Proszę o sprawdzenie loga (błedy oraz wolny start systemu)

**Posty:** 62 · przez **kris__25** 07 Lis 2008, 20:45

Witam, mam system Vista Home Basic i czasami przy uruchamianiu systemu włącza się próba naprawiania systemu, która kończy się niepowodzeniem, ale wyskakuje mi opcja że moge przywrócić system do ostaniego punktu przywracania i po zaznaczeniu tej opcji uruchamia sie normalnie. Natomiast czasami po uruchomieniu nie wyskakuje mi opcja naprawy ale wtedy system uruchamia sie chyba z 10 minut podczas gdy wczesniej odpalal sie w ok.1 minute, stad prosba o pomoc i dlatego prosze o sprawdzenie loga

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:26:47, on 2008-11-07 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\rundll32.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe C:\Windows\system32\conime.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe" O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: @%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193 (idsvc) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8336 bytes

**Posty:** 300 · przez **sgsman** 07 Lis 2008, 21:13

1. Wstaw loga w tagi "code".
2. Wrzuć loga z combofixa.
3. Czekaj, aż ktoś Ci pomoże

.

**Posty:** 62 · przez **kris__25** 07 Lis 2008, 21:24

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:26:47, on 2008-11-07 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\rundll32.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe C:\Windows\system32\conime.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe" O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: @%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193 (idsvc) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8336 bytes

**Posty:** 684 · przez **djarta** 07 Lis 2008, 22:06

O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

>>Hijack>>scan(Do a system scan only)>>zaznacz>>Fix checked.

Daj log z ComboFixa.

===============
K.

**Posty:** 62 · przez **kris__25** 07 Lis 2008, 22:15

Oto log z ComboFixa

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - Rumianek 2008-11-07 20:35:00.1 - NTFSx86 Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.1.1045.18.1135 [GMT 1:00] Uruchomiony z: d:\instalki\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-07 do 2008-11-07 ))))))))))))))))))))))))))))))) . 2008-11-07 19:26 . 2008-11-07 19:26 <DIR> d-------- c:\program files\Trend Micro 2008-11-07 19:08 . 2008-11-07 19:25 <DIR> d-------- c:\users\All Users\Spybot - Search & Destroy 2008-11-07 19:08 . 2008-11-07 19:25 <DIR> d-------- c:\programdata\Spybot - Search & Destroy 2008-11-07 19:08 . 2008-11-07 19:08 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2008-11-05 06:18 . 2008-11-05 06:18 <DIR> d--hs---- C:\found.000 2008-11-02 17:28 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-11-01 16:40 . 2008-11-01 16:40 <DIR> d-------- c:\users\Rumianek\AppData\Roaming\InterVideo 2008-10-23 05:51 . 2008-11-05 23:42 <DIR> dr------- C:\Filmy 2008-10-18 07:47 . 2008-10-02 02:32 1,383,424 --a------ c:\windows\System32\mshtml.tlb 2008-10-18 07:47 . 2008-10-02 04:49 827,392 --a------ c:\windows\System32\wininet.dll 2008-10-15 07:14 . 2008-09-18 06:09 3,601,464 --a------ c:\windows\System32\ntkrnlpa.exe 2008-10-15 07:14 . 2008-09-18 06:09 3,549,240 --a------ c:\windows\System32\ntoskrnl.exe 2008-10-15 06:56 . 2008-08-27 02:06 288,768 --a------ c:\windows\System32\drivers\srv.sys 2008-10-15 06:46 . 2008-09-18 03:16 2,032,640 --a------ c:\windows\System32\win32k.sys 2008-10-13 16:00 . 2008-10-16 18:27 <DIR> d-------- c:\users\Rumianek\AppData\Roaming\Ahead 2008-10-13 15:58 . 2008-10-13 15:58 <DIR> d-------- c:\users\All Users\Nero 2008-10-13 15:58 . 2008-10-13 15:58 <DIR> d-------- c:\programdata\Nero 2008-10-13 15:58 . 2008-10-13 15:58 <DIR> d-------- c:\program files\Nero 2008-10-13 15:58 . 2008-10-13 16:01 <DIR> d-------- c:\program files\Common Files\Ahead 2008-10-11 12:28 . 2008-10-13 10:33 <DIR> d-------- C:\_cache 2008-10-07 22:42 . 2008-10-07 22:42 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-10-07 21:37 . 2008-10-07 21:37 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-01 08:40 --------- d-----w c:\users\Rumianek\AppData\Roaming\Winamp 2008-10-18 06:14 --------- d-----w c:\users\Rumianek\AppData\Roaming\IrfanView 2008-10-06 13:38 --------- d-----w c:\programdata\NOS 2008-10-06 13:38 --------- d-----w c:\program files\NOS 2008-10-06 13:34 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-10-06 13:33 --------- d-----w c:\program files\Common Files\Adobe 2008-10-06 07:54 --------- d-----w c:\programdata\SBT 2008-10-06 07:54 --------- d-----w c:\program files\Przeglądarka migawek 2008-10-06 07:46 --------- d-----w c:\users\Rumianek\AppData\Roaming\Microsoft Web Folders 2008-10-06 05:42 174 --sha-w c:\program files\desktop.ini 2008-10-06 05:34 --------- d-----w c:\program files\Windows Sidebar 2008-10-06 05:34 --------- d-----w c:\program files\Windows Photo Gallery 2008-10-06 05:34 --------- d-----w c:\program files\Windows Mail 2008-10-06 05:34 --------- d-----w c:\program files\Windows Defender 2008-10-06 05:34 --------- d-----w c:\program files\Windows Collaboration 2008-10-06 05:34 --------- d-----w c:\program files\Windows Calendar 2008-10-06 05:21 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-10-06 05:21 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-10-02 05:33 --------- d-----w c:\program files\NAPI-PROJEKT 2008-10-02 05:33 --------- d-----w c:\program files\ALLPlayer 2008-10-02 05:05 --------- d-----w c:\programdata\eMule 2008-10-02 05:04 --------- d-----w c:\program files\eMule 2008-10-02 05:01 --------- d-----w c:\users\Rumianek\AppData\Roaming\Media Player Classic 2008-10-02 04:57 269,312 ----a-w c:\windows\System32\es.dll 2008-10-02 04:56 --------- d-----w c:\programdata\Apple Computer 2008-10-02 04:56 --------- d-----w c:\program files\Ringz Studio 2008-10-02 04:56 --------- d-----w c:\program files\Common Files\Real 2008-10-01 20:02 --------- d-----w c:\program files\IrfanView 2008-10-01 19:54 --------- d-----w c:\program files\Winamp 2008-10-01 19:53 --------- d-----w c:\programdata\Winamp Toolbar 2008-10-01 19:53 --------- d-----w c:\programdata\OrbNetworks 2008-10-01 19:53 --------- d-----w c:\program files\Winamp Toolbar 2008-10-01 19:53 --------- d-----w c:\program files\Winamp Remote 2008-10-01 19:39 --------- d-----w c:\users\Rumianek\AppData\Roaming\Gadu-Gadu 2008-10-01 19:38 --------- d-----w c:\program files\Gadu-Gadu 2008-10-01 19:26 61,440 ----a-w c:\windows\System32\winipsec.dll 2008-10-01 19:26 361,984 ----a-w c:\windows\System32\IPSECSVC.DLL 2008-10-01 19:26 28,672 ----a-w c:\windows\System32\FwRemoteSvr.dll 2008-10-01 19:26 272,896 ----a-w c:\windows\System32\polstore.dll 2008-10-01 19:21 2,048 ----a-w c:\windows\System32\tzres.dll 2008-10-01 19:19 303,616 ----a-w c:\windows\System32\wmpeffects.dll 2008-10-01 19:13 9,847,296 ----a-w c:\windows\System32\NlsData000a.dll 2008-10-01 19:09 988,216 ----a-w c:\windows\System32\winload.exe 2008-10-01 19:09 927,288 ----a-w c:\windows\System32\winresume.exe 2008-10-01 19:09 615,992 ----a-w c:\windows\System32\ci.dll 2008-10-01 19:09 6,656 ----a-w c:\windows\System32\kbd106n.dll 2008-10-01 19:09 46,592 ----a-w c:\windows\System32\setbcdlocale.dll 2008-10-01 19:09 40,960 ----a-w c:\windows\System32\srclient.dll 2008-10-01 19:09 378,368 ----a-w c:\windows\System32\srcore.dll 2008-10-01 19:09 318,464 ----a-w c:\windows\System32\rstrui.exe 2008-10-01 19:09 19,000 ----a-w c:\windows\System32\kd1394.dll 2008-10-01 19:09 14,848 ----a-w c:\windows\System32\srdelayed.exe 2008-10-01 19:07 295,936 ----a-w c:\windows\System32\gdi32.dll 2008-10-01 19:06 14,848 ----a-w c:\windows\System32\wshrm.dll 2008-10-01 19:06 113,664 ----a-w c:\windows\system32\drivers\rmcast.sys 2008-10-01 19:04 84,480 ----a-w c:\windows\System32\INETRES.dll 2008-10-01 19:04 738,304 ----a-w c:\windows\System32\inetcomm.dll 2008-10-01 19:04 1,314,816 ----a-w c:\windows\System32\quartz.dll 2008-10-01 19:03 --------- d-----w c:\program files\MSXML 4.0 2008-10-01 18:30 --------- d-----w c:\program files\Alwil Software 2008-10-01 18:27 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-10-01 18:26 --------- d-----w c:\programdata\Symantec 2008-10-01 10:18 --------- d-----w c:\users\Rumianek\AppData\Roaming\AdobeUM 2008-10-01 03:51 53,448 ----a-w c:\windows\System32\wuauclt.exe 2008-10-01 03:51 45,768 ----a-w c:\windows\System32\wups2.dll 2008-10-01 03:51 1,811,656 ----a-w c:\windows\System32\wuaueng.dll 2008-10-01 03:51 1,524,736 ----a-w c:\windows\System32\wucltux.dll 2008-10-01 03:50 83,456 ----a-w c:\windows\System32\wudriver.dll 2008-10-01 03:50 563,912 ----a-w c:\windows\System32\wuapi.dll 2008-10-01 03:50 36,552 ----a-w c:\windows\System32\wups.dll 2008-10-01 03:50 31,232 ----a-w c:\windows\System32\wuapp.exe 2008-10-01 03:50 163,904 ----a-w c:\windows\System32\wuwebv.dll 2008-09-30 22:05 --------- d--h--w c:\program files\InstallShield Installation Information 2008-09-30 22:05 --------- d-----w c:\program files\Atheros 2008-09-30 22:04 --------- d-----w c:\program files\TOSHIBA 2008-09-30 22:03 0 --sha-r c:\windows\system32\drivers\TOSHIBA_Satellite A100_04811-PL_PSAANE-03K02.MRK 2008-09-30 21:34 --------- d-----w c:\users\Rumianek\AppData\Roaming\Toshiba 2008-09-30 21:13 --------- d-----w c:\programdata\ToshibaEurope 2008-09-30 21:08 --------- d-sh--w c:\programdata\Ulubione 2008-09-30 21:08 --------- d-sh--w c:\programdata\Szablony 2008-09-30 21:08 --------- d-sh--w c:\programdata\Pulpit 2008-09-30 21:08 --------- d-sh--w c:\programdata\Menu Start 2008-09-30 21:08 --------- d-sh--w c:\programdata\Dokumenty 2008-09-30 21:08 --------- d-sh--w c:\programdata\Dane aplikacji . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 413696] "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2007-01-04 77824] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 409264] "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-01-02 493112] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 530552] "NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-07 90191] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-07 7766016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-07 81920] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 577536] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496] "Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2006-12-22 554640] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2006-11-26 97357] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-07 c:\windows\RtHDVCpl.exe] "NDSTray.exe"="NDSTray.exe" [BU] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{BF748F0E-2517-4B89-9EBA-38650F4C0616}"= UDP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{3A2B8C58-9E18-4CF8-A944-D0D92A3E6097}"= TCP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{E0A8B41F-AD04-451D-BD3B-30A620A41A9E}"= UDP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{963608F1-E009-41BA-A19E-8AA5944A4F94}"= TCP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{62838088-D57C-4A76-B020-DB53FFEBD5F3}"= UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{3F5A6015-B1AD-49F0-91A1-6543362B6016}"= TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "TCP Query User{9CD7F525-5C1C-4A01-AC0B-2BE557A98FC8}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule "UDP Query User{14852654-4129-4AF4-AE31-B136F0C33178}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280] R3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2006-11-19 7168] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40056501-9429-11dd-a5e7-00a0d16c52d6}] \shell\AutoRun\command - F:\ \shell\open\Command - rundll32.exe .\desktop.dll,InstallM *Newly Created Service* - PROCEXP90 . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\users\Rumianek\AppData\Roaming\Mozilla\Firefox\Profiles\ez06l0m1.default\ FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava11.dll FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava12.dll FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava13.dll FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava14.dll FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava32.dll FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjpi160.dll FF -: plugin - c:\program files\Java\jre1.6.0\bin\npoji610.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-07 20:42:27 Windows 6.0.6001 Service Pack 1 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i??????????s?????? ???X????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: c:\windows\Explorer.exe -> ?:\windows\system32\iertutil.dll . Czas ukończenia: 2008-11-07 20:46:04 ComboFix-quarantined-files.txt 2008-11-07 19:45:59 Przed: 27 167 723 520 bajtów wolnych Po: 26,784,149,504 bajtów wolnych 220 --- E O F --- 2008-11-07 05:23:41

Dodano 08.11.2008 06:42:44:
Podczas skanowania combofixem wyskoczyl mi komunikat, że plik C\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation jest uszkodzony i nie mozna go odczytac i nalezy uruchomic program CHKDSK. Po restarcie kompa uruchomilo mi sie sprawdzanie spojnosci danych.

Dodano 08.11.2008 06:45:16:
Bład pliku vfind.cfexe