Coś się dzieje z systemem :(

[Orygano (Bladeus)]

Od kilku dni mam problem u taty w laptopie z oglądaniem stron internetowych, zchodzi obraz w dół :(, tak samo w programach takich co może być przyczyną takiego zachowania się kompa

w trybie awaryjnym to samo, co jest, laptop wariuje, na pulpicie cały czas podświetla ostatnią dolną ikonę w lewym dolnym rogu

Log z ComboFix

ComboFix 08-11-07.01 - Roman 2008-11-08 0:31:54.17 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.294 [GMT 1:00] Uruchomiony z: c:\documents and settings\Roman\Moje dokumenty\Instalki\qw123.exe UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-07 do 2008-11-07 ))))))))))))))))))))))))))))))) . 2008-11-07 21:57 . 2008-11-07 22:38 250 --a------ c:\windows\gmer.ini 2008-11-07 18:17 . 2008-11-07 18:17 2008-11-07 14:23 . 2008-11-07 14:23 2008-11-07 14:23 . 2008-11-07 14:23 2008-11-07 14:23 . 2008-11-07 14:23 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-11-07 13:59 . 2008-11-07 13:59 2008-11-07 13:59 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll 2008-11-07 13:59 . 2008-05-30 14:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll 2008-11-07 13:58 . 2008-11-07 13:58 2008-11-07 13:58 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll 2008-11-07 13:58 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll 2008-11-07 13:58 . 2007-07-19 18:14 1,358,192 --a------ c:\windows\system32\D3DCompiler_35.dll 2008-11-07 13:58 . 2007-07-19 18:14 444,776 --a------ c:\windows\system32\d3dx10_35.dll 2008-11-06 23:09 . 2008-11-06 23:09 2008-11-05 22:10 . 2008-11-05 22:10 8,272 —hs---- c:\windows\system32`.vbe 2008-11-05 22:10 . 2008-11-05 22:10 8,272 —hs---- c:\windows`.vbe 2008-11-05 00:20 . 2008-11-05 00:20 2008-10-31 18:17 . 2008-10-31 18:17 2008-10-27 23:29 . 2008-10-27 23:30 2008-10-27 23:23 . 2008-11-03 22:22 2008-10-23 23:37 . 2008-10-23 23:37 2008-10-23 22:32 . 2008-10-15 17:36 337,408 -----c— c:\windows\system32\dllcache\netapi32.dll 2008-10-23 15:07 . 2008-10-23 15:07 2008-10-23 14:56 . 2008-10-27 21:50 2008-10-23 14:28 . 2008-10-23 14:29 2008-10-23 14:27 . 2008-10-23 14:27 2008-10-23 13:20 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll 2008-10-23 13:20 . 2008-04-17 12:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys 2008-10-23 13:19 . 2008-10-23 13:20 2008-10-23 13:19 . 2008-10-23 13:19 2008-10-23 13:19 . 2008-10-23 13:20 2008-10-23 13:17 . 2008-10-23 13:18 2008-10-23 13:14 . 2008-10-23 13:14 2008-10-23 13:14 . 2008-10-23 13:14 2008-10-22 21:47 . 2008-10-22 21:47 2008-10-21 22:37 . 2008-04-13 19:45 26,112 --a------ c:\windows\system32\drivers\usbser.sys 2008-10-21 22:37 . 2008-04-13 19:45 26,112 --a–c— c:\windows\system32\dllcache\usbser.sys 2008-10-21 22:36 . 2008-10-21 22:36 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-21 22:36 . 2008-10-21 22:36 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-21 22:34 . 2008-10-21 22:37 2008-10-21 22:34 . 2008-10-21 22:40 2008-10-21 22:34 . 2008-10-21 22:37 2008-10-21 22:33 . 2008-11-05 00:20 2008-10-21 22:31 . 2008-10-21 22:31 2008-10-21 22:31 . 2008-10-21 22:31 2008-10-21 22:31 . 2007-09-17 14:53 21,632 --a------ c:\windows\system32\drivers\pccsmcfd.sys 2008-10-21 22:30 . 2008-11-05 00:20 2008-10-21 22:30 . 2008-05-07 07:38 90,624 --a------ c:\windows\system32\nmwcdcls.dll 2008-10-21 22:28 . 2008-11-05 00:16 2008-10-21 22:02 . 2008-10-21 22:02 2008-10-21 22:02 . 2008-10-21 22:02 2008-10-19 22:22 . 2008-04-14 18:20 69,120 --------- c:\windows\system32\wlanapi.dll 2008-10-19 22:21 . 2008-04-14 18:20 50,688 --------- c:\windows\system32\tspkg.dll 2008-10-19 22:20 . 2008-04-14 18:20 293,376 --------- c:\windows\system32\qagentrt.dll 2008-10-19 22:20 . 2008-04-14 18:20 150,528 --------- c:\windows\system32\qagent.dll 2008-10-19 22:20 . 2008-04-14 18:20 144,896 --------- c:\windows\system32\onex.dll 2008-10-19 22:20 . 2008-04-14 18:20 76,800 --------- c:\windows\system32\qutil.dll 2008-10-19 22:20 . 2008-04-14 18:20 62,464 --------- c:\windows\system32\qcliprov.dll 2008-10-19 22:20 . 2008-04-14 18:20 61,952 --------- c:\windows\system32\rasqec.dll 2008-10-19 22:20 . 2008-04-14 18:21 32,768 --------- c:\windows\system32\setupn.exe 2008-10-19 22:20 . 2008-04-13 19:40 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2008-10-19 22:19 . 2008-04-14 18:20 1,306,624 -----c— c:\windows\system32\dllcache\msxml6.dll 2008-10-19 22:19 . 2008-04-14 18:20 196,608 --------- c:\windows\system32\napmontr.dll 2008-10-19 22:19 . 2008-04-14 18:21 176,640 --------- c:\windows\system32\napstat.exe 2008-10-19 22:19 . 2008-04-14 18:20 155,136 --------- c:\windows\system32\mssha.dll 2008-10-19 22:19 . 2008-04-14 17:22 89,600 -----c— c:\windows\system32\dllcache\msxml6r.dll 2008-10-19 22:19 . 2008-04-14 17:20 80,896 --------- c:\windows\system32\msshavmsg.dll 2008-10-19 22:19 . 2008-04-14 18:20 30,720 --------- c:\windows\system32\napipsec.dll 2008-10-19 22:18 . 2008-04-14 18:20 397,312 --------- c:\windows\system32\mmcex.dll 2008-10-19 22:18 . 2008-04-14 18:20 184,320 --------- c:\windows\system32\microsoft.managementconsole.dll 2008-10-19 22:18 . 2008-04-14 18:20 106,496 --------- c:\windows\system32\mmcfxcommon.dll 2008-10-19 22:18 . 2008-04-14 18:20 61,440 --------- c:\windows\system32\kmsvc.dll 2008-10-19 22:18 . 2008-04-14 18:20 37,376 --------- c:\windows\system32\l2gpstore.dll 2008-10-19 22:18 . 2008-04-14 18:21 33,792 --------- c:\windows\system32\mmcperf.exe 2008-10-19 22:16 . 2008-04-14 18:20 651,264 --------- c:\windows\system32\dot3ui.dll 2008-10-19 22:16 . 2008-04-14 18:20 233,472 --------- c:\windows\system32\azroles.dll 2008-10-19 22:16 . 2008-04-14 18:20 133,632 --------- c:\windows\system32\dot3svc.dll 2008-10-19 22:16 . 2008-04-14 18:20 59,904 --------- c:\windows\system32\dot3cfg.dll 2008-10-19 22:16 . 2008-04-14 18:20 56,832 --------- c:\windows\system32\dot3msm.dll 2008-10-19 22:16 . 2008-04-14 18:20 48,640 --------- c:\windows\system32\dhcpqec.dll 2008-10-19 22:16 . 2008-04-14 18:20 39,936 --------- c:\windows\system32\dot3gpclnt.dll 2008-10-19 22:16 . 2008-04-14 18:20 39,936 --------- c:\windows\system32\dimsroam.dll 2008-10-19 22:16 . 2008-04-14 18:20 26,112 --------- c:\windows\system32\dot3api.dll 2008-10-19 22:16 . 2008-04-14 18:20 19,456 --------- c:\windows\system32\dimsntfy.dll 2008-10-19 22:16 . 2008-04-14 18:20 12,800 --------- c:\windows\system32\credssp.dll 2008-10-19 22:16 . 2008-04-14 18:20 9,216 --------- c:\windows\system32\dot3dlg.dll 2008-10-19 22:16 . 2008-04-14 18:20 7,168 --------- c:\windows\system32\bitsprx4.dll 2008-10-17 10:15 . 2008-10-17 10:24 2008-10-17 08:48 . 2008-10-17 08:47 410,976 --a------ c:\windows\system32\deploytk.dll 2008-10-17 08:48 . 2008-10-17 08:47 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-10-16 16:12 . 2008-10-16 16:12 2008-10-15 08:42 . 2008-07-18 21:07 270,880 --a------ c:\windows\system32\mucltui.dll 2008-10-15 08:42 . 2008-07-18 21:07 210,976 --a------ c:\windows\system32\muweb.dll 2008-10-15 08:42 . 2008-07-18 21:07 29,728 --a------ c:\windows\system32\mucltui.dll.mui 2008-10-15 08:34 . 2006-10-26 18:56 32,592 --a------ c:\windows\system32\msonpmon.dll 2008-10-15 08:32 . 2008-10-15 08:32 2008-10-15 08:24 . 2008-10-15 08:24 2008-10-15 08:23 . 2008-10-15 08:39 2008-10-15 08:22 . 2008-10-30 18:06 2008-10-15 07:54 . 2008-09-08 11:41 333,824 -----c— c:\windows\system32\dllcache\srv.sys 2008-10-15 07:53 . 2008-08-14 14:26 2,190,464 -----c— c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-15 07:53 . 2008-08-14 14:26 2,146,816 -----c— c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-15 07:53 . 2008-08-14 14:26 2,067,328 -----c— c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-15 07:53 . 2008-08-14 14:26 2,025,472 -----c— c:\windows\system32\dllcache\ntkrpamp.exe 2008-10-15 07:53 . 2008-09-15 16:27 1,846,656 -----c— c:\windows\system32\dllcache\win32k.sys 2008-10-11 19:55 . 2008-10-11 19:55 0 --a------ c:\windows\nsreg.dat 2008-10-11 12:36 . 2008-10-11 12:36 2008-10-11 12:36 . 2008-10-14 16:18 2008-10-11 10:59 . 2008-11-06 22:31 2008-10-08 20:05 . 2008-10-08 20:05 2008-10-08 19:55 . 2008-10-08 20:07 140,676 --a------ c:\windows\HPHins13.dat 2008-10-08 19:55 . 2007-01-22 17:05 2,977 --------- c:\windows\hphmdl13.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-07 17:59 --------- d-----w c:\program files\AutoCAD R14 2008-11-07 17:33 --------- d–h--w c:\program files\InstallShield Installation Information 2008-11-06 05:37 21 --sh–w C:\date.bin 2008-10-26 17:13 --------- d-----w c:\program files\Google 2008-10-23 12:19 --------- d-----w c:\program files\iPod 2008-10-23 12:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-10-17 07:47 --------- d-----w c:\program files\Java 2008-10-15 07:31 --------- d-----w c:\program files\MSBuild 2008-10-14 17:44 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP 2008-10-08 19:06 --------- d-----w c:\program files\HP 2008-10-08 19:06 --------- d-----w c:\program files\Common Files\HP 2008-09-25 14:10 --------- d-----w c:\program files\DivX 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys 2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll 2008-08-26 08:27 826,368 ----a-w c:\windows\system32\wininet.dll 2008-08-14 13:26 2,190,464 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 13:26 2,067,328 ----a-w c:\windows\system32\ntkrnlpa.exe 2007-12-28 16:29 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 1997-07-21 17:30 1,045,776 --sha-w c:\windows\system32\Msjet35.dll 1997-06-23 01:00 123,664 --sha-w c:\windows\system32\Msjint35.dll 1997-06-23 10:06 24,848 --sha-w c:\windows\system32\Msjter35.dll 1997-06-23 10:06 252,176 --sha-w c:\windows\system32\Msrd2x35.dll 1997-06-23 10:06 287,504 --sha-w c:\windows\system32\Msxbse35.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-07_18.54.10.93 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-07 20:56:57 884,736 ----a-w c:\windows\gmer.dll + 2008-04-17 20:13:02 811,008 ----a-w c:\windows\gmer.exe + 2008-11-07 20:56:57 85,969 ----a-w c:\windows\system32\drivers\gmer.sys + 2008-11-07 23:39:44 16,384 ----atw c:\windows\temp\Perflib_Perfdata_710.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360] “LDM”=“c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe” [2007-03-14 67128] “MSMSGS”=“c:\program files\Messenger\msmsgs.exe” [2008-04-14 1695232] “PC Suite Tray”=“c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe” [2008-10-02 1124352] “Nokia.PCSync”=“c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe” [2008-06-17 1249280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SigmaTel StacMon”=“c:\program files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe” [2003-08-03 86073] “SynTPLpr”=“c:\program files\Synaptics\SynTP\SynTPLpr.exe” [2003-05-30 110592] “SynTPEnh”=“c:\program files\Synaptics\SynTP\SynTPEnh.exe” [2003-05-30 614400] “TouchED”=“c:\program files\TOSHIBA\TouchED\TouchED.Exe” [2003-03-13 122880] “PRONoMgr.exe”=“c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe” [2003-12-10 86016] “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2008-06-12 34672] “HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe” [2006-12-10 49152] “GrooveMonitor”=“c:\program files\Microsoft Office\Office12\GrooveMonitor.exe” [2007-08-24 33648] “SunJavaUpdateSched”=“c:\program files\Java\jre6\bin\jusched.exe” [2008-10-17 136600] “QuickTime Task”=“c:\program files\QuickTime\QTTask.exe” [2008-09-06 413696] “iTunesHelper”=“c:\program files\iTunes\iTunesHelper.exe” [2008-10-01 289576] “nwiz”=“nwiz.exe” [2003-08-28 c:\windows\system32\nwiz.exe] “000StTHK”=“000StTHK.exe” [2001-06-23 19:28 24576 c:\windows\system32\000StTHK.exe] “TFNF5”=“TFNF5.exe” [2003-07-18 c:\windows\system32\TFNF5.exe] “LTSMMSG”=“LTSMMSG.exe” [2003-04-18 c:\windows\ltsmmsg.exe] “TFncKy”=“TFncKy.exe” [bU] “TPSMain”=“TPSMain.exe” [2003-10-06 c:\windows\system32\TPSMain.exe] “Logitech Utility”=“Logi_MwX.Exe” [2003-12-11 c:\windows\LOGI_MWX.EXE] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE” [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-14 67128] RAMASST.lnk - c:\windows\system32\RAMASST.exe [2004-09-12 155648] Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2003-12-16 15:49 110592 c:\windows\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusDisableNotify”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe”= “c:\Program Files\Gadu-Gadu\gg.exe”= “c:\Program Files\Skype\Phone\Skype.exe”= “c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”= “c:\Program Files\Microsoft Office\Office12\GROOVE.EXE”= “c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”= “%windir%\Network Diagnostic\xpnetdiag.exe”= “%windir%\system32\sessmgr.exe”= “c:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe”= “c:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe”= “c:\Program Files\Bonjour\mDNSResponder.exe”= “c:\Program Files\iTunes\iTunes.exe”= “c:\Program Files\eMule\emule.exe”= R2 JavaQuickStarterService;Java Quick Starter;c:\program files\Java\jre6\bin\jqs.exe [2008-10-17 152984] S3 cmusbser;%CMUSBSER%;c:\windows\system32\DRIVERS\cmusbser.sys [2006-12-13 87040] S3 jfdcd;jfdcd;c:\docume~1\Roman\USTAWI~1\Temp\jfdcd.sys [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{419bee40-81a4-11dc-b47d-000e353cdc9f}] \Shell\AutoRun\command - WScript.exe .`.vbs \Shell\open\Command - WScript.exe .`.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{e69000c4-3879-11dc-b3ca-000e353cdc9f}] \Shell\AutoRun\command - F:\USBNB.exe . Zawartość folderu ‘Zaplanowane zadania’ 2008-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Roman\Dane aplikacji\Mozilla\Firefox\Profiles\mfs01kih.default\ FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-08 00:39:52 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów … skanowanie ukrytych wpisów autostartu … skanowanie ukrytych plików … skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\S24EvMon.exe c:\windows\system32\ZCfgSvc.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Toshiba\ConfigFree\CFSvcs.exe c:\program files\Toshiba\TOSHIBA Controls\TFncKy.exe c:\windows\system32\DVDRAMSV.exe c:\windows\system32\TPSBattM.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\RegSrvc.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\iPod\bin\iPodService.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe c:\windows\system32\1XConfig.exe c:\windows\system32\wbem\wmiapsrv.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe . ************************************************************************** . Czas ukończenia: 2008-11-08 0:45:28 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-11-07 23:45:23 ComboFix2.txt 2008-11-07 17:54:44 ComboFix3.txt 2008-11-06 16:28:43 Przed: 16 977 625 088 bajtów wolnych Po: 17,216,962,560 bajtów wolnych 277 — E O F — 2008-10-29 13:13:18 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:04:39, on 2008-11-08 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\TFNF5.exe C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\LTSMMSG.exe C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe C:\WINDOWS\system32\TPSMain.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\TPSBattM.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\RAMASST.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\RegSrvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe C:\WINDOWS\System32\1XConfig.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Roman\Moje dokumenty\Instalki\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM…\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM…\Run: [000StTHK] 000StTHK.exe O4 - HKLM…\Run: [TFNF5] TFNF5.exe O4 - HKLM…\Run: [sigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe O4 - HKLM…\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM…\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe O4 - HKLM…\Run: [LTSMMSG] LTSMMSG.exe O4 - HKLM…\Run: [TFncKy] TFncKy.exe O4 - HKLM…\Run: [TPSMain] TPSMain.exe O4 - HKLM…\Run: [PRONoMgr.exe] c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe O4 - HKLM…\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe” O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [GrooveMonitor] “C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre6\bin\jusched.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [PC Suite Tray] “C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe” -onlytray O4 - HKCU…\Run: [Nokia.PCSync] “C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe” /NoDialog O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O4 - Global Startup: Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm O8 - Extra context menu item: Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm O8 - Extra context menu item: Eksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Eksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock...ash/swflash.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe – End of file - 10052 bytes A GMER pokazał mi takie coś na wstępie GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2008-11-07 22:36:10 Windows 5.1.2600 Dodatek Service Pack 3 ---- Kernel code sections - GMER 1.0.14 ---- ? Combo-Fix.sys Nie można odnaleźć określonego pliku. ! ? C:\ComboFix\catchme.sys System nie może odnaleźć określonej ścieżki. ! ? C:\WINDOWS\system32\Drivers\PROCEXP90.SYS Nie można odnaleźć określonego pliku. ! ---- Devices - GMER 1.0.14 ---- AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Sterownik klasy myszy/Microsoft Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) ---- EOF - GMER 1.0.14 ----

[technik_elektro]

może zwyczajnie an klawiaturze masz przyciśnięty na stałe jakiś klawisz np pg dn :P.

[Orygano (Bladeus)]

sprawdziłem teraz klawisze i wszystkie mam wporzo, to się zaczeło dziać jak moja kochana siotra włożyła pena i na drugi dzień jak włączyłem lapa to takie coś się dzieje…

[Gutek]

Wklej do Notatnika:

Driver::

jfdcd


Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo oraz skan http://www.kaspersky.pl/virusscanner.html

Dodatkowo - wykonaj skan Dr. Web CureIt

Po tym

Optymalizacja XP: viewtopic.php?t=76580

Optymalizacja autostartu: http://www.bezpieczenstwosystemow.pl/in … opic=116.0

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2t=29id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2t=29id=509

Opis RegCleaner - http://www.agavk.p9.pl/strony/progra_regcleaner.php

Zobacz - Obsługa jv16 PowerTools

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16t=253052

[Orygano (Bladeus)]

teraz sobie lapa włączyłem przy włączonym głosie, przy włączaniu kompa wygaje no może przez 30 sek taki ciągły dzwięk. Nie wiem czy z systemem się coś nie włącza a potem system szaleje…!

[Gutek]

Możesz wykonać to o co prosiłem?

[Orygano (Bladeus)]

Log z ComboFix

ComboFix 08-11-07.01 - Roman 2008-11-09 16:38:26.18 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.194 [GMT 1:00] Uruchomiony z: c:\documents and settings\Roman\Moje dokumenty\Instalki\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Roman\Moje dokumenty\Instalki\CFScript.txt * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA FILE :: C:`.vbs c:\windows`.vbe c:\windows\system32`.vbe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows`.vbe c:\windows\system32`.vbe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_JFDCD -------\Service_jfdcd ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-08 01:38 . 2007-12-06 18:12 110,592 --a------ c:\windows\system32\SynTPCo4.dll 2008-11-07 21:57 . 2008-11-08 07:57 250 --a------ c:\windows\gmer.ini 2008-11-07 18:17 . 2008-11-07 18:17 2008-11-07 14:23 . 2008-11-07 14:23 2008-11-07 14:23 . 2008-11-07 14:23 2008-11-07 14:23 . 2008-11-07 14:23 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-11-07 13:59 . 2008-11-07 13:59 2008-11-07 13:59 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll 2008-11-07 13:59 . 2008-05-30 14:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll 2008-11-07 13:58 . 2008-11-07 13:58 2008-11-07 13:58 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll 2008-11-07 13:58 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll 2008-11-07 13:58 . 2007-07-19 18:14 1,358,192 --a------ c:\windows\system32\D3DCompiler_35.dll 2008-11-07 13:58 . 2007-07-19 18:14 444,776 --a------ c:\windows\system32\d3dx10_35.dll 2008-11-06 23:09 . 2008-11-06 23:09 2008-11-05 00:20 . 2008-11-05 00:20 2008-10-31 18:17 . 2008-10-31 18:17 2008-10-27 23:29 . 2008-10-27 23:30 2008-10-27 23:23 . 2008-11-03 22:22 2008-10-23 23:37 . 2008-10-23 23:37 2008-10-23 22:32 . 2008-10-15 17:36 337,408 -----c— c:\windows\system32\dllcache\netapi32.dll 2008-10-23 15:07 . 2008-10-23 15:07 2008-10-23 14:56 . 2008-10-27 21:50 2008-10-23 14:28 . 2008-10-23 14:29 2008-10-23 14:27 . 2008-10-23 14:27 2008-10-23 13:20 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll 2008-10-23 13:20 . 2008-04-17 12:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys 2008-10-23 13:19 . 2008-10-23 13:20 2008-10-23 13:19 . 2008-10-23 13:19 2008-10-23 13:19 . 2008-10-23 13:20 2008-10-23 13:17 . 2008-10-23 13:18 2008-10-23 13:14 . 2008-10-23 13:14 2008-10-23 13:14 . 2008-10-23 13:14 2008-10-22 21:47 . 2008-10-22 21:47 2008-10-21 22:37 . 2008-04-13 19:45 26,112 --a------ c:\windows\system32\drivers\usbser.sys 2008-10-21 22:37 . 2008-04-13 19:45 26,112 --a–c— c:\windows\system32\dllcache\usbser.sys 2008-10-21 22:36 . 2008-10-21 22:36 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-21 22:36 . 2008-10-21 22:36 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-21 22:34 . 2008-10-21 22:37 2008-10-21 22:34 . 2008-10-21 22:40 2008-10-21 22:34 . 2008-10-21 22:37 2008-10-21 22:33 . 2008-11-05 00:20 2008-10-21 22:31 . 2008-10-21 22:31 2008-10-21 22:31 . 2008-10-21 22:31 2008-10-21 22:31 . 2007-09-17 14:53 21,632 --a------ c:\windows\system32\drivers\pccsmcfd.sys 2008-10-21 22:30 . 2008-11-05 00:20 2008-10-21 22:30 . 2008-05-07 07:38 90,624 --a------ c:\windows\system32\nmwcdcls.dll 2008-10-21 22:28 . 2008-11-05 00:16 2008-10-21 22:02 . 2008-10-21 22:02 2008-10-21 22:02 . 2008-10-21 22:02 2008-10-19 22:22 . 2008-04-14 18:20 69,120 --------- c:\windows\system32\wlanapi.dll 2008-10-19 22:21 . 2008-04-14 18:20 50,688 --------- c:\windows\system32\tspkg.dll 2008-10-19 22:20 . 2008-04-14 18:20 293,376 --------- c:\windows\system32\qagentrt.dll 2008-10-19 22:20 . 2008-04-14 18:20 150,528 --------- c:\windows\system32\qagent.dll 2008-10-19 22:20 . 2008-04-14 18:20 144,896 --------- c:\windows\system32\onex.dll 2008-10-19 22:20 . 2008-04-14 18:20 76,800 --------- c:\windows\system32\qutil.dll 2008-10-19 22:20 . 2008-04-14 18:20 62,464 --------- c:\windows\system32\qcliprov.dll 2008-10-19 22:20 . 2008-04-14 18:20 61,952 --------- c:\windows\system32\rasqec.dll 2008-10-19 22:20 . 2008-04-14 18:21 32,768 --------- c:\windows\system32\setupn.exe 2008-10-19 22:20 . 2008-04-13 19:40 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2008-10-19 22:19 . 2008-04-14 18:20 1,306,624 -----c— c:\windows\system32\dllcache\msxml6.dll 2008-10-19 22:19 . 2008-04-14 18:20 196,608 --------- c:\windows\system32\napmontr.dll 2008-10-19 22:19 . 2008-04-14 18:21 176,640 --------- c:\windows\system32\napstat.exe 2008-10-19 22:19 . 2008-04-14 18:20 155,136 --------- c:\windows\system32\mssha.dll 2008-10-19 22:19 . 2008-04-14 17:22 89,600 -----c— c:\windows\system32\dllcache\msxml6r.dll 2008-10-19 22:19 . 2008-04-14 17:20 80,896 --------- c:\windows\system32\msshavmsg.dll 2008-10-19 22:19 . 2008-04-14 18:20 30,720 --------- c:\windows\system32\napipsec.dll 2008-10-19 22:18 . 2008-04-14 18:20 397,312 --------- c:\windows\system32\mmcex.dll 2008-10-19 22:18 . 2008-04-14 18:20 184,320 --------- c:\windows\system32\microsoft.managementconsole.dll 2008-10-19 22:18 . 2008-04-14 18:20 106,496 --------- c:\windows\system32\mmcfxcommon.dll 2008-10-19 22:18 . 2008-04-14 18:20 61,440 --------- c:\windows\system32\kmsvc.dll 2008-10-19 22:18 . 2008-04-14 18:20 37,376 --------- c:\windows\system32\l2gpstore.dll 2008-10-19 22:18 . 2008-04-14 18:21 33,792 --------- c:\windows\system32\mmcperf.exe 2008-10-19 22:16 . 2008-04-14 18:20 651,264 --------- c:\windows\system32\dot3ui.dll 2008-10-19 22:16 . 2008-04-14 18:20 233,472 --------- c:\windows\system32\azroles.dll 2008-10-19 22:16 . 2008-04-14 18:20 133,632 --------- c:\windows\system32\dot3svc.dll 2008-10-19 22:16 . 2008-04-14 18:20 59,904 --------- c:\windows\system32\dot3cfg.dll 2008-10-19 22:16 . 2008-04-14 18:20 56,832 --------- c:\windows\system32\dot3msm.dll 2008-10-19 22:16 . 2008-04-14 18:20 48,640 --------- c:\windows\system32\dhcpqec.dll 2008-10-19 22:16 . 2008-04-14 18:20 39,936 --------- c:\windows\system32\dot3gpclnt.dll 2008-10-19 22:16 . 2008-04-14 18:20 39,936 --------- c:\windows\system32\dimsroam.dll 2008-10-19 22:16 . 2008-04-14 18:20 26,112 --------- c:\windows\system32\dot3api.dll 2008-10-19 22:16 . 2008-04-14 18:20 19,456 --------- c:\windows\system32\dimsntfy.dll 2008-10-19 22:16 . 2008-04-14 18:20 12,800 --------- c:\windows\system32\credssp.dll 2008-10-19 22:16 . 2008-04-14 18:20 9,216 --------- c:\windows\system32\dot3dlg.dll 2008-10-19 22:16 . 2008-04-14 18:20 7,168 --------- c:\windows\system32\bitsprx4.dll 2008-10-17 10:15 . 2008-10-17 10:24 2008-10-17 08:48 . 2008-10-17 08:47 410,976 --a------ c:\windows\system32\deploytk.dll 2008-10-17 08:48 . 2008-10-17 08:47 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-10-16 16:12 . 2008-10-16 16:12 2008-10-15 08:42 . 2008-07-18 21:07 270,880 --a------ c:\windows\system32\mucltui.dll 2008-10-15 08:42 . 2008-07-18 21:07 210,976 --a------ c:\windows\system32\muweb.dll 2008-10-15 08:42 . 2008-07-18 21:07 29,728 --a------ c:\windows\system32\mucltui.dll.mui 2008-10-15 08:34 . 2006-10-26 18:56 32,592 --a------ c:\windows\system32\msonpmon.dll 2008-10-15 08:32 . 2008-10-15 08:32 2008-10-15 08:24 . 2008-10-15 08:24 2008-10-15 08:23 . 2008-10-15 08:39 2008-10-15 08:22 . 2008-10-30 18:06 2008-10-15 07:54 . 2008-09-08 11:41 333,824 -----c— c:\windows\system32\dllcache\srv.sys 2008-10-15 07:53 . 2008-08-14 14:26 2,190,464 -----c— c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-15 07:53 . 2008-08-14 14:26 2,146,816 -----c— c:\windows\system32\dllcache\ntkrnlmp.exe 2008-10-15 07:53 . 2008-08-14 14:26 2,067,328 -----c— c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-15 07:53 . 2008-08-14 14:26 2,025,472 -----c— c:\windows\system32\dllcache\ntkrpamp.exe 2008-10-15 07:53 . 2008-09-15 16:27 1,846,656 -----c— c:\windows\system32\dllcache\win32k.sys 2008-10-11 19:55 . 2008-10-11 19:55 0 --a------ c:\windows\nsreg.dat 2008-10-11 12:36 . 2008-10-11 12:36 2008-10-11 12:36 . 2008-10-14 16:18 2008-10-11 10:59 . 2008-11-06 22:31 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 10:19 --------- d-----w c:\program files\AutoCAD R14 2008-11-08 15:01 --------- d-----w c:\program files\Gadu-Gadu 2008-11-07 17:33 --------- d–h--w c:\program files\InstallShield Installation Information 2008-11-06 05:37 21 --sh–w C:\date.bin 2008-10-26 17:13 --------- d-----w c:\program files\Google 2008-10-23 12:19 --------- d-----w c:\program files\iPod 2008-10-23 12:17 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-10-17 07:47 --------- d-----w c:\program files\Java 2008-10-15 07:31 --------- d-----w c:\program files\MSBuild 2008-10-14 17:44 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP 2008-10-08 19:06 --------- d-----w c:\program files\HP 2008-10-08 19:06 --------- d-----w c:\program files\Common Files\HP 2008-10-08 19:05 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HPSSUPPLY 2008-09-25 14:10 --------- d-----w c:\program files\DivX 2007-12-28 16:29 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 1997-07-21 17:30 1,045,776 --sha-w c:\windows\system32\Msjet35.dll 1997-06-23 01:00 123,664 --sha-w c:\windows\system32\Msjint35.dll 1997-06-23 10:06 24,848 --sha-w c:\windows\system32\Msjter35.dll 1997-06-23 10:06 252,176 --sha-w c:\windows\system32\Msrd2x35.dll 1997-06-23 10:06 287,504 --sha-w c:\windows\system32\Msxbse35.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-07_18.54.10.93 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-07 20:56:57 884,736 ----a-w c:\windows\gmer.dll + 2008-04-17 20:13:02 811,008 ----a-w c:\windows\gmer.exe + 2008-11-07 20:56:57 85,969 ----a-w c:\windows\system32\drivers\gmer.sys - 2003-05-30 15:56:22 271,728 ----a-w c:\windows\system32\drivers\SynTP.sys + 2007-12-06 16:41:42 220,032 ----a-w c:\windows\system32\drivers\SynTP.sys + 2008-04-14 16:11:37 53,248 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\i386\i8042prt.sys + 2008-04-14 15:55:09 23,296 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\i386\mouclass.sys + 2003-05-30 16:30:30 69,632 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\InstNT.exe + 2003-05-30 16:03:44 73,728 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynCOM.dll + 2003-05-30 16:04:16 110,592 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynCtrl.dll + 2003-05-30 16:27:04 471,040 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynISDLL.dll + 2003-05-30 15:50:38 147,456 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynMood.exe + 2003-05-30 15:56:22 271,728 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynTP.sys + 2003-05-30 16:02:18 94,208 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynTPAPI.dll + 2003-05-30 16:02:48 40,960 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynTPCOM.dll + 2003-05-30 16:12:48 5,140,480 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynTPCpl.dll + 2003-05-30 16:23:14 614,400 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynTPEnh.exe + 2003-05-30 16:24:24 65,536 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynTPFcs.dll + 2003-05-30 16:25:02 110,592 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynTPLpr.exe + 2003-05-30 15:51:34 159,744 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\SynZMetr.exe + 2003-05-30 16:25:54 212,992 ----a-w c:\windows\system32\ReinstallBackups\0014\DriverFiles\Tutorial.exe - 2003-05-30 16:03:44 73,728 ----a-w c:\windows\system32\SynCOM.dll + 2007-12-06 16:08:20 163,840 ----a-w c:\windows\system32\SynCOM.dll - 2003-05-30 16:04:16 110,592 ----a-w c:\windows\system32\SynCtrl.dll + 2007-12-06 16:09:04 196,608 ----a-w c:\windows\system32\SynCtrl.dll - 2003-05-30 16:02:18 94,208 ----a-w c:\windows\system32\SynTPAPI.dll + 2007-12-06 16:20:04 147,456 ----a-w c:\windows\system32\SynTPAPI.dll + 2008-11-09 15:46:25 16,384 ----atw c:\windows\temp\Perflib_Perfdata_84.dat . – Migawka wyzerowana – . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2008-04-14 15360] “LDM”=“c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe” [2007-03-14 67128] “MSMSGS”=“c:\program files\Messenger\msmsgs.exe” [2008-04-14 1695232] “PC Suite Tray”=“c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe” [2008-10-02 1124352] “Nokia.PCSync”=“c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe” [2008-06-17 1249280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SigmaTel StacMon”=“c:\program files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe” [2003-08-03 86073] “SynTPLpr”=“c:\program files\Synaptics\SynTP\SynTPLpr.exe” [2003-05-30 110592] “SynTPEnh”=“c:\program files\Synaptics\SynTP\SynTPEnh.exe” [2007-12-06 1024000] “TouchED”=“c:\program files\TOSHIBA\TouchED\TouchED.Exe” [2003-03-13 122880] “PRONoMgr.exe”=“c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe” [2003-12-10 86016] “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2008-06-12 34672] “HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe” [2006-12-10 49152] “GrooveMonitor”=“c:\program files\Microsoft Office\Office12\GrooveMonitor.exe” [2007-08-24 33648] “SunJavaUpdateSched”=“c:\program files\Java\jre6\bin\jusched.exe” [2008-10-17 136600] “QuickTime Task”=“c:\program files\QuickTime\QTTask.exe” [2008-09-06 413696] “iTunesHelper”=“c:\program files\iTunes\iTunesHelper.exe” [2008-10-01 289576] “nwiz”=“nwiz.exe” [2003-08-28 c:\windows\system32\nwiz.exe] “000StTHK”=“000StTHK.exe” [2001-06-23 19:28 24576 c:\windows\system32\000StTHK.exe] “TFNF5”=“TFNF5.exe” [2003-07-18 c:\windows\system32\TFNF5.exe] “LTSMMSG”=“LTSMMSG.exe” [2003-04-18 c:\windows\ltsmmsg.exe] “TFncKy”=“TFncKy.exe” [bU] “TPSMain”=“TPSMain.exe” [2003-10-06 c:\windows\system32\TPSMain.exe] “Logitech Utility”=“Logi_MwX.Exe” [2003-12-11 c:\windows\LOGI_MWX.EXE] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE” [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-14 67128] RAMASST.lnk - c:\windows\system32\RAMASST.exe [2004-09-12 155648] Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2003-12-16 15:49 110592 c:\windows\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusDisableNotify”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe”= “c:\Program Files\Gadu-Gadu\gg.exe”= “c:\Program Files\Skype\Phone\Skype.exe”= “c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”= “c:\Program Files\Microsoft Office\Office12\GROOVE.EXE”= “c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”= “%windir%\Network Diagnostic\xpnetdiag.exe”= “%windir%\system32\sessmgr.exe”= “c:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe”= “c:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe”= “c:\Program Files\Bonjour\mDNSResponder.exe”= “c:\Program Files\iTunes\iTunes.exe”= “c:\Program Files\eMule\emule.exe”= R2 JavaQuickStarterService;Java Quick Starter;c:\program files\Java\jre6\bin\jqs.exe [2008-10-17 152984] S3 cmusbser;%CMUSBSER%;c:\windows\system32\DRIVERS\cmusbser.sys [2006-12-13 87040] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{e69000c4-3879-11dc-b3ca-000e353cdc9f}] \Shell\AutoRun\command - F:\USBNB.exe . Zawartość folderu ‘Zaplanowane zadania’ 2008-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 16:46:51 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów … skanowanie ukrytych wpisów autostartu … skanowanie ukrytych plików … skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\S24EvMon.exe c:\windows\system32\ZCfgSvc.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Toshiba\ConfigFree\CFSvcs.exe c:\windows\system32\DVDRAMSV.exe c:\program files\Toshiba\TOSHIBA Controls\TFncKy.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\RegSrvc.exe c:\windows\system32\TPSBattM.exe c:\program files\iPod\bin\iPodService.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\windows\system32\1XConfig.exe c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\windows\system32\wbem\wmiapsrv.exe . ************************************************************************** . Czas ukończenia: 2008-11-09 16:52:18 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-11-09 15:52:13 ComboFix2.txt 2008-11-07 23:45:29 ComboFix3.txt 2008-11-07 17:54:44 ComboFix4.txt 2008-11-06 16:28:43 Przed: 17 086 038 016 bajtów wolnych Po: 17,088,974,848 bajtów wolnych 297 — E O F — 2008-10-29 13:13:18 Ale nadal dzieją się te rzeczy co napisałem wcześniej, troche lepiej bo jakby zwolniło ale dalej schodzi w dół Ale jak włącze gre Red Alert 3 to zachowuje się komp normalnie i nie schodzi obraz, co jest, dlaczego nie da się tego naprawić, pierwszy raz się z takim czymś spotykam

[Gutek]

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=253052

A tego nie zrobiłeś

Dodatkowo - wykonaj skan Dr. Web CureIt Po tym nowy log z Combo oraz skan http://www.kaspersky.pl/virusscanner.html

[Orygano (Bladeus)]

Przeskanowałem system Kaspersky online Skaner 7

wykrył to: