[log] komputer wyłącza się samoistnie...

**Posty:** 112 · przez **Atrakcyjny_Kazimierz** 13 Lis 2009, 18:08

Witam. Mam pewien problem. Mój pecet od pewnego czasu wyłącza się samoistnie, podczas np. otwierania jakichś programów (for example Gadu-Gadu), poza tym pracuje okrutnie wolno, co czasem - nie ukrywając - doprowadza mnie do szewskiej pasji. Proszę o sprawdzenie loga z HiJackThis i RSIT'a.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:05:38, on 2009-11-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Avast\aswUpdSv.exe C:\Program Files\Avast\ashServ.exe C:\WINDOWS\Explorer.EXE E:\Daemon Tools\daemon.exe C:\Program Files\VVSN\VVSN.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\PROGRA~1\Avast\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe E:\skype\Phone\Skype.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Avast\ashMaiSv.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Avast\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\***\Pulpit\RSIT.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.amnezja.org/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [DAEMON Tools] "E:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe 9\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKCU\..\Run: [Skype] "E:\skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ares] "E:\Ares\Ares.exe" -h O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.amnezja.org/ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Unknown owner - C:\Program Files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 7423 bytes

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by *** at 2009-11-13 17:05:23 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 7 GB (37%) free of 19 GB Total RAM: 767 MB (39% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:05:27, on 2009-11-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Avast\aswUpdSv.exe C:\Program Files\Avast\ashServ.exe C:\WINDOWS\Explorer.EXE E:\Daemon Tools\daemon.exe C:\Program Files\VVSN\VVSN.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\PROGRA~1\Avast\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe E:\skype\Phone\Skype.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Avast\ashMaiSv.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Avast\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\***\Pulpit\RSIT.exe C:\Program Files\HijackThis\***.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.amnezja.org/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [DAEMON Tools] "E:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe 9\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKCU\..\Run: [Skype] "E:\skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ares] "E:\Ares\Ares.exe" -h O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.amnezja.org/ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Unknown owner - C:\Program Files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 7453 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-26 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-26 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=NvQTwk,NvCplDaemon initialize [] "DAEMON Tools"=E:\Daemon Tools\daemon.exe [2005-11-08 128920] "VVSN"=C:\Program Files\VVSN\VVSN.exe [2005-10-25 107520] "LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184] "LogitechVideoRepair"=C:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752] "LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088] "SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2003-10-14 155648] "PaperPort PTD"=C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2005-03-17 57393] "IndexSearch"=C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2005-03-17 40960] "SetDefPrt"=C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe [2005-01-26 49152] "ControlCenter2.0"=C:\Program Files\Brother\ControlCenter2\brctrcen.exe [2005-05-17 933888] "Adobe Reader Speed Launcher"=D:\Adobe 9\Reader\Reader_sl.exe [2008-06-12 34672] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [] "avast!"=C:\PROGRA~1\Avast\ashDisp.exe [2009-08-17 81000] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-26 149280] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2008-03-17 570664] "SecurDisc"=C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe [2007-06-25 1629480] "InCD"=C:\Program Files\Nero\Nero 7\InCD\InCD.exe [2007-06-25 1057064] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"=E:\skype\Phone\Skype.exe [2008-11-07 21633320] "LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe [2006-02-20 20480] "LogitechSoftwareUpdate"=C:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608] "MsnMsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background [] "ares"=E:\Ares\Ares.exe -h [] "AdobeUpdater"=C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [] "LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-06-09 2363392] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="NVDESK32.DLL" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "E:\Gadu-Gadu\gg.exe"="E:\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "E:\Kazaa Lite Rewolucja\kazaalite.kpp"="E:\Kazaa Lite Rewolucja\kazaalite.kpp:*:Enabled:kazaalite" "E:\DC++\DCPlusPlus.exe"="E:\DC++\DCPlusPlus.exe:*:Enabled:DC++" "E:\Program Files\iMesh Applications\iMesh6\iMesh6.exe"="E:\Program Files\iMesh Applications\iMesh6\iMesh6.exe:*:Enabled:iMesh 6" "E:\eMule\EMULE.EXE"="E:\eMule\EMULE.EXE:*:Enabled:eMule" "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger" "C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player" "E:\Gadu-Gadu\ggphone\ggphone.exe"="E:\Gadu-Gadu\ggphone\ggphone.exe:*:Enabled:Internetowe polaczenia telefoniczne" "E:\bitlord\BitLord.exe"="E:\bitlord\BitLord.exe:*:Enabled:BitLord" "E:\Bearshare\BearShare.exe"="E:\Bearshare\BearShare.exe:*:Enabled:BearShare" "E:\Ares\Ares.exe"="E:\Ares\Ares.exe:*:Enabled:Ares p2p for windows" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "F:\Bitcomet\BitComet.exe"="F:\Bitcomet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "E:\Dance Party\Program\DanceParty.exe"="E:\Dance Party\Program\DanceParty.exe:*:Enabled:Dance Party" "E:\Phone\Skype.exe"="E:\Phone\Skype.exe:*:Enabled:Skype" "C:\WINDOWS\System32\muzapp.exe"="C:\WINDOWS\System32\muzapp.exe:*:Enabled:MUZ AOD APP player" "E:\bitlord\nowe gadu\Nowe Gadu-Gadu\gg.exe"="E:\bitlord\nowe gadu\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu" "E:\skype\Phone\Skype.exe"="E:\skype\Phone\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d549ccd0-1f1f-11dc-b0ab-00304f2dd352}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe ======List of files/folders created in the last 1 months====== 2009-11-13 17:05:23 ----D---- C:\rsit 2009-11-13 17:03:39 ----D---- C:\Program Files\HijackThis 2009-11-13 15:55:08 ----SHD---- C:\FOUND.058 2009-11-13 15:47:08 ----SHD---- C:\FOUND.057 2009-11-12 20:28:30 ----SHD---- C:\FOUND.056 2009-11-11 23:21:07 ----HD---- C:\WINDOWS\$NtUninstallKB969947$ 2009-11-11 13:19:50 ----SHD---- C:\FOUND.055 2009-11-08 17:45:18 ----SHD---- C:\FOUND.054 2009-11-07 22:15:06 ----D---- C:\Program Files\MSXML 4.0 2009-11-07 16:50:48 ----SHD---- C:\FOUND.053 2009-11-06 21:07:18 ----D---- C:\Documents and Settings\***\Dane aplikacji\dvdcss 2009-11-06 16:14:55 ----A---- C:\WINDOWS\NeroDigital.ini 2009-11-06 16:08:48 ----SHD---- C:\FOUND.052 2009-11-06 14:33:03 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2009-11-06 14:25:34 ----D---- C:\Program Files\Common Files\LightScribe 2009-11-06 14:24:21 ----D---- C:\Documents and Settings\***\Dane aplikacji\Ahead 2009-11-06 14:23:51 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2009-11-06 14:19:50 ----D---- C:\Program Files\Nero 2009-11-06 14:19:50 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2009-11-06 14:19:49 ----D---- C:\Program Files\Common Files\Ahead 2009-11-06 14:17:22 ----A---- C:\WINDOWS\system32\d3dx9_30.dll 2009-11-06 14:17:21 ----A---- C:\WINDOWS\system32\d3dx9_28.dll 2009-11-05 16:36:02 ----SHD---- C:\FOUND.051 2009-11-05 16:31:16 ----SHD---- C:\FOUND.009 2009-11-05 13:31:06 ----SHD---- C:\FOUND.008 2009-11-05 13:08:19 ----D---- C:\WINDOWS\system32\NtmsData 2009-11-05 13:05:02 ----SHD---- C:\FOUND.007 2009-11-05 12:18:21 ----HD---- C:\WINDOWS\$NtUninstallKB976749$ 2009-11-04 09:59:24 ----SHD---- C:\FOUND.006 2009-10-26 19:40:46 ----D---- C:\WINDOWS\Sun 2009-10-26 19:24:31 ----A---- C:\WINDOWS\system32\javaws.exe 2009-10-26 19:24:31 ----A---- C:\WINDOWS\system32\javaw.exe 2009-10-26 19:24:31 ----A---- C:\WINDOWS\system32\java.exe 2009-10-26 19:24:31 ----A---- C:\WINDOWS\system32\deploytk.dll 2009-10-26 19:23:55 ----D---- C:\Program Files\Java 2009-10-26 19:20:01 ----D---- C:\Documents and Settings\***\Dane aplikacji\Sun 2009-10-23 14:23:21 ----HD---- C:\WINDOWS\$NtUninstallKB974455$ 2009-10-16 11:19:19 ----HD---- C:\WINDOWS\$NtUninstallKB958869$ 2009-10-16 11:19:05 ----HD---- C:\WINDOWS\$NtUninstallKB954155_WM9$ 2009-10-16 11:17:24 ----HD---- C:\WINDOWS\$NtUninstallKB969059$ 2009-10-16 11:16:28 ----HD---- C:\WINDOWS\$NtUninstallKB974112$ 2009-10-16 11:16:20 ----HD---- C:\WINDOWS\$NtUninstallKB975025$ 2009-10-16 11:16:11 ----HD---- C:\WINDOWS\$NtUninstallKB974571$ 2009-10-16 11:14:50 ----HD---- C:\WINDOWS\$NtUninstallKB971486$ 2009-10-16 11:14:38 ----HD---- C:\WINDOWS\$NtUninstallKB973525$ 2009-10-16 11:13:28 ----HD---- C:\WINDOWS\$NtUninstallKB975467$ 2009-10-15 12:04:18 ----SHD---- C:\FOUND.005 2009-10-14 10:10:28 ----SHD---- C:\FOUND.004 ======List of files/folders modified in the last 1 months====== 2009-11-12 21:39:12 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-11-05 18:36:22 ----A---- C:\WINDOWS\system32\MRT.exe 2009-10-23 14:27:10 ----A---- C:\WINDOWS\imsins.BAK 2009-10-20 01:08:10 ----A---- C:\WINDOWS\system32\mshtml.dll 2009-10-17 19:16:26 ----A---- C:\WINDOWS\wincmd.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-08-17 26944] R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-08-17 114768] R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-08-17 51376] R1 InCDPass;Nero InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [2007-06-25 36776] R1 incdrm;Nero InCD MRW Remapper; C:\WINDOWS\system32\drivers\InCDRm.sys [2007-06-25 38440] R1 P3;Sterownik procesora Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2004-08-03 46592] R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2004-08-09 53920] R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-08-17 20560] R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-08-17 94160] R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-08-17 23152] R3 BrScnUsb;Brother USB Still Image driver; C:\WINDOWS\System32\Drivers\BrScnUsb.sys [2004-10-15 15295] R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2005-12-27 223128] R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2001-09-14 905097] R3 QCMerced;Logitech QuickCam Communicate; C:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152] R3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992] R3 usbaudio;Sterownik audio USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264] R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480] R3 VIAudio;Kontroler VIA AC'97 Audio (WDM); C:\WINDOWS\system32\drivers\ac97via.sys [2004-08-03 84480] R4 InCDfs;Nero InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [2007-06-25 119080] S1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848] S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 hidgame;Włącznik Microsoft HID do portu joysticka; C:\WINDOWS\system32\DRIVERS\hidgame.sys [2001-08-17 8576] S3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 QV2KUX;Cyfrowy aparat fotograficzny Casio; C:\WINDOWS\system32\DRIVERS\qv2kux.sys [2001-08-17 3328] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000] S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-10 18944] S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Avast\aswUpdSv.exe [2009-08-17 18752] R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast\ashServ.exe [2009-08-17 138680] R2 Brother XP spl Service;BrSplService; C:\WINDOWS\system32\brsvc01a.exe [2002-04-12 57344] R2 InCDsrv;InCD Helper; C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe [2007-06-25 1552680] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-26 153376] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-06-09 73728] R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2001-09-14 57344] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-10 38912] R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Avast\ashMaiSv.exe [2009-08-17 254040] R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Avast\ashWebSv.exe [2009-08-17 352920] R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848] S1 InCDrec;Nero InCD File System Recognizer; C:\WINDOWS\system32\drivers\InCDRec.sys [2007-06-25 16040] S2 NeroRegInCDSrv;Nero Registry InCD Service; C:\Program Files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240] -----------------EOF-----------------

**Posty:** 18165 · przez **wojtas** 13 Lis 2009, 19:12

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 112 · przez **Atrakcyjny_Kazimierz** 13 Lis 2009, 20:27

Otowąż i on jest, azaliż dobrym jest, hejże hej. Oj dana.

Kod: Zaznacz wszystko: ComboFix 09-11-13.06 - *** 2009-11-13 18:49.1.1 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.767.364 [GMT 1:00] Uruchomiony z: c:\documents and settings\***\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1351 [VPS 091113-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\***\USTAWI~1\Temp\IadHide4.dll c:\documents and settings\***\Ulubione\Games.url c:\documents and settings\***\Ulubione\Translator.url c:\documents and settings\***\Ulubione\Videos.url c:\documents and settings\***\Ustawienia lokalne\Temp\IadHide4.dll c:\windows\hosts c:\windows\system32\clrviddc.dll c:\windows\system32\ieuinit.inf . ((((((((((((((((((((((((( Pliki utworzone od 2009-10-13 do 2009-11-13 ))))))))))))))))))))))))))))))) . 2009-11-13 16:52 . 2009-11-13 16:52 -------- d-----w- c:\program files\Nero 2009-11-13 16:52 . 2009-11-13 16:52 -------- d-----w- c:\program files\Common Files\Ahead 2009-11-13 16:52 . 2009-11-13 16:52 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nero 2009-11-13 16:05 . 2009-11-13 16:05 -------- d-----w- C:\rsit 2009-11-13 14:55 . 2009-11-13 14:55 -------- d-----w- C:\FOUND.058 2009-11-13 14:47 . 2009-11-13 14:47 -------- d-----w- C:\FOUND.057 2009-11-12 19:28 . 2009-11-12 19:28 -------- d-----w- C:\FOUND.056 2009-11-11 12:19 . 2009-11-11 12:19 -------- d-----w- C:\FOUND.055 2009-11-08 16:45 . 2009-11-08 16:45 -------- d-----w- C:\FOUND.054 2009-11-07 21:15 . 2009-11-07 21:15 -------- d-----w- c:\program files\MSXML 4.0 2009-11-07 15:50 . 2009-11-07 15:50 -------- d-----w- C:\FOUND.053 2009-11-06 20:07 . 2009-11-06 20:07 -------- d-----w- c:\documents and settings\***\Dane aplikacji\dvdcss 2009-11-06 15:08 . 2009-11-06 15:08 -------- d-----w- C:\FOUND.052 2009-11-06 13:33 . 2009-11-06 13:33 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LightScribe 2009-11-06 13:28 . 2009-11-06 13:28 -------- d-----w- c:\documents and settings\***\Ustawienia lokalne\Dane aplikacji\Ahead 2009-11-06 13:25 . 2009-11-06 13:25 -------- d-----w- c:\program files\Common Files\LightScribe 2009-11-06 13:24 . 2009-11-06 13:24 -------- d-----w- c:\documents and settings\***\Dane aplikacji\Ahead 2009-11-06 13:23 . 2009-11-06 13:23 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Ahead 2009-11-05 15:36 . 2009-11-05 15:36 -------- d-----w- C:\FOUND.051 2009-11-05 15:31 . 2009-11-05 15:31 -------- d-----w- C:\FOUND.009 2009-11-05 12:32 . 2004-08-03 23:38 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys 2009-11-05 12:32 . 2004-08-03 23:38 14848 ----a-w- c:\windows\system32\dllcache\kbdhid.sys 2009-11-05 12:31 . 2009-11-05 12:31 -------- d-----w- C:\FOUND.008 2009-11-05 12:08 . 2009-11-05 12:08 -------- d-----w- c:\windows\system32\NtmsData 2009-11-05 12:05 . 2009-11-05 12:05 -------- d-----w- C:\FOUND.007 2009-11-04 08:59 . 2009-11-04 08:59 -------- d-----w- C:\FOUND.006 2009-10-26 18:40 . 2009-10-26 18:40 -------- d-----w- c:\windows\Sun 2009-10-26 18:24 . 2009-10-26 18:24 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-10-26 18:23 . 2009-10-26 18:23 -------- d-----w- c:\program files\Java 2009-10-26 18:23 . 2009-10-26 18:38 152576 ----a-w- c:\documents and settings\***\Dane aplikacji\Sun\Java\jre1.6.0_16\lzma.dll 2009-10-20 00:08 . 2009-10-20 00:08 3084288 ------w- c:\windows\system32\dllcache\mshtml.dll 2009-10-15 11:04 . 2009-10-15 11:04 -------- d-----w- C:\FOUND.005 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-25 06:58 . 2004-08-03 21:44 664576 ----a-w- c:\windows\system32\wininet.dll 2009-09-25 06:58 . 2004-08-03 21:44 81920 ----a-w- c:\windows\system32\ieencode.dll 2009-09-19 15:13 . 2009-09-19 15:13 -------- d-----w- c:\program files\Avast 2009-09-18 19:00 . 2009-09-18 19:00 -------- d-----w- c:\program files\Alwil Software 2009-09-18 18:25 . 2009-09-18 18:25 -------- d-----w- c:\documents and settings\***\Dane aplikacji\vlc 2009-09-18 18:24 . 2009-09-18 18:24 -------- d-----w- c:\program files\VideoLAN 2009-09-11 15:36 . 2004-08-03 21:44 133632 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 21:47 . 2004-08-03 21:44 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-26 09:16 . 2004-08-03 21:44 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-17 17:10 . 2009-09-19 15:13 1279456 ----a-w- c:\windows\system32\aswBoot.exe 2009-08-17 17:06 . 2009-09-19 15:14 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys 2009-08-17 17:06 . 2009-09-19 15:14 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2009-08-17 17:05 . 2009-09-19 15:14 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2009-08-17 17:05 . 2009-09-19 15:14 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2009-08-17 17:04 . 2009-09-19 15:14 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2009-08-17 17:04 . 2009-09-19 15:14 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2009-08-17 17:03 . 2009-09-19 15:14 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2009-08-17 17:02 . 2009-09-19 15:14 97480 ----a-w- c:\windows\system32\AvastSS.scr . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="e:\skype\Phone\Skype.exe" [2008-11-07 21633320] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2006-02-20 20480] "LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="NvQTwk" [X] "DAEMON Tools"="e:\daemon tools\daemon.exe" [2005-11-08 128920] "VVSN"="c:\program files\VVSN\VVSN.exe" [2005-10-25 107520] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184] "LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752] "LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960] "SetDefPrt"="c:\program files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 49152] "ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 933888] "Adobe Reader Speed Launcher"="d:\adobe 9\Reader\Reader_sl.exe" [2008-06-12 34672] "avast!"="c:\progra~1\Avast\ashDisp.exe" [2009-08-17 81000] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-26 149280] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-03-17 570664] "SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-2-20 450560] Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2006-11-24 802816] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\nvdesk32.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"= "c:\\Program Files\\Windows Media Player\\wmplayer.exe"= "e:\\bitlord\\nowe gadu\\Nowe Gadu-Gadu\\gg.exe"= "e:\\skype\\Phone\\Skype.exe"= "n:\\Installation\\Setupx.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9114:TCP"= 9114:TCP:BitComet 9114 TCP "9114:UDP"= 9114:UDP:BitComet 9114 UDP R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-09-19 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-09-19 20560] S2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe --> c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [?] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - MBR *Deregistered* - mbr [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.wp.pl/ uDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = localhost uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\***\Dane aplikacji\Mozilla\Firefox\Profiles\6hyz6blu.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.wp.pl/ FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query= FF - plugin: d:\adobe 9\Reader\browser\nppdf32.dll . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe HKCU-Run-ares - e:\ares\Ares.exe HKCU-Run-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe HKU-Default-Run-Picasa Media Detector - e:\picasa\Picasa2\PicasaMediaDetector.exe AddRemove-AP Instrument Tuner 1.02 - c:\program files\Audio Phonics AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\FlashUtil9c.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-13 19:03 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe >>UNKNOWN [0x82F93A40]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> 0x82f93a40 Warning: possible MBR rootkit infection ! user & kernel MBR OK Use "Recovery Console" command "fixmbr" to clear infection ! ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Avast\aswUpdSv.exe c:\program files\Avast\ashServ.exe c:\windows\system32\brss01a.exe c:\program files\Nero\Nero 7\InCD\InCDsrv.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\wdfmgr.exe c:\program files\Logitech\Video\FxSvr2.exe c:\program files\Avast\setup\avast.setup c:\program files\Avast\ashMaiSv.exe c:\program files\Avast\ashWebSv.exe c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe c:\windows\system32\wbem\wmiapsrv.exe . ************************************************************************** . Czas ukończenia: 2009-11-13 19:08 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-11-13 18:08 Przed: 7 461 208 064 bajtów wolnych Po: 7 856 406 528 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - F49578884EEF95FCF7B2492D5676E1B3

**Posty:** 2183 · przez **NieWiem** 14 Lis 2009, 13:54

Atrakcyjny_Kazimierz, prawie nic tu nie ma...

1. Ściągnij na dysk program MBR i zapisz go bezpośrednio w roocie dysku systemowego (X:\mbr.exe, gdzie X jest literą dysku systemowego).

Uruchom program i pozwól mu spokojnie działać. Wytworzy on loga w pliku X:\mbr.log - proszę go otworzyć za pomocą notatnika i przekleić zawartość w tagach [code] do posta. X: - litera dysku, na którym zapisany był program mbr.exe.

2.

Pobierz program TFC
Zamknij wszystkie otwarte programy - inaczej TFC zrobi to za Ciebie
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Kliknij przycisk Start
Czyszczenie lokalizacji tymczasowych może chwilę potrwać (ale znowu bez przesady), uzbrój się w cierpliwość.
Jeśli padnie prośba o restart - zgódź się.