Problem z laptopem/ log

[biigos]

Witam, moja dziewczyna ma problem z uruchamianiem laptopa,a mianowicie, 80% prob wlaczenia konczy sie tylko na czarnym ekranie...jesli sie wlaczy to jest cud...wlaczam go i widze tylko czarny ekran, czasem jak sie go tak zoastawi to wlasnie sie uruchamia, ale bb zadko...czyli prawie zawsze nic sie nie dzieje i jest tylko czarny ekran nawet po czasie 10min...
prosze o pomoc, moze cos w nim siedzi...

Kod: Zaznacz wszystko

ComboFix 08-10-15.06 - Ola 2008-10-16 12:49:27.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic   6.0.6000.0.1250.1.1045.18.230 [GMT 2:00]
Uruchomiony z: C:\Users\Ola\Desktop\ComboFix.exe
* Utworzono nowy punkt przywracania
* Resident AV is active

.

(((((((((((((((((((((((((   Pliki utworzone od 2008-09-16 do 2008-10-16  )))))))))))))))))))))))))))))))
.

Nie utworzono żadnych nowych plików w tym okresie

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-16 10:43   ---------   d-----w   C:\Program Files\Trend Micro
2008-10-16 10:03   12,931   ----a-w   C:\Users\Ola\AppData\Roaming\nvModes.dat
2008-10-16 10:01   ---------   d-----w   C:\Users\Ola\AppData\Roaming\WTablet
2008-10-16 09:57   ---------   d-----w   C:\Program Files\Windows Mail
2008-10-15 19:02   ---------   d-----w   C:\ProgramData\Lx_cats
2008-10-14 19:08   ---------   d-----w   C:\Users\Ola\AppData\Roaming\OpenOffice.org2
2008-10-05 21:52   ---------   d-----w   C:\Users\Ola\AppData\Roaming\Skype
2008-10-05 10:11   ---------   d-----w   C:\Users\Ola\AppData\Roaming\Azureus
2008-10-03 05:13   ---------   d-----w   C:\ProgramData\Kaspersky Lab
2008-10-02 03:49   826,368   ----a-w   C:\Windows\System32\wininet.dll
2008-10-02 03:49   56,320   ----a-w   C:\Windows\System32\iesetup.dll
2008-10-02 03:49   52,736   ----a-w   C:\Windows\AppPatch\iebrshim.dll
2008-10-02 03:48   26,624   ----a-w   C:\Windows\System32\ieUnatt.exe
2008-09-26 09:18   ---------   d-----w   C:\Program Files\Lexmark 2600 Series
2008-09-26 09:01   ---------   d-----w   C:\Program Files\Lexmark Toolbar
2008-09-18 04:35   3,505,208   ----a-w   C:\Windows\System32\ntkrnlpa.exe
2008-09-18 04:35   3,470,904   ----a-w   C:\Windows\System32\ntoskrnl.exe
2008-09-18 02:03   2,027,520   ----a-w   C:\Windows\System32\win32k.sys
2008-09-16 17:37   ---------   d-----w   C:\Program Files\EA GAMES
2008-08-26 01:12   290,304   ----a-w   C:\Windows\system32\drivers\srv.sys
2008-07-31 03:34   537,600   ----a-w   C:\Windows\AppPatch\AcLayers.dll
2008-07-31 03:34   449,536   ----a-w   C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:34   28,160   ----a-w   C:\Windows\System32\Apphlpdm.dll
2008-07-31 03:34   2,144,256   ----a-w   C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:34   173,056   ----a-w   C:\Windows\AppPatch\AcXtrnal.dll
2008-07-31 03:34   1,686,528   ----a-w   C:\Windows\System32\gameux.dll
2008-07-30 23:47   4,247,552   ----a-w   C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-30 23:32   2,560   ----a-w   C:\Windows\AppPatch\AcRes.dll
2008-07-19 05:10   53,448   ----a-w   C:\Windows\System32\wuauclt.exe
2008-07-19 05:10   45,768   ----a-w   C:\Windows\System32\wups2.dll
2008-07-19 05:10   36,552   ----a-w   C:\Windows\System32\wups.dll
2008-07-19 05:09   563,912   ----a-w   C:\Windows\System32\wuapi.dll
2008-07-19 05:09   1,811,656   ----a-w   C:\Windows\System32\wuaueng.dll
2008-07-19 03:44   83,456   ----a-w   C:\Windows\System32\wudriver.dll
2008-07-19 03:44   1,524,736   ----a-w   C:\Windows\System32\wucltux.dll
2008-07-18 20:08   163,904   ----a-w   C:\Windows\System32\wuwebv.dll
2008-07-18 18:44   31,232   ----a-w   C:\Windows\System32\wuapp.exe
2008-07-13 07:39   174   --sha-w   C:\Program Files\desktop.ini
2008-04-14 13:57   0   ----a-w   C:\Users\Ola\AppData\Roaming\wklnhst.dat
2007-05-22 16:48   6,571,920   ----a-w   C:\Program Files\Opera_9.21_International_Setup.exe
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 815104]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 159744]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-12-04 46704]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 472776]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-01-13 7766016]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-01-13 81920]
"Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2006-06-07 507904]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 200704]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 286720]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-01-15 172032]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"lxdnmon.exe"="C:\Program Files\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136]
"lxdnamon"="C:\Program Files\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2006-11-07 44128]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BBD66B82-631A-4BC6-8519-46BE7831E95D}"= UDP:C:\Program Files\Hp\QuickPlay\QP.exe:QP
"{4BB6401A-2E97-401A-8D7B-C9A6056F6C0F}"= TCP:C:\Program Files\Hp\QuickPlay\QP.exe:QP
"TCP Query User{454D25F1-1030-42A4-A9D9-761F3E99BC84}C:\\programy\\gadu-gadu\\gg.exe"= UDP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"UDP Query User{BEEABBB6-3D04-4CE8-90F0-CB2FAB07110E}C:\\programy\\gadu-gadu\\gg.exe"= TCP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"TCP Query User{122DE662-1C7B-44E6-A249-F22F6094620E}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{4E677F18-EA76-4BBC-A3E7-3F8A1FC72822}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{B1E79B37-A45A-49EC-A1A8-60AA92482649}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{C26B988C-6377-442B-BF6D-636704229376}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{7C043890-6E2F-4C4D-92F2-E48B00BC95EA}C:\\program files\\napi-projekt\\napisy.exe"= UDP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"UDP Query User{5C2D49F7-CE69-41A6-9330-899D78640B4F}C:\\program files\\napi-projekt\\napisy.exe"= TCP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"TCP Query User{53326DA0-724D-4D05-8AFF-EFDD52440E18}C:\\program files\\opera\\opera.exe"= UDP:C:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{A066C898-7264-4205-B8F0-ABA74099AE5C}C:\\program files\\opera\\opera.exe"= TCP:C:\program files\opera\opera.exe:Opera Internet Browser
"TCP Query User{D95DA246-7DE6-4ED8-AFE0-400D6F4A4649}C:\\program files\\skype\\phone\\skype.exe"= Disabled:UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{8F7F6AA7-936F-4031-81A6-B49233233F64}C:\\program files\\skype\\phone\\skype.exe"= Disabled:TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{D57A326D-6B68-46BD-B044-91FF8B1D9835}C:\\programy\\gadu-gadu\\gg.exe"= UDP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"UDP Query User{195736B6-77CA-4322-A4BC-C3A39EBE10E5}C:\\programy\\gadu-gadu\\gg.exe"= TCP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"TCP Query User{3BA36ECE-E9F5-460A-B0AC-8F0E3CDFED53}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{2B1AACCE-4F46-44FB-8822-7E94C46F192F}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{441837EA-9DA0-42D7-9092-FB3C9B3562C5}"= UDP:C:\Program Files\NetScream\NetScream.exe:NetScream
"{4A35D7A2-C4B5-4F37-AE51-08B44EBA7022}"= TCP:C:\Program Files\NetScream\NetScream.exe:NetScream
"TCP Query User{65DA2567-71EF-4396-9A85-9EA6ADBAD947}C:\\program files\\bittyrant\\azureus.exe"= UDP:C:\program files\bittyrant\azureus.exe:Azureus
"UDP Query User{0BC03E7D-EF47-4BC0-800A-BAF2E35B6FFE}C:\\program files\\bittyrant\\azureus.exe"= TCP:C:\program files\bittyrant\azureus.exe:Azureus
"TCP Query User{25997DDA-EEC8-4817-85F7-314C169A94A7}C:\\program files\\napi-projekt\\napisy.exe"= UDP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"UDP Query User{46A5D687-5C3F-49CB-B31A-0247AD30E0ED}C:\\program files\\napi-projekt\\napisy.exe"= TCP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"TCP Query User{03637D08-375E-48DA-8397-46F94363A582}C:\\program files\\bittyrant\\azureus.exe"= UDP:C:\program files\bittyrant\azureus.exe:Azureus
"UDP Query User{51D7112A-1ABA-4D2E-8B24-3AE76225BC01}C:\\program files\\bittyrant\\azureus.exe"= TCP:C:\program files\bittyrant\azureus.exe:Azureus
"{88792DB3-02F6-4B47-ACFC-9CD28AE7D09B}"= C:\Program Files\Cyberlink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
"{9064C39A-D2F3-4FA5-AA2F-1718B376F38E}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{58320991-5365-41B1-925B-5AD668FAFF1A}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{6FF2599E-DC7F-4D11-9A61-2F6959F9C7AA}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{B858C51D-ECCC-4299-A179-A29523582961}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{A1392393-6B41-4C41-B49A-691BF4466926}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{8CE69CE0-D8AB-410D-A347-46C9BF111640}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{2AA84D09-8636-47B2-9FD2-306206DCB523}"= UDP:C:\Windows\System32\lxdncoms.exe:Lexmark Communications System
"{F0937DBF-441E-42BD-ADF2-EC2EED1B3F1B}"= TCP:C:\Windows\System32\lxdncoms.exe:Lexmark Communications System
"{A3ABCD3D-6858-48D0-9201-93AF0F13E7C8}"= UDP:C:\Program Files\Lexmark 2600 Series\lxdnamon.exe:Lexmark Device Monitor
"{49321B31-C63C-4F27-A56D-8132C23E0661}"= TCP:C:\Program Files\Lexmark 2600 Series\lxdnamon.exe:Lexmark Device Monitor
"{22C603EA-1ACE-42C5-8208-6BC605DF0D24}"= UDP:C:\Program Files\Lexmark 2600 Series\frun.exe:Lexmark Productivity Studio
"{04FCD1F3-393E-4D05-84EA-22AC9ACB3EEA}"= TCP:C:\Program Files\Lexmark 2600 Series\frun.exe:Lexmark Productivity Studio
"{FF359425-0EA1-420D-83B6-6C51E4EACA13}"= UDP:C:\Program Files\Lexmark 2600 Series\lxdnmon.exe:Printer Device Monitor
"{ABA3CD05-A6DE-4E18-9811-F0417C658461}"= TCP:C:\Program Files\Lexmark 2600 Series\lxdnmon.exe:Printer Device Monitor
"{E0701B15-DBDF-46B0-AE0B-470392D9F000}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"{D50E7D31-BAB4-49E1-893C-30DACFF3F22E}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"{1B518C16-D198-415D-967B-7BDE8476CFF0}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdntime.exe:Lexmark Connect Time Executable
"{98F581C1-52D4-4EA3-B6D0-523EDE1F3D1A}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdntime.exe:Lexmark Connect Time Executable
"{54020A12-15C7-4047-A474-DA900D55A5D6}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnjswx.exe:Job Status Window Interface
"{14F2F0E4-30AE-43F5-990E-E23F6DD809A8}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnjswx.exe:Job Status Window Interface
"TCP Query User{C207E556-F713-44A7-8F11-0C9E2CB3BC9A}C:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:C:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{102F9806-77E5-4FF3-8456-FE2C6BCD55A9}C:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:C:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51 13560]
R2 lxdn_device;lxdn_device;C:\Windows\system32\lxdncoms.exe [2007-12-05 594600]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\Windows\system32\DRIVERS\wacomvhid.sys [2007-02-16 12848]
S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork   REG_MULTI_SZ      PLA DPS BFE mpssvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\setupM2008Podst.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\shell\AutoRun\command - I:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\shell\AutoRun\command - K:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{163e6771-1f51-11dc-8ec1-001b241263a5}]
\shell\AutoRun\command - G:\RunGame.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{895037da-3525-11dd-b0be-001b241263a5}]
\shell\AutoRun\command - EXPLORER.EXE
\shell\explore\Command - EXPLORER.EXE
\shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eed73a9e-2108-11dd-8ce5-001b241263a5}]
\shell\AutoRun\command - I:\EXPLORER.EXE
\shell\explore\Command - I:\EXPLORER.EXE
\shell\open\Command - I:\EXPLORER.EXE

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Zawartość folderu 'Zaplanowane zadania'

2008-10-16 C:\Windows\Tasks\User_Feed_Synchronization-{867F636F-2067-4194-BA2A-1498D132ED45}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKU-Default-RunOnce-IETI - C:\Program Files\Skype\Phone\IEPlugin\unins000.exe


.
------- Skan uzupełniający -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.pl/
R1 -: HKCU-SearchURL,(Default) = hxxp://www.searchgateway.net/search/%s
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-16 12:54:52
Windows 6.0.6000  NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-10-16 12:57:37
ComboFix-quarantined-files.txt  2008-10-16 10:56:55

Przed: System nie może znaleźć komunikatu dla numeru komunikatu 0x2379 w pliku komunikatów dla Application.
Po: 17,922,625,536 bajtów wolnych

210   --- E O F ---   2008-10-15 21:53:15

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:22, on 2008-10-16
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\TabUserW.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Lexmark 2600 Series\lxdnmon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Opera\opera.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchgateway.net/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchgateway.net/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lxdnmon.exe] "C:\Program Files\Lexmark 2600 Series\lxdnmon.exe"
O4 - HKLM\..\Run: [lxdnamon] "C:\Program Files\Lexmark 2600 Series\lxdnamon.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JR1916~1.0_0\bin\ssv.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Unknown owner - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe (file missing)
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe
O23 - Service: lxdn_device -   - C:\Windows\system32\lxdncoms.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9438 bytes


[Okocza]

otwórz notatnik i wklej:

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{895037da-3525-11dd-b0be-001b241263a5}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{163e6771-1f51-11dc-8ec1-001b241263a5}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]

zapisz jako Fix.reg i odpal

wróć z combofixem nowym

[biigos]

Kod: Zaznacz wszystko

ComboFix 08-10-15.06 - Ola 2008-10-16 17:26:28.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic   6.0.6000.0.1250.1.1045.18.400 [GMT 2:00]
Uruchomiony z: C:\Users\Ola\Desktop\ComboFix.exe
* Resident AV is active

.

(((((((((((((((((((((((((   Pliki utworzone od 2008-09-16 do 2008-10-16  )))))))))))))))))))))))))))))))
.

Nie utworzono żadnych nowych plików w tym okresie

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-16 15:20   12,931   ----a-w   C:\Users\Ola\AppData\Roaming\nvModes.dat
2008-10-16 15:20   ---------   d-----w   C:\Users\Ola\AppData\Roaming\WTablet
2008-10-16 10:43   ---------   d-----w   C:\Program Files\Trend Micro
2008-10-16 09:57   ---------   d-----w   C:\Program Files\Windows Mail
2008-10-15 19:02   ---------   d-----w   C:\ProgramData\Lx_cats
2008-10-14 19:08   ---------   d-----w   C:\Users\Ola\AppData\Roaming\OpenOffice.org2
2008-10-05 21:52   ---------   d-----w   C:\Users\Ola\AppData\Roaming\Skype
2008-10-05 10:11   ---------   d-----w   C:\Users\Ola\AppData\Roaming\Azureus
2008-10-03 05:13   ---------   d-----w   C:\ProgramData\Kaspersky Lab
2008-10-02 03:49   826,368   ----a-w   C:\Windows\System32\wininet.dll
2008-10-02 03:49   56,320   ----a-w   C:\Windows\System32\iesetup.dll
2008-10-02 03:49   52,736   ----a-w   C:\Windows\AppPatch\iebrshim.dll
2008-10-02 03:48   26,624   ----a-w   C:\Windows\System32\ieUnatt.exe
2008-09-26 09:18   ---------   d-----w   C:\Program Files\Lexmark 2600 Series
2008-09-26 09:01   ---------   d-----w   C:\Program Files\Lexmark Toolbar
2008-09-18 04:35   3,505,208   ----a-w   C:\Windows\System32\ntkrnlpa.exe
2008-09-18 04:35   3,470,904   ----a-w   C:\Windows\System32\ntoskrnl.exe
2008-09-18 02:03   2,027,520   ----a-w   C:\Windows\System32\win32k.sys
2008-09-16 17:37   ---------   d-----w   C:\Program Files\EA GAMES
2008-08-26 01:12   290,304   ----a-w   C:\Windows\system32\drivers\srv.sys
2008-07-31 03:34   537,600   ----a-w   C:\Windows\AppPatch\AcLayers.dll
2008-07-31 03:34   449,536   ----a-w   C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:34   28,160   ----a-w   C:\Windows\System32\Apphlpdm.dll
2008-07-31 03:34   2,144,256   ----a-w   C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:34   173,056   ----a-w   C:\Windows\AppPatch\AcXtrnal.dll
2008-07-31 03:34   1,686,528   ----a-w   C:\Windows\System32\gameux.dll
2008-07-30 23:47   4,247,552   ----a-w   C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-30 23:32   2,560   ----a-w   C:\Windows\AppPatch\AcRes.dll
2008-07-19 05:10   53,448   ----a-w   C:\Windows\System32\wuauclt.exe
2008-07-19 05:10   45,768   ----a-w   C:\Windows\System32\wups2.dll
2008-07-19 05:10   36,552   ----a-w   C:\Windows\System32\wups.dll
2008-07-19 05:09   563,912   ----a-w   C:\Windows\System32\wuapi.dll
2008-07-19 05:09   1,811,656   ----a-w   C:\Windows\System32\wuaueng.dll
2008-07-19 03:44   83,456   ----a-w   C:\Windows\System32\wudriver.dll
2008-07-19 03:44   1,524,736   ----a-w   C:\Windows\System32\wucltux.dll
2008-07-18 20:08   163,904   ----a-w   C:\Windows\System32\wuwebv.dll
2008-07-18 18:44   31,232   ----a-w   C:\Windows\System32\wuapp.exe
2008-07-13 07:39   174   --sha-w   C:\Program Files\desktop.ini
2008-04-14 13:57   0   ----a-w   C:\Users\Ola\AppData\Roaming\wklnhst.dat
2007-05-22 16:48   6,571,920   ----a-w   C:\Program Files\Opera_9.21_International_Setup.exe
.

(((((((((((((((((((((((((((((   snapshot@2008-10-16_12.55.59,70   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-16 10:01:00   2,048   --sha-w   C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-10-16 15:20:13   2,048   --sha-w   C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-10-16 10:01:00   2,048   --sha-w   C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-10-16 15:20:13   2,048   --sha-w   C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-10-16 10:02:41   262,144   --sha-w   C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-10-16 15:22:08   262,144   --sha-w   C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-10-16 10:03:12   262,144   --sha-w   C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-10-16 15:22:02   262,144   --sha-w   C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-10-16 15:22:02   262,144   ---ha-w   C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-10-15 18:50:33   103,924   ----a-w   C:\Windows\System32\perfc009.dat
+ 2008-10-16 11:35:27   103,924   ----a-w   C:\Windows\System32\perfc009.dat
- 2008-10-15 18:50:33   86,416   ----a-w   C:\Windows\System32\perfc015.dat
+ 2008-10-16 11:35:28   86,416   ----a-w   C:\Windows\System32\perfc015.dat
- 2008-10-15 18:50:33   610,142   ----a-w   C:\Windows\System32\perfh009.dat
+ 2008-10-16 11:35:27   610,142   ----a-w   C:\Windows\System32\perfh009.dat
- 2008-10-15 18:50:33   535,568   ----a-w   C:\Windows\System32\perfh015.dat
+ 2008-10-16 11:35:28   535,568   ----a-w   C:\Windows\System32\perfh015.dat
- 2008-10-16 10:02:01   6,029,312   ----a-w   C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-10-16 11:00:01   6,029,312   ----a-w   C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-10-16 10:03:31   13,292   ----a-w   C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2264648438-128847679-3440345005-1000_UserData.bin
+ 2008-10-16 15:22:09   13,384   ----a-w   C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2264648438-128847679-3440345005-1000_UserData.bin
- 2008-10-16 10:03:30   162,416   ----a-w   C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-10-16 15:22:09   162,524   ----a-w   C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-10-16 10:03:26   55,142   ----a-w   C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-10-16 15:22:06   55,142   ----a-w   C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 815104]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 159744]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-12-04 46704]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 472776]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-01-13 7766016]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-01-13 81920]
"Samsung PanelMgr"="C:\Windows\Samsung\PanelMgr\SSMMgr.exe" [2006-06-07 507904]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 200704]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 286720]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-01-15 172032]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"lxdnmon.exe"="C:\Program Files\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136]
"lxdnamon"="C:\Program Files\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="C:\Windows\SMINST\launcher.exe" [2006-11-07 44128]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BBD66B82-631A-4BC6-8519-46BE7831E95D}"= UDP:C:\Program Files\Hp\QuickPlay\QP.exe:QP
"{4BB6401A-2E97-401A-8D7B-C9A6056F6C0F}"= TCP:C:\Program Files\Hp\QuickPlay\QP.exe:QP
"TCP Query User{454D25F1-1030-42A4-A9D9-761F3E99BC84}C:\\programy\\gadu-gadu\\gg.exe"= UDP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"UDP Query User{BEEABBB6-3D04-4CE8-90F0-CB2FAB07110E}C:\\programy\\gadu-gadu\\gg.exe"= TCP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"TCP Query User{122DE662-1C7B-44E6-A249-F22F6094620E}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{4E677F18-EA76-4BBC-A3E7-3F8A1FC72822}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{B1E79B37-A45A-49EC-A1A8-60AA92482649}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{C26B988C-6377-442B-BF6D-636704229376}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{7C043890-6E2F-4C4D-92F2-E48B00BC95EA}C:\\program files\\napi-projekt\\napisy.exe"= UDP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"UDP Query User{5C2D49F7-CE69-41A6-9330-899D78640B4F}C:\\program files\\napi-projekt\\napisy.exe"= TCP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"TCP Query User{53326DA0-724D-4D05-8AFF-EFDD52440E18}C:\\program files\\opera\\opera.exe"= UDP:C:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{A066C898-7264-4205-B8F0-ABA74099AE5C}C:\\program files\\opera\\opera.exe"= TCP:C:\program files\opera\opera.exe:Opera Internet Browser
"TCP Query User{D95DA246-7DE6-4ED8-AFE0-400D6F4A4649}C:\\program files\\skype\\phone\\skype.exe"= Disabled:UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{8F7F6AA7-936F-4031-81A6-B49233233F64}C:\\program files\\skype\\phone\\skype.exe"= Disabled:TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{D57A326D-6B68-46BD-B044-91FF8B1D9835}C:\\programy\\gadu-gadu\\gg.exe"= UDP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"UDP Query User{195736B6-77CA-4322-A4BC-C3A39EBE10E5}C:\\programy\\gadu-gadu\\gg.exe"= TCP:C:\programy\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"TCP Query User{3BA36ECE-E9F5-460A-B0AC-8F0E3CDFED53}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{2B1AACCE-4F46-44FB-8822-7E94C46F192F}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{441837EA-9DA0-42D7-9092-FB3C9B3562C5}"= UDP:C:\Program Files\NetScream\NetScream.exe:NetScream
"{4A35D7A2-C4B5-4F37-AE51-08B44EBA7022}"= TCP:C:\Program Files\NetScream\NetScream.exe:NetScream
"TCP Query User{65DA2567-71EF-4396-9A85-9EA6ADBAD947}C:\\program files\\bittyrant\\azureus.exe"= UDP:C:\program files\bittyrant\azureus.exe:Azureus
"UDP Query User{0BC03E7D-EF47-4BC0-800A-BAF2E35B6FFE}C:\\program files\\bittyrant\\azureus.exe"= TCP:C:\program files\bittyrant\azureus.exe:Azureus
"TCP Query User{25997DDA-EEC8-4817-85F7-314C169A94A7}C:\\program files\\napi-projekt\\napisy.exe"= UDP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"UDP Query User{46A5D687-5C3F-49CB-B31A-0247AD30E0ED}C:\\program files\\napi-projekt\\napisy.exe"= TCP:C:\program files\napi-projekt\napisy.exe:www.napiprojekt.pl
"TCP Query User{03637D08-375E-48DA-8397-46F94363A582}C:\\program files\\bittyrant\\azureus.exe"= UDP:C:\program files\bittyrant\azureus.exe:Azureus
"UDP Query User{51D7112A-1ABA-4D2E-8B24-3AE76225BC01}C:\\program files\\bittyrant\\azureus.exe"= TCP:C:\program files\bittyrant\azureus.exe:Azureus
"{88792DB3-02F6-4B47-ACFC-9CD28AE7D09B}"= C:\Program Files\Cyberlink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
"{9064C39A-D2F3-4FA5-AA2F-1718B376F38E}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{58320991-5365-41B1-925B-5AD668FAFF1A}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{6FF2599E-DC7F-4D11-9A61-2F6959F9C7AA}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{B858C51D-ECCC-4299-A179-A29523582961}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{A1392393-6B41-4C41-B49A-691BF4466926}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{8CE69CE0-D8AB-410D-A347-46C9BF111640}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{2AA84D09-8636-47B2-9FD2-306206DCB523}"= UDP:C:\Windows\System32\lxdncoms.exe:Lexmark Communications System
"{F0937DBF-441E-42BD-ADF2-EC2EED1B3F1B}"= TCP:C:\Windows\System32\lxdncoms.exe:Lexmark Communications System
"{A3ABCD3D-6858-48D0-9201-93AF0F13E7C8}"= UDP:C:\Program Files\Lexmark 2600 Series\lxdnamon.exe:Lexmark Device Monitor
"{49321B31-C63C-4F27-A56D-8132C23E0661}"= TCP:C:\Program Files\Lexmark 2600 Series\lxdnamon.exe:Lexmark Device Monitor
"{22C603EA-1ACE-42C5-8208-6BC605DF0D24}"= UDP:C:\Program Files\Lexmark 2600 Series\frun.exe:Lexmark Productivity Studio
"{04FCD1F3-393E-4D05-84EA-22AC9ACB3EEA}"= TCP:C:\Program Files\Lexmark 2600 Series\frun.exe:Lexmark Productivity Studio
"{FF359425-0EA1-420D-83B6-6C51E4EACA13}"= UDP:C:\Program Files\Lexmark 2600 Series\lxdnmon.exe:Printer Device Monitor
"{ABA3CD05-A6DE-4E18-9811-F0417C658461}"= TCP:C:\Program Files\Lexmark 2600 Series\lxdnmon.exe:Printer Device Monitor
"{E0701B15-DBDF-46B0-AE0B-470392D9F000}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"{D50E7D31-BAB4-49E1-893C-30DACFF3F22E}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnpswx.exe:Printer Status Window Interface
"{1B518C16-D198-415D-967B-7BDE8476CFF0}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdntime.exe:Lexmark Connect Time Executable
"{98F581C1-52D4-4EA3-B6D0-523EDE1F3D1A}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdntime.exe:Lexmark Connect Time Executable
"{54020A12-15C7-4047-A474-DA900D55A5D6}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnjswx.exe:Job Status Window Interface
"{14F2F0E4-30AE-43F5-990E-E23F6DD809A8}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdnjswx.exe:Job Status Window Interface
"TCP Query User{C207E556-F713-44A7-8F11-0C9E2CB3BC9A}C:\\program files\\lexmark 2600 series\\lxdnmon.exe"= UDP:C:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor
"UDP Query User{102F9806-77E5-4FF3-8456-FE2C6BCD55A9}C:\\program files\\lexmark 2600 series\\lxdnmon.exe"= TCP:C:\program files\lexmark 2600 series\lxdnmon.exe:Printer Device Monitor

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51 13560]
R2 lxdn_device;lxdn_device;C:\Windows\system32\lxdncoms.exe [2007-12-05 594600]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\Windows\system32\DRIVERS\wacomvhid.sys [2007-02-16 12848]
S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2007-12-05 98984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork   REG_MULTI_SZ      PLA DPS BFE mpssvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\setupM2008Podst.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eed73a9e-2108-11dd-8ce5-001b241263a5}]
\shell\AutoRun\command - I:\EXPLORER.EXE
\shell\explore\Command - I:\EXPLORER.EXE
\shell\open\Command - I:\EXPLORER.EXE
.
Zawartość folderu 'Zaplanowane zadania'

2008-10-16 C:\Windows\Tasks\User_Feed_Synchronization-{867F636F-2067-4194-BA2A-1498D132ED45}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
.
.
------- Skan uzupełniający -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.pl/
R1 -: HKCU-SearchURL,(Default) = hxxp://www.searchgateway.net/search/%s
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-16 17:32:21
Windows 6.0.6000  NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-10-16 17:36:20
ComboFix-quarantined-files.txt  2008-10-16 15:36:15
ComboFix2.txt  2008-10-16 10:57:38

Przed: System nie może znaleźć komunikatu dla numeru komunikatu 0x2379 w pliku komunikatów dla Application.
Po: 17,830,268,928 bajtów wolnych

222   --- E O F ---   2008-10-15 21:53:15


[Okocza]

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eed73a9e-2108-11dd-8ce5-001b241263a5}]

wklej jeszcze to do notatnika i ponownie to samo - Fix.reg i odpalasz.

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp (ewentualnie tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

[biigos]

To tak, wszystko ladnie poszlo oprocz ot move it, nie chce wystartowac, moze dlatego ze to vista,
wiec po restarcie dalej to samo, wiec go wylaczylem, i za 2 razem poszedl. teraz tak, w viscie da sie wy;aczyc info ktore za kazdym razem po wlaczeniu kompa informuje ze zostaly zamkniete programy przy uruchamianiu systemu, za kazdym razem sie to pokazuje i jest meczace...

Daje screena:
http://img380.imageshack.us/my.php?image=procesylz0.jpg

[Okocza]

pcsuite
lxdnmon.exe
lxdnamon

wyłączasz.

ktore za kazdym razem po wlaczeniu kompa informuje ze zostaly zamkniete programy przy uruchamianiu systemu, za kazdym razem sie to pokazuje i jest meczace...

'niektore programy startowe zostaly zablokowane'

[biigos]

tak wlasnie tak
ale to sa rzeczy do drukarki, a nie chce zeby miala z tym problemy, bo ona sie zna na tym jak... to moze zostawie przynajmniej te 2??
xdnmon.exe
lxdnamon

a pc suite po wylaczeniu , trzeba od nowa instalowac po podlaczeniu tel do laptopa wiec dlatego to zostawilem...

Dodano 16.10.2008 17:57:49:
teraz w ogole wlaczyl sie ale puplit carny i tylko pasek widze...a w menadzeze jest tyle otwartych procesorow ze on na 100% teraz ciagnie...eh zaraz zbiore lomot chyba jak jej nie bedzie dzialal... pomoz

[Okocza]

jaki proces najwięcej zabiera i powiedz mi jeszcze jaki to jest laptop, tzn co jest w środku.

tak wlasnie tak

klikasz na ikonkę z której wychodzi ten 'dymek'

to moze zostawie przynajmniej te 2??

ale będzie więcej zasobów zabierać, a jak będzie chciała coś wydrukować to się samo włączy.

[biigos]

hp pavilion dv6000
kurcze teraz jest tylko pasek na dole z ikonkami pulpit nic, nic nie mozna kliknac w ogole go nie ma....
a procesy sa ok, pomylilem sie i popatrzylem w uslugi....co mam zrobic?? proooszeee bo jest gorzej niz byle hehe....

[Okocza]

po 1: Vista na tym laptopie będzie przymulać.

po 2: Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[biigos]

kurcze klikam pojawia sie niebieski ekran i znika... w trybie awaryjnym oczywisice

[Okocza]

kurcze klikam pojawia sie niebieski ekran i znika... w trybie awaryjnym oczywisice

Prawym na ,,Mój komputer">właściwości>Zakładka "Zaawansowane" -> Uruchamianie i odzyskiwanie i klikamy "ustawienia">
w części "Awaria systemu" odznaczamy pole "Automatycznie uruchom ponownie"

teraz zamiast resetu pojawi sie bluescreen przepisz kod bledu z dolu strony bluescreena

[biigos]

nic nie pomoglo
i zadneg kodu bledu nie ma

[Okocza]

kurcze klikam pojawia sie niebieski ekran i znika... w trybie awaryjnym oczywisice

spróbuj wejść w ten awaryjny teraz i jak Ci wyskoczy to przepisz kod błędu... jak nie wyskoczy to rób to o co prosiłem - czyli SDFixa

[biigos]

ale ja caly czas w awaryjnym i znika...bo normalnie nie ma pulpitu wiec w normalym nic nie ma.... ale mi sie zebralo...pomoz mi przynajmniej wrocic do poprzedniej konfiguracji....

[Okocza]

pomoz mi przynajmniej wrocic do poprzedniej konfiguracji....

masz płytę od Windowsa

włóż płytkę windowsa - zbootuj ją. wejdź do konsoli (naprawa systemu) i w niej wpisz

chkdsk x: /p

gdzie x to litera partycji systemowej


jeśli nie to podczas uruchamiania laptopa naciśnij f8 i wybierz 'ostatnia znana konfiguracja'

[biigos]

nie mam.....nie strasz mnie ze tego sie nie da inaczej zrobic...

[Okocza]

koniec kafejki. Robisz to o co proszę.

podczas uruchamiania laptopa naciśnij f8 i wybierz 'ostatnia znana konfiguracja'

jeśli nie pomoże próbujesz wejść do awaryjnego/normalnego i tam wpisujesz:

chkdsk x: /p

gdzie x to litera partycji systemowej

[biigos]

probowalem ost dobra konfig nic nie dziala, odrazu okienko explorera ze zostaje zamkniety i koniec...nie ma puplitu proszeee....teraz prubuje chkdsk x: /p

[Okocza]

explorera ze zostaje zamkniety i koniec

menedżer zdań - plik - nowe zdanie - explorer.exe - ok