaemon - d:\program files\RivaTuner v2.11\RivaTuner.exe . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\ir7t49g0.default\ FF - plugin: c:\documents and settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\ir7t49g0.default\extensions\justintvpublisher@justin.tv\platform\WINNT_x86-msvc\plugins\npjustintvpublish.dll FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll FF - plugin: d:\program files\Real Alternative\browser\plugins\nppl3260.dll FF - plugin: d:\program files\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-02 15:42:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) "scansk"=hex(0):64,84,5a,c6,19,ae,d7,70,b8,43,41,cf,ec,03,59,93,ee,6e,5b,1c,77, 85,1b,b4,29,30,35,7b,96,de,45,df,ee,10,79,a1,95,40,28,54,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7c16fd06-349c-46a0-892b-bd0630081ffc}] @Denied: (Full) (Everyone) "Model"=dword:00000018 "Therad"=dword:0000001e "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\ . Czas ukończenia: 2009-04-02 15:42:59 ComboFix-quarantined-files.txt 2009-04-02 13:42:58 Przed: 18 574 229 504 bajtów wolnych Po: 18,566,631,424 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 180 --- E O F --- 2009-03-15 22:26:58

**Posty:** 8001 · przez **Okocza** 02 Kwi 2009, 15:47

1. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exe
3. dajesz loga z combofixa

Przenieś program mbr.exe bezpośrednio na C:\
nastepnie przejdz do trybu awaryjnego z z obsługą linii komend
w linii komend wpisz polecenie C:\mbr.exe -f (tam jest spacja między mbr.exe a -f) i ENTER
Reset komputera do trybu normalnego i robisz nowy log z mbr.exe

**Posty:** 10 · przez **Angare** 03 Kwi 2009, 08:31

Combofix:

Kod: Zaznacz wszystko: ComboFix 09-04-01.01 - Arek 2009-04-03 8:29:02.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.3007.2553 [GMT 2:00] Uruchomiony z: c:\documents and settings\Arek\Pulpit\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-03 do 2009-04-03 ))))))))))))))))))))))))))))))) . 2009-04-02 16:04 . 2009-04-02 16:04 <DIR> d-------- c:\documents and settings\Arek\DoctorWeb 2009-04-02 16:01 . 2009-04-02 16:01 66,048 --a------ C:\mbr.exe 2009-04-02 14:31 . 2009-04-02 14:31 <DIR> d-------- c:\windows\ERUNT 2009-04-02 14:24 . 2009-04-02 14:24 <DIR> d-------- C:\SDFix 2009-04-02 09:48 . 2009-04-02 09:48 <DIR> d-------- c:\program files\Trend Micro 2009-04-01 22:27 . 2009-04-01 21:01 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-04-01 21:11 . 2009-04-01 21:11 <DIR> d-------- c:\documents and settings\LocalService\Pulpit 2009-04-01 21:01 . 2009-04-01 20:59 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-04-01 20:53 . 2009-04-01 20:53 <DIR> d--h-c--- c:\documents and settings\All Users\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-04-01 20:52 . 2009-04-01 20:52 <DIR> d-------- c:\program files\Lavasoft 2009-04-01 20:52 . 2009-04-01 21:01 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-03-15 20:47 . 2004-08-04 01:44 16,384 --a------ c:\windows\system32\ipsink.ax 2009-03-15 20:47 . 2004-08-04 01:44 16,384 --a--c--- c:\windows\system32\dllcache\ipsink.ax 2009-03-15 20:47 . 2004-08-04 00:10 15,360 --a------ c:\windows\system32\drivers\StreamIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 15,360 --a--c--- c:\windows\system32\dllcache\streamip.sys 2009-03-15 20:47 . 2004-08-04 00:10 11,136 --a------ c:\windows\system32\drivers\SLIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 11,136 --a--c--- c:\windows\system32\dllcache\slip.sys 2009-03-15 20:47 . 2004-08-04 00:10 10,880 --a------ c:\windows\system32\drivers\NdisIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 10,880 --a--c--- c:\windows\system32\dllcache\ndisip.sys 2009-03-15 20:47 . 2004-08-03 23:58 5,504 --a------ c:\windows\system32\drivers\MSTEE.sys 2009-03-15 20:47 . 2004-08-03 23:58 5,504 --a--c--- c:\windows\system32\dllcache\mstee.sys 2009-03-10 21:15 . 2009-03-10 21:15 <DIR> d-------- c:\program files\Opera 2009-03-07 14:42 . 2009-03-07 14:55 64 --a------ c:\windows\configspam.ini 2009-03-07 10:57 . 2009-03-10 12:41 <DIR> d-------- c:\program files\SkanerOnline . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-01 18:53 --------- d--h--w c:\program files\InstallShield Installation Information 2009-04-01 18:52 --------- d-----w c:\program files\Common Files\InstallShield 2009-04-01 18:44 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\uTorrent 2009-03-13 17:51 --------- d-----w c:\program files\Common Files\Adobe 2009-03-10 20:19 --------- d-----w c:\program files\Java 2009-02-28 19:49 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\BESTplayer 2009-02-22 19:53 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Hamachi 2009-02-15 11:43 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Nowe Gadu-Gadu 2009-02-14 19:10 --------- d-----w c:\program files\Sprytne Katalogowanie (demo) 2009-02-09 14:19 1,846,528 ----a-w c:\windows\system32\win32k.sys 2009-01-17 12:29 410,984 ----a-w c:\windows\system32\deploytk.dll 2006-06-23 06:48 32,768 -c--a-r c:\windows\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((( SnapShot@2009-04-02_15.42.23,87 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-03 06:26:54 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_27c.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-06-02 385024] "egui"="d:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-09 13529088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-09 86016] "Win2k ServicesLogg"="c:\windows\serviceslogg.exe" [2008-12-30 764928] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-01 515416] "nwiz"="nwiz.exe" [2008-05-09 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^Arek^Menu Start^Programy^Autostart^hamachi.lnk] path=c:\documents and settings\Arek\Menu Start\Programy\Autostart\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2009-02-27 18:10 35696 d:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 15:35 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2006-11-12 12:48 157592 d:\program files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-27 01:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a--c--- 2007-09-20 09:51 1836328 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2007-03-01 15:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2006-04-10 09:19 729088 c:\program files\Analog Devices\SoundMAX\SMax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] -ra--c--- 2006-05-01 12:07 843776 c:\program files\Analog Devices\Core\smax4pnp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2009-01-17 14:30 148888 c:\program files\Java\jre6\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"= "d:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "d:\\Program Files\\Gadu-Gadu\\gg.exe"= "d:\\Program Files\\BearShare\\BearShare.exe"= "d:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\Program Files\\SopCast\\SopCast.exe"= "d:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "d:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"= "c:\\WINDOWS\\pppp.exe"= "c:\\WINDOWS\\serviceslogg.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-04-01 64160] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800] R2 ekrn;Eset Service;d:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632] S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\PrawkoB.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0e93bd9-feb8-11d5-aa80-806d6172696f}] \Shell\AutoRun\command - F:\ASUSACPI.exe . Zawartość folderu 'Zaplanowane zadania' 2009-04-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-04-01 20:55] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\ir7t49g0.default\ FF - plugin: c:\documents and settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\ir7t49g0.default\extensions\justintvpublisher@justin.tv\platform\WINNT_x86-msvc\plugins\npjustintvpublish.dll FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll FF - plugin: d:\program files\Real Alternative\browser\plugins\nppl3260.dll FF - plugin: d:\program files\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-03 08:29:49 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) "scansk"=hex(0):64,84,5a,c6,19,ae,d7,70,b8,43,41,cf,ec,03,59,93,ee,6e,5b,1c,77, 85,1b,b4,29,30,35,7b,96,de,45,df,ee,10,79,a1,95,40,28,54,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7c16fd06-349c-46a0-892b-bd0630081ffc}] @Denied: (Full) (Everyone) "Model"=dword:00000018 "Therad"=dword:0000001e "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\ . Czas ukończenia: 2009-04-03 8:30:40 ComboFix-quarantined-files.txt 2009-04-03 06:30:38 ComboFix2.txt 2009-04-02 13:43:00 Przed: 18 418 319 360 bajtów wolnych Po: 18,484,703,232 bajtów wolnych 172 --- E O F --- 2009-03-15 22:26:58

**Posty:** 18165 · przez **wojtas** 03 Kwi 2009, 19:00

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef. rowniez robisz skan mbr.exe i tez dajesz z niego loga...

**Posty:** 10 · przez **Angare** 04 Kwi 2009, 12:56

FixIEDef:

Kod: Zaznacz wszystko: !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

System nadal się zawiesza

**Posty:** 18165 · przez **wojtas** 04 Kwi 2009, 14:05

wykonaj co kazałem do końca.. brak nowego loga , raportu :-|

**Posty:** 10 · przez **Angare** 04 Kwi 2009, 14:14

wojtas napisał(a):wykonaj co kazałem do końca.. brak nowego loga , raportu

Ze skanem antywirusem mam problem, ponieważ kilka razy podjąłem próbę skanu, jednak w trakcie komputer się zawiesił, raz się udało do końca przeskanować system, antywirus nic nie wykrył, jak już chciałem dać raport na forum, to system się znów zawiesił.

**Posty:** 18165 · przez **wojtas** 04 Kwi 2009, 14:24

to daj nowego loga z combofixa i mbr.exe

**Posty:** 10 · przez **Angare** 04 Kwi 2009, 14:57

Combofix

Kod: Zaznacz wszystko: ComboFix 09-04-03.01 - Arek 2009-04-04 14:33:50.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.3007.2500 [GMT 2:00] Uruchomiony z: c:\documents and settings\Arek\Pulpit\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-04 do 2009-04-04 ))))))))))))))))))))))))))))))) . 2009-04-04 12:54 . 2009-04-04 12:54 <DIR> d-------- C:\ERDNT 2009-04-04 12:54 . 2009-04-04 12:54 <DIR> d-------- C:\!FixIEDef 2009-04-04 11:23 . 2009-04-04 11:23 <DIR> d---s---- c:\documents and settings\Arek\UserData 2009-04-02 16:04 . 2009-04-02 16:04 <DIR> d-------- c:\documents and settings\Arek\DoctorWeb 2009-04-02 14:31 . 2009-04-03 21:33 <DIR> d-------- c:\windows\ERUNT 2009-04-02 09:48 . 2009-04-02 09:48 <DIR> d-------- c:\program files\Trend Micro 2009-04-01 21:11 . 2009-04-01 21:11 <DIR> d-------- c:\documents and settings\LocalService\Pulpit 2009-04-01 20:52 . 2009-04-01 20:52 <DIR> d-------- c:\program files\Lavasoft 2009-04-01 20:52 . 2009-04-03 09:48 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-03-15 20:47 . 2004-08-04 01:44 16,384 --a------ c:\windows\system32\ipsink.ax 2009-03-15 20:47 . 2004-08-04 01:44 16,384 --a--c--- c:\windows\system32\dllcache\ipsink.ax 2009-03-15 20:47 . 2004-08-04 00:10 15,360 --a------ c:\windows\system32\drivers\StreamIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 15,360 --a--c--- c:\windows\system32\dllcache\streamip.sys 2009-03-15 20:47 . 2004-08-04 00:10 11,136 --a------ c:\windows\system32\drivers\SLIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 11,136 --a--c--- c:\windows\system32\dllcache\slip.sys 2009-03-15 20:47 . 2004-08-04 00:10 10,880 --a------ c:\windows\system32\drivers\NdisIP.sys 2009-03-15 20:47 . 2004-08-04 00:10 10,880 --a--c--- c:\windows\system32\dllcache\ndisip.sys 2009-03-15 20:47 . 2004-08-03 23:58 5,504 --a------ c:\windows\system32\drivers\MSTEE.sys 2009-03-15 20:47 . 2004-08-03 23:58 5,504 --a--c--- c:\windows\system32\dllcache\mstee.sys 2009-03-10 21:15 . 2009-03-10 21:15 <DIR> d-------- c:\program files\Opera 2009-03-07 14:42 . 2009-03-07 14:55 64 --a------ c:\windows\configspam.ini 2009-03-07 10:57 . 2009-03-10 12:41 <DIR> d-------- c:\program files\SkanerOnline . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-04 12:32 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\uTorrent 2009-04-04 10:42 --------- d--h--w c:\program files\InstallShield Installation Information 2009-04-04 10:42 --------- d-----w c:\program files\Common Files\InstallShield 2009-03-13 17:51 --------- d-----w c:\program files\Common Files\Adobe 2009-03-10 20:19 --------- d-----w c:\program files\Java 2009-02-28 19:49 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\BESTplayer 2009-02-22 19:53 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Hamachi 2009-02-15 11:43 --------- d-----w c:\documents and settings\Arek\Dane aplikacji\Nowe Gadu-Gadu 2009-02-14 19:10 --------- d-----w c:\program files\Sprytne Katalogowanie (demo) 2009-02-09 14:19 1,846,528 ----a-w c:\windows\system32\win32k.sys 2009-01-17 12:29 410,984 ----a-w c:\windows\system32\deploytk.dll 2006-06-23 06:48 32,768 -c--a-r c:\windows\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Odkurzacz-MCD"="d:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-06-02 385024] "egui"="d:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-09 13529088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-09 86016] "Win2k ServicesLogg"="c:\windows\serviceslogg.exe" [2008-12-30 764928] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm "VIDC.ACDV"= ACDV.dll [HKLM\~\startupfolder\C:^Documents and Settings^Arek^Menu Start^Programy^Autostart^hamachi.lnk] path=c:\documents and settings\Arek\Menu Start\Programy\Autostart\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2009-02-27 18:10 35696 d:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 15:35 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2006-11-12 12:48 157592 d:\program files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a--c--- 2006-10-27 01:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a--c--- 2007-09-20 09:51 1836328 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2007-03-01 15:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2006-04-10 09:19 729088 c:\program files\Analog Devices\SoundMAX\SMax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] -ra--c--- 2006-05-01 12:07 843776 c:\program files\Analog Devices\Core\smax4pnp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2009-01-17 14:30 148888 c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-05-09 04:56 1630208 c:\windows\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"= "d:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "d:\\Program Files\\Gadu-Gadu\\gg.exe"= "d:\\Program Files\\BearShare\\BearShare.exe"= "d:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\Program Files\\SopCast\\SopCast.exe"= "d:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "d:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"= "c:\\WINDOWS\\pppp.exe"= "c:\\WINDOWS\\serviceslogg.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800] R2 ekrn;Eset Service;d:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320] S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0e93bd9-feb8-11d5-aa80-806d6172696f}] \Shell\AutoRun\command - F:\ASUSACPI.exe . Zawartość folderu 'Zaplanowane zadania' 2009-04-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [] . . ------- Skan uzupełniający ------- . uInternet Settings,ProxyOverride = *.local IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\ir7t49g0.default\ FF - plugin: c:\documents and settings\Arek\Dane aplikacji\Mozilla\Firefox\Profiles\ir7t49g0.default\extensions\justintvpublisher@justin.tv\platform\WINNT_x86-msvc\plugins\npjustintvpublish.dll FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll FF - plugin: d:\program files\Real Alternative\browser\plugins\nppl3260.dll FF - plugin: d:\program files\Real Alternative\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-04 14:34:28 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) "scansk"=hex(0):64,84,5a,c6,19,ae,d7,70,b8,43,41,cf,ec,03,59,93,ee,6e,5b,1c,77, 85,1b,b4,29,30,35,7b,96,de,45,df,ee,10,79,a1,95,40,28,54,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7c16fd06-349c-46a0-892b-bd0630081ffc}] @Denied: (Full) (Everyone) "Model"=dword:00000018 "Therad"=dword:0000001e "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\ . Czas ukończenia: 2009-04-04 14:35:18 ComboFix-quarantined-files.txt 2009-04-04 12:35:14 Przed: 20 544 827 392 bajtów wolnych Po: 20,535,803,904 bajtów wolnych 160 --- E O F --- 2009-03-15 22:26:58

Coś mbr.exe nie chciało mi odpalić, zrobiłem wszystko tak jak w opisie.

**Posty:** 18165 · przez **wojtas** 04 Kwi 2009, 18:31

już nic nie ma... ale dla pewnosci zastosuj jeszcze raz sdfixa i daj z niego raport

**Posty:** 10 · przez **Angare** 06 Kwi 2009, 21:11

Niestety nadal problem występuje. Po kilku minutach aktywności systemu, nagle komputer się zawiesza i słychać tylko pisk z głośników.

**Posty:** 18165 · przez **wojtas** 06 Kwi 2009, 21:29

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Win2k ServicesLogg"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru.... i juz nic wiecej nie widac

Autor postu otrzymał pochwałę

**Posty:** 10 · przez **Angare** 06 Kwi 2009, 23:29

Dalej mi się zawiesza system, tylko tym razem bez odgłosu z głośników.

**Posty:** 18165 · przez **wojtas** 07 Kwi 2009, 18:56

włóż płytkę windowsa - zbootuj ją. wejdź do konsoli odzyskiwania i w niej wpisz

chkdsk /r

gdzie x to litera partycji systemowej.

**Posty:** 10 · przez **Angare** 11 Kwi 2009, 11:17

Nic niestety to nie pomogło, chyba będę musiał zrobić formata.