Prosze o spr. logów(bluescreen,problem ze sciaganiem plikow)

**Posty:** 5 · przez **kompot** 09 Gru 2008, 03:24

Witam.
Proszę o sprawdzenie logów, mój komputer to XP Home z SP2. Wcześniej miałem ESET SMart Security, teraz darmowe avast, ad-aware plus Zone Alarm.
Pełna lista problemów:
-wyskakujący bluescreen przy przeglądaniu www, nie widzę tu żadnej prawidłowości, blogi, podstrony wp.pl, różne fora internetowe
-wiele komunikatow o tym, że plik jest uszkodzony lub nie nadaje się do odczytu i mam użyć CHKDSK(gdy uruchamiam chkdsk.exe /f nie moze on zablokowac dysku/woluminu, po restarcie rowniez)
-nie moge zapisywać plików na dysk-"żądana witryna jest niedostepna lub nie można jej znależć", jedyne co mi pozostaje to przez Firefoxa. Zwykle korzystam z Maxthona i przy tym chciałbym zostać
-nie odpalają mi się ostatnio filmiki np. na Youtube(nie tylko), mimo przejścia przez wszystkie kroki w poradnikach dot. odpalania tych filmików, flash, activeX, wszystko jest zainstalowane świeże
-zawsze po restarcie muszę recznie odpalać pasek szybkiego uruchamiania, a ikony są zresetowane pod względem alfabetycznym(ten problem akurat mam od bardzo dawna i chyba nie jest zwiazany z powyzszymi)

Log z Combofixa ma ok. 400 stron. Jak go w takim razie umieścić?

Dołaczam log z HJT.

HJT

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:33:23, on 2008-12-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\ASWLSVC.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtDetectSc.exe C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtFlashSwitch.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe C:\WINDOWS\system32\ASWL2K.exe C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe C:\WINDOWS\system32\UAService7.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\WapSter\WapSter AQQ\AQQ.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\VersalSoft\InternetDownload\InternetDownload.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: E-Zsoft VideoDownloaderToolBar - {4322A444-92F8-4C3E-BD4C-013BA51E2871} - C:\Program Files\VersalSoft\InternetDownload\VDTB.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: E-Zsoft VideoDownloaderToolBar - {4322A444-92F8-4C3E-BD4C-013BA51E2871} - C:\Program Files\VersalSoft\InternetDownload\VDTB.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InternetDownload_upgrade] "C:\Program Files\VersalSoft\InternetDownload\InternetDownload.exe" /upgrade O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present O8 - Extra context menu item: Download by VersalSoft Internet Download - C:\Program Files\VersalSoft\InternetDownload\adddownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O15 - Trusted Zone: http://www.mks.com.pl O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Eset HTTP Server (EHttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (file missing) O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing) O23 - Service: GtDetectSc Service (GtDetectSc) - OptionNV - C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtDetectSc.exe O23 - Service: GtFlashSwitch Service (GtFlashSwitch) - Option - C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtFlashSwitch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe -- End of file - 8184 bytes

Pozdrawiam i bardzo prosze o pomoc.
Jeśli potrzeba jakiś dodatkowych informacji odpowiem w miare mozliwości(nie jestem specem jak widać).

**Posty:** 8001 · przez **Okocza** 09 Gru 2008, 11:16

kompot napisał(a):wyskakujący bluescreen przy przeglądaniu www, nie widzę tu żadnej prawidłowości, blogi, podstrony wp.pl, różne fora internetowe

Prawym na ,,Mój komputer">właściwości>Zakładka "Zaawansowane" -> Uruchamianie i odzyskiwanie i klikamy "ustawienia">
w części "Awaria systemu" odznaczamy pole "Automatycznie uruchom ponownie"

-----------------------------

teraz zamiast resetu pojawi sie bluescreen przepisz kod bledu z dolu strony bluescreena

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

----------------------------

kompot napisał(a):ESET SMart Security, teraz darmowe avast, ad-aware plus Zone Alarm.

ESET'owski antywir jest skuteczniejszy, nie potrzebnie zamieniałeś.

Autor postu otrzymał pochwałę

**Posty:** 5 · przez **kompot** 09 Gru 2008, 18:01

Witam i dziękuję za zainteresowanie.
Co do bluescreena, nie pojawił się, mogę najwyżej podać z pamięci, bo zwróciłem na to uwagę, ale pewny nie jestem, szczególnie ostaniego:
0x00000000
0x00000002
0x00000008
0x0000000F

Niektórych uszkodzonych plików nie mogę usunąć nawet KillBoxem, co mogę z tym fantem zrobić?

Jeśli mówisz, że ESET antivir jest skuteczniejszy, to wróce do niego na pewno, w ogóle nie zamula komputera. Rozumiem, że to zamiast Avasta i ew. Zone Alarm.

Logi:

SDFix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2008-12-09 at 16:38 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-09 16:49:04 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 4 Aug 2004 4,639 ..SH. --- "C:\Program Files\Windows Media Player\mplayer2.exe" Fri 28 Jan 2005 73,728 ..SH. --- "C:\Program Files\Windows Media Player\wmplayer.exe" Mon 23 Jun 2008 625,664 ..SH. --- "C:\Program Files\Internet Explorer\iexplore.exe" Fri 30 May 2008 200,704 A..H. --- "C:\Program Files\iPlus\tools.exe" Sat 14 Jan 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 28 Jun 2008 26,112 ...H. --- "C:\Documents and Settings\Patryk\Pulpit\~WRL0570.tmp" Sun 29 Oct 2006 444 ...HR --- "C:\Documents and Settings\All Users\Dane aplikacji\SecuROM\UserData\securom_v7_01G.bak" Sun 21 Oct 2007 24,064 ...H. --- "C:\Documents and Settings\Patryk\Moje dokumenty\docs\BMG\~WRL0001.tmp" [b]Finished![/b]

Combofix:

Kod: Zaznacz wszystko: ComboFix 08-12-07.04 - Patryk 2008-12-09 16:51:26.9 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.792 [GMT 1:00] Uruchomiony z: c:\documents and settings\Patryk\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-09 do 2008-12-09 ))))))))))))))))))))))))))))))) . 2008-12-09 16:35 . 2008-12-09 16:35 <DIR> d-------- c:\windows\ERUNT 2008-12-09 16:34 . 2005-09-10 09:12 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS 2008-12-09 16:34 . 2005-09-10 08:54 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2008-12-09 16:34 . 2005-09-10 09:18 <DIR> dr------- c:\documents and settings\Administrator\Ulubione 2008-12-09 16:34 . 2005-09-10 08:54 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2008-12-09 16:34 . 2005-09-10 08:54 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2008-12-09 16:34 . 2005-09-10 09:18 <DIR> dr------- c:\documents and settings\Administrator\Moje dokumenty 2008-12-09 16:34 . 2005-09-10 08:54 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2008-12-09 16:34 . 2005-09-10 09:20 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji\Symantec 2008-12-09 16:34 . 2005-09-10 08:54 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2008-12-09 16:34 . 2008-12-09 16:34 <DIR> d-------- c:\documents and settings\Administrator 2008-12-09 16:28 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix 2008-12-09 10:52 . 2008-12-09 10:52 <DIR> d-------- c:\documents and settings\Patryk\Dane aplikacji\The Bat! 2008-12-09 01:38 . 2008-12-09 01:38 <DIR> d-------- C:\!KillBox 2008-12-09 01:33 . 2008-12-09 01:33 <DIR> d-------- c:\program files\Trend Micro 2008-12-09 01:07 . 2008-12-09 01:08 <DIR> d-------- C:\MxDownload 2008-12-09 01:07 . 2008-12-09 01:07 0 --a------ c:\windows\system32\cid_store.dat 2008-12-09 01:06 . 2008-12-09 01:06 <DIR> d-------- C:\VersalSoft 2008-12-09 01:05 . 2008-12-09 01:06 <DIR> d-------- c:\program files\VersalSoft 2008-12-09 01:05 . 2008-12-09 01:05 <DIR> d-------- c:\program files\Universal 2008-11-29 19:26 . 2008-12-09 16:32 32 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-11-29 19:26 . 2008-12-09 16:32 32 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-11-29 19:21 . 2008-11-29 19:21 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\MailFrontier 2008-11-29 19:21 . 2008-07-09 09:05 75,248 --a------ c:\windows\zllsputility.exe 2008-11-29 19:21 . 2004-04-27 04:40 11,264 --a------ c:\windows\system32\SpOrder.dll 2008-11-29 19:19 . 2008-11-29 19:19 <DIR> d-------- c:\windows\system32\ZoneLabs 2008-11-29 19:19 . 2008-11-29 19:19 <DIR> d-------- c:\windows\Internet Logs 2008-11-29 19:19 . 2008-11-29 19:19 <DIR> d-------- c:\program files\Zone Labs 2008-11-29 19:19 . 2008-07-09 09:05 1,086,952 --a------ c:\windows\system32\zpeng24.dll 2008-11-29 18:53 . 2008-11-29 19:14 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-29 18:15 . 2008-11-29 18:15 <DIR> d-------- c:\program files\Alwil Software 2008-11-29 16:28 . 2008-11-29 16:28 <DIR> d-------- c:\program files\Sunbelt Software 2008-11-29 16:22 . 2008-11-29 16:22 <DIR> d-------- c:\program files\Lavasoft 2008-11-29 16:22 . 2008-11-29 16:22 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2008-11-29 14:35 . 2008-11-29 14:35 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Yahoo! Companion 2008-11-26 20:33 . 2008-11-26 20:33 <DIR> d-------- c:\program files\TuneUp Utilities 2008 2008-11-26 20:33 . 2008-11-26 20:33 <DIR> d-------- c:\documents and settings\Patryk\Dane aplikacji\TuneUp Software 2008-11-26 20:33 . 2008-11-26 20:33 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\TuneUp Software 2008-11-26 20:33 . 2008-11-26 20:33 306,432 --a------ c:\windows\system32\TuneUpDefragService.exe 2008-11-26 20:33 . 2007-12-20 10:41 29,440 --a------ c:\windows\system32\uxtuneup.dll 2008-11-26 20:32 . 2008-11-26 20:32 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-26 20:21 . 2008-11-26 20:21 <DIR> d-------- c:\program files\Yahoo! 2008-11-26 20:04 . 2008-11-26 20:05 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\AVS4YOU 2008-11-24 21:53 . 2008-11-24 21:53 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\NCH Software 2008-11-24 21:52 . 2008-11-24 21:52 <DIR> d-------- c:\program files\NCH Software 2008-11-24 21:52 . 2008-11-24 21:52 <DIR> d-------- c:\documents and settings\Patryk\Dane aplikacji\NCH Swift Sound 2008-11-24 21:52 . 2008-11-24 21:52 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound 2008-11-24 21:51 . 2008-11-24 21:51 <DIR> d-------- c:\program files\NCH Swift Sound 2008-11-21 20:54 . 2008-11-21 20:54 <DIR> d-------- c:\program files\Common Files\AVSMedia 2008-11-21 20:54 . 2008-11-21 20:54 <DIR> d-------- c:\program files\AVS4YOU 2008-11-21 20:54 . 2007-09-27 15:22 524,288 --a------ c:\windows\system32\xvidcore.dll 2008-11-21 20:54 . 2007-09-27 15:22 261,632 --a------ c:\windows\system32\mcdvd_32.dll 2008-11-21 20:54 . 2003-05-22 00:50 156,910 --a------ c:\windows\WMSysPr8.prx 2008-11-21 20:54 . 2007-09-27 15:22 139,264 --a------ c:\windows\system32\xvidvfw.dll 2008-11-21 20:54 . 2003-03-25 06:49 98,304 --a------ c:\windows\system32\L3CODECX.AX 2008-11-21 20:54 . 2003-05-22 00:50 82,944 --a------ c:\windows\system32\vct3216.acm 2008-11-21 20:54 . 2004-09-06 17:06 53,248 --a------ c:\windows\system32\xvid.ax 2008-11-21 20:54 . 2003-05-22 00:50 38,912 --a------ c:\windows\system32\alf2cd.acm 2008-11-21 20:54 . 2003-05-21 13:50 24,576 --a------ c:\windows\system32\msxml3a.dll 2008-11-21 20:54 . 2000-03-14 21:55 13,239 --a------ c:\windows\system32\Scg726.acm . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-03 15:45 2,861,056 ------w c:\windows\Internet Logs\xDB1.tmp 2008-10-30 20:32 --------- d-----w c:\program files\uTorrent 2008-10-30 20:32 --------- d-----w c:\documents and settings\Patryk\Dane aplikacji\uTorrent 2008-10-30 17:12 --------- d-----w c:\program files\IrfanView 2008-10-29 21:52 --------- d-----w c:\program files\Microsoft Games 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-13 12:07 --------- d-----w c:\program files\Common Files\Autodata Limited Shared 2008-10-12 20:20 --------- d-----w c:\documents and settings\Patryk\Dane aplikacji\CyberLink 2008-10-12 20:19 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\CyberLink 2008-10-12 20:18 --------- d-----w c:\program files\CyberLink 2008-02-01 22:23 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((( snapshot_2008-12-09_ 1.54.53.84 ))))))))))))))))))))))))))))))))))))))))) . - 2005-02-24 19:36:08 16,096 ------w c:\windows\$hf_mig$\KB894391\spmsg.dll + 2005-02-25 03:36:06 16,096 ------w c:\windows\$hf_mig$\KB894391\spmsg.dll - 2005-02-24 19:36:08 212,704 ------w c:\windows\$hf_mig$\KB894391\spuninst.exe + 2005-02-25 03:36:06 212,704 ------w c:\windows\$hf_mig$\KB894391\spuninst.exe - 2005-02-24 19:36:08 22,240 ------w c:\windows\$hf_mig$\KB894391\update\spcustom.dll + 2005-02-25 03:36:06 22,240 ------w c:\windows\$hf_mig$\KB894391\update\spcustom.dll - 2005-02-24 19:36:08 725,728 ------w c:\windows\$hf_mig$\KB894391\update\update.exe + 2005-02-25 03:36:06 725,728 ------w c:\windows\$hf_mig$\KB894391\update\update.exe - 2005-02-24 19:36:08 387,296 ------w c:\windows\$hf_mig$\KB894391\update\updspapi.dll + 2005-02-25 03:36:08 387,296 ------w c:\windows\$hf_mig$\KB894391\update\updspapi.dll + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-12-09 15:36:18 524,288 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-09 15:36:18 8,192 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-12-09 15:36:00 524,288 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-09 15:36:00 8,192 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-12-09 15:43:26 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_44c.dat + 2008-12-09 15:43:32 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_5a0.dat + 2008-12-09 15:43:26 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_b8.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-29 136600] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-10-22 413696] "InternetDownload_upgrade"="c:\program files\VersalSoft\InternetDownload\InternetDownload.exe" [2008-11-24 361472] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"= 1 (0x1) "{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}"= 1073741857 (0x40000021) "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"= 32 (0x20) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoAddPrinter"= 0 (0x0) "NoDeletePrinter"= 0 (0x0) "NoCustomizeWebView"= 0 (0x0) "NoGoTo"= 1 (0x1) "NoOptions"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoStartMenuMyMusic"= 0 (0x0) "NoSMMyDocs"= 1 (0x1) "NoFavoritesMenu"= 1 (0x1) "NoCommonGroups"= 0 (0x0) "NoStartMenuSubFolders"= 0 (0x0) "NoNtSecurity"= 0 (0x0) "NoBandCustomize"= 1 (0x1) "NoExpandedNewMenu"= 0 (0x0) "SpecifyDefaultButtons"= 1 (0x1) "Btn_Search"= 2 (0x2) "Btn_Folders"= 2 (0x2) "Btn_Favorites"= 2 (0x2) "Btn_Media"= 2 (0x2) "Btn_History"= 2 (0x2) "Btn_Fullscreen"= 2 (0x2) "Btn_Tools"= 2 (0x2) "Btn_MailNews"= 2 (0x2) "Btn_Size"= 2 (0x2) "Btn_Edit"= 2 (0x2) "Btn_Discussions"= 2 (0x2) "Btn_Cut"= 2 (0x2) "Btn_Copy"= 2 (0x2) "Btn_Paste"= 2 (0x2) "Btn_Encoding"= 2 (0x2) "Btn_PrintPreview"= 2 (0x2) "EnforceShellExtensionSecurity"= 0 (0x0) "ForceCopyAclwithFile"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.asv2"= asusasv2.dll "VIDC.3iv2"= 3ivxVfWCodec.dll "vidc.i263"= i263_32.drv "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm "msacm.imc"= imc32.acm "vidc.DIVF"= DivX412.dll [HKLM\~\startupfolder\C:^Documents and Settings^Patryk^Menu Start^Programy^Autostart^RocketDock.lnk] path=c:\documents and settings\Patryk\Menu Start\Programy\Autostart\RocketDock.lnk backup=c:\windows\pss\RocketDock.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Patryk^Menu Start^Programy^Autostart^TransBar.lnk] path=c:\documents and settings\Patryk\Menu Start\Programy\Autostart\TransBar.lnk backup=c:\windows\pss\TransBar.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Patryk^Menu Start^Programy^Autostart^UberIcon.lnk] path=c:\documents and settings\Patryk\Menu Start\Programy\Autostart\UberIcon.lnk backup=c:\windows\pss\UberIcon.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Patryk^Menu Start^Programy^Autostart^Y'z Shadow.lnk] path=c:\documents and settings\Patryk\Menu Start\Programy\Autostart\Y'z Shadow.lnk backup=c:\windows\pss\Y'z Shadow.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Control Center] --a------ 2005-06-15 15:50 1623040 c:\progra~1\ASUS\WLAN Card Utilities\Center.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 13:00 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HControl] --------- 2005-07-06 23:26 102400 c:\windows\ATK0100\HControl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --------- 2004-09-15 11:02 155648 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iPlusManager] --a------ 2008-05-30 14:26 409600 c:\program files\iPlus\iPlusChecker.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --------- 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] --a------ 2008-08-11 08:31 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power_Gear] --a------ 2004-09-21 16:55 81920 c:\program files\ASUS\Power4 Gear\BatteryLife.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-10-22 19:25 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock] --a------ 2007-03-19 00:05 630784 c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] --a------ 2004-12-16 05:55 688218 c:\program files\Synaptics\SynTP\SynTPEnh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] --a------ 2004-12-16 05:55 98394 c:\program files\Synaptics\SynTP\SynTPLpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-10-01 22:00 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray] --------- 2004-08-04 13:00 3072 c:\windows\system32\systray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "MkS_Scan"=3 (0x3) "Emproxy"=3 (0x3) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9276:TCP"= 9276:TCP:BitComet 9276 TCP "9276:UDP"= 9276:UDP:BitComet 9276 UDP "7391:TCP"= 7391:TCP:BitComet 7391 TCP "7391:UDP"= 7391:UDP:BitComet 7391 UDP R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-29 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-29 20560] R2 eprdrv;eprdrv;c:\windows\system32\drivers\eprdrv.SYS [2008-04-22 12712] R2 GtDetectSc;GtDetectSc Service;c:\program files\iPlus\Drivers\driver2k\GTMax3.6\GtDetectSc.exe [2008-09-06 204800] R2 GtFlashSwitch;GtFlashSwitch Service;c:\program files\iPlus\Drivers\driver2k\GTMax3.6\GtFlashSwitch.exe [2008-09-06 204800] R2 MSSQL$INVENTORCONTENT;MSSQL$INVENTORCONTENT;c:\program files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe -sINVENTORCONTENT [] R2 simdrv;simdrv;c:\windows\system32\drivers\simdrv.SYS [2008-04-22 9708] R3 ASNDIS5;ASNDIS5 Protocol Driver;\??\c:\windows\system32\ASNDIS5.SYS [2005-09-10 16269] S2 ekrn;Eset Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" [] S2 FLEXlm Service 1;FLEXlm Service 1; [] S3 ce6230;Intel CE6230 Standalone USB Driver;c:\windows\system32\DRIVERS\CE6230StandaloneDriver.sys [2008-05-06 44800] S3 ce6230BDACAP;Realfine CE6230 BDA Driver;c:\windows\system32\DRIVERS\CE6230BDA.sys [2008-05-06 19328] S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2008-09-06 95744] S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2008-09-06 51968] S3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2008-09-06 8064] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2008-08-26 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2008-08-26 8320] S3 PVUSB;CESG502 USB Driver;c:\windows\system32\DRIVERS\CESG502.sys [2008-05-15 40672] S3 SQLAgent$INVENTORCONTENT;SQLAgent$INVENTORCONTENT;c:\program files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlagent.EXE -i INVENTORCONTENT [] S3 Video3D;ASUS Video3D Service;c:\windows\system32\Drivers\Video3D.sys [] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0619afa4-7ede-11d3-a358-0013d49f99bb}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9de418c-9f36-11da-a85a-0013d4a245b7}] \Shell\AutoRun\command - G:\f.bat \Shell\explore\Command - G:\f.bat \Shell\open\Command - G:\f.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb9cf108-3e94-11dd-abc2-0013d49f99bb}] \Shell\AutoRun\command - G:\laucher.exe . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uLocal Page = c:\winnt\System32\blank.htm mStart Page = about:blank mSearch Bar = about:blank uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Download by VersalSoft Internet Download - c:\program files\VersalSoft\InternetDownload\adddownload.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd c:\windows\Downloaded Program Files\Snooker.dll - O16 -: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} hxxp://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab c:\windows\Downloaded Program Files\Snooker.inf FireFox -: Profile - c:\documents and settings\Patryk\Dane aplikacji\Mozilla\Firefox\Profiles\ul62bbcj.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdjvu.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin10.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin9.dll FF -: plugin - c:\program files\QuickTime\Plugins\npqtplugin10.dll FF -: plugin - c:\program files\QuickTime\Plugins\npqtplugin8.dll FF -: plugin - c:\program files\QuickTime\Plugins\npqtplugin9.dll FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-09 16:54:25 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-09 16:55:47 ComboFix-quarantined-files.txt 2008-12-09 15:55:44 ComboFix5.txt 2008-12-09 15:50:40 ComboFix4.txt 2008-06-21 23:59:12 ComboFix3.txt 2008-06-23 00:37:56 ComboFix2.txt 2008-12-09 00:56:00 Przed: 3 687 481 344 bajtów wolnych Po: 3,698,425,856 bajtów wolnych 328 --- E O F --- 2008-09-30 16:33:06

HJT:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:56:14, on 2008-12-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\ASWLSVC.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtDetectSc.exe C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtFlashSwitch.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe C:\WINDOWS\system32\ASWL2K.exe C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\blank.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: E-Zsoft VideoDownloaderToolBar - {4322A444-92F8-4C3E-BD4C-013BA51E2871} - C:\Program Files\VersalSoft\InternetDownload\VDTB.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: E-Zsoft VideoDownloaderToolBar - {4322A444-92F8-4C3E-BD4C-013BA51E2871} - C:\Program Files\VersalSoft\InternetDownload\VDTB.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [InternetDownload_upgrade] "C:\Program Files\VersalSoft\InternetDownload\InternetDownload.exe" /upgrade O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present O8 - Extra context menu item: Download by VersalSoft Internet Download - C:\Program Files\VersalSoft\InternetDownload\adddownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O15 - Trusted Zone: http://www.mks.com.pl O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Eset HTTP Server (EHttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (file missing) O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing) O23 - Service: GtDetectSc Service (GtDetectSc) - OptionNV - C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtDetectSc.exe O23 - Service: GtFlashSwitch Service (GtFlashSwitch) - Option - C:\Program Files\iPlus\Drivers\driver2k\GTMax3.6\GtFlashSwitch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe -- End of file - 8058 bytes

**Posty:** 18165 · przez **wojtas** 09 Gru 2008, 18:26

włóż płytkę windowsa - zbootuj ją. wejdź do konsoli odzyskiwania i w niej wpisz

chkdsk x: /r

gdzie x to litera partycji systemowej.

**Posty:** 5 · przez **kompot** 10 Gru 2008, 18:14

Mam plyte z Home SP3(moj SP2 jest 400km stad). Rozumiem, że do mojego SP2 moge dograc SP3 i resztę zrobić z wymienionej na poczatku płyty?

**Posty:** 18165 · przez **wojtas** 10 Gru 2008, 18:43

sadze ze tak..

Autor postu otrzymał pochwałę

**Posty:** 5 · przez **kompot** 10 Gru 2008, 19:49

Sorry za laickie pytania, ale to zupełnie nie moja działka.

Przed chwilą miałem bluescreena, ostatnia linijka:
0x000000D1 (0x00000000, 0x00000002, 0x00000000, 0x893F9648)

**Posty:** 18165 · przez **wojtas** 10 Gru 2008, 22:26

looknij:

http://support.microsoft.com/kb/817789/pl

**Posty:** 5 · przez **kompot** 10 Gru 2008, 23:30

To chyba mnie nie dotyczy.
Wrócilem do ESET.

Dodano Dzisiaj, 01:48:
Niestety plyta+konsola odzyskiwania+chkdsk /r nie pomogły. Naprawa instalacji także. Poleciał format.
I pierwsz raz od dwóch lat mam kalkulator, painta, działa też pasek szybkiego uruchamiania.
Na przyszłość: Watch your click!
Dzięki wszytskim za pomoc anyway.