Qzzy
5 Maj 2009 17:53
#1
Witam, mam problem, bardzo długo wyłącza mi się windows XP od wczoraj. Wygląda to tak że klikam na wyłącz komputer, wszystko pięknie, jest potem okienko “Zamykanie komputera”, znika ono i jest przez 5 minut pusty ekran z kursorem.
to mój log z HiJack’a.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:49:54, on 2009-05-05
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go2.microsoft.com/fwlink/?LinkID=87096&errorID=1601
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Loader Class - {F880A4A8-C436-4AC4-AFD1-AA0BDC9552DD} - Q:\Download\Windows\[narzędzia]\Nightly FinedXer\FindeXer.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-21-854245398-1957994488-1202660629-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Gibs')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCB66E03-7629-42B7-9D75-67613009211E}: NameServer = 192.168.0.1
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3255 bytes
Qzzy
5 Maj 2009 18:37
#3
oto i on.
ComboFix 09-05-04.A3 - root 2009-05-05 20:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.511.326 [GMT 2:00]
Uruchomiony z: q:\download\Windows\[narzędzia]\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\9g234sdfdfgjf23
c:\windows\system32\nfr.assembly
c:\windows\system32\nfr.gpref
.
((((((((((((((((((((((((( Pliki utworzone od 2009-04-05 do 2009-05-05 )))))))))))))))))))))))))))))))
.
2009-05-05 17:49 . 2009-05-05 17:49 -------- d-----w c:\program files\Trend Micro
2009-05-05 14:19 . 2009-05-05 14:19 -------- d-----w c:\documents and settings\Rodzina\Dane aplikacji\FindeXer
2009-05-05 10:23 . 2009-05-05 10:28 -------- d-----w c:\program files\RegCleaner
2009-05-05 09:32 . 2008-10-16 12:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-05-05 09:32 . 2008-10-16 12:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-05-05 09:07 . 2008-06-19 14:24 28544 ----a-w c:\windows\system32\drivers\pavboot.sys
2009-05-05 09:03 . 2009-05-05 09:03 -------- d-----w c:\documents and settings\root\Ustawienia lokalne\Dane aplikacji\Mozilla
2009-05-05 09:01 . 2009-05-05 09:01 -------- d-----w c:\program files\Panda Security
2009-05-05 08:32 . 2009-05-05 08:32 -------- d-----w c:\documents and settings\root\Dane aplikacji\FindeXer
2009-05-04 17:32 . 2009-05-04 17:33 -------- d-----w c:\documents and settings\Gibs\Dane aplikacji\FindeXer
2009-05-04 09:45 . 2009-05-04 09:45 -------- d-----w c:\program files\Microsoft Silverlight
2009-05-03 15:55 . 2009-05-03 15:55 -------- d-----w c:\program files\7-Zip
2009-05-03 12:43 . 2009-01-11 16:20 -------- d--h--w c:\documents and settings\root\Ustawienia lokalne
2009-05-03 12:43 . 2009-05-05 17:14 -------- d-----w c:\documents and settings\root
2009-05-02 12:55 . 2009-05-02 12:55 221184 ----a-w c:\windows\system32\wrap_oal.dll
2009-05-02 12:55 . 2009-05-02 12:55 81920 ----a-w c:\windows\system32\OpenAL32.dll
2009-05-01 19:39 . 2009-05-01 19:40 -------- d--h--w c:\windows\system32\GroupPolicy
2009-04-27 20:14 . 2009-04-27 20:14 -------- d-----w c:\program files\Common Files\Borland Shared
2009-04-27 20:14 . 2009-04-27 20:14 -------- d-----w c:\program files\STREAM soft
2009-04-08 09:41 . 2009-01-11 16:20 -------- d-----r c:\documents and settings\studio\Menu Start
2009-04-08 09:41 . 2009-04-08 10:06 -------- d-----r c:\documents and settings\studio\Moje dokumenty
2009-04-08 09:41 . 2009-04-08 09:44 -------- d-----w c:\documents and settings\studio\Pulpit
2009-04-08 09:41 . 2009-01-11 15:33 -------- d--h--w c:\documents and settings\studio\Szablony
2009-04-08 09:41 . 2009-04-08 09:41 -------- d-----r c:\documents and settings\studio\Ulubione
2009-04-08 09:41 . 2009-04-09 11:44 -------- d-----w c:\documents and settings\studio\Ustawienia lokalne\Dane aplikacji\Microsoft
2009-04-08 09:41 . 2009-01-11 16:20 -------- d--h--w c:\documents and settings\studio\Ustawienia lokalne
2009-04-08 09:41 . 2009-04-08 09:41 -------- d-----w c:\documents and settings\studio
2009-04-06 19:04 . 2009-04-06 19:04 -------- d-----w c:\windows\ShellNew
2009-04-06 19:02 . 2009-04-06 19:02 -------- d-----w c:\documents and settings\Gibs\Dane aplikacji\Microsoft Web Folders
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-03 15:21 . 2009-03-23 16:30 -------- d-----w c:\program files\GTK2-Runtime
2009-04-27 03:35 . 2009-01-12 05:27 23208 ----a-w c:\documents and settings\Gibs\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-04-25 17:25 . 2001-10-26 18:15 49712 ----a-w c:\windows\system32\perfc015.dat
2009-04-25 17:25 . 2001-10-26 18:15 355830 ----a-w c:\windows\system32\perfh015.dat
2009-04-11 11:35 . 2009-04-11 11:35 8192 ----a-w c:\windows\d3dx.dat
2009-04-08 09:45 . 2009-04-08 09:45 23768 ----a-w c:\documents and settings\studio\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-04-06 19:07 . 2009-04-06 19:07 5058 ----a-w c:\windows\Help\hhcolreg.dat
2009-04-06 19:01 . 2009-01-11 15:40 -------- d-----w c:\program files\microsoft frontpage
2009-04-04 21:40 . 2009-04-04 21:13 -------- d-----w c:\program files\Samurize
2009-04-04 21:14 . 2009-01-21 12:36 -------- d-----w c:\program files\foobar2000
2009-04-04 15:36 . 2009-04-04 15:36 -------- d-----w c:\program files\Mplayer
2009-04-04 15:32 . 2009-04-04 15:32 -------- d-----w c:\program files\DAEMON Tools Toolbar
2009-04-04 15:32 . 2009-04-04 15:32 -------- d-----w c:\program files\DAEMON Tools Lite
2009-04-04 15:29 . 2009-04-04 15:29 717296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-04-02 20:15 . 2009-04-02 20:15 1 ---h--w c:\windows\t55ft2810f44.dat
2009-04-02 19:17 . 2009-04-02 19:17 -------- d-----w c:\program files\directx
2009-03-21 16:19 . 2009-03-21 16:19 1 ---h--w c:\windows\t55ft2808f44.dat
2009-03-18 11:31 . 2009-03-18 11:31 1 ---h--w c:\windows\t55ft2807f44.dat
2009-03-12 20:27 . 2009-03-12 20:26 -------- d-----w c:\program files\RocketDock
2009-03-12 20:18 . 2004-08-03 22:44 219648 ----a-w c:\windows\system32\uxtheme.dll
2009-03-12 08:14 . 2009-03-12 08:14 -------- d-----w c:\program files\Lavalys
2009-03-11 21:15 . 2009-03-11 21:10 -------- d-----w c:\program files\runmodule
2009-03-10 21:09 . 2009-03-10 21:09 -------- d-----w c:\program files\CCleaner
2009-03-10 19:23 . 2009-03-10 19:23 -------- d-----w c:\program files\Alwil Software
2009-03-10 19:10 . 2009-03-10 19:10 -------- d-----w c:\program files\Opera
2009-03-10 16:22 . 2009-03-10 16:22 1 ---h--w c:\windows\t55ft3518f44.dat
2009-03-09 17:51 . 2009-03-09 17:42 -------- d-----w c:\program files\LiteStep
2009-03-06 14:22 . 2004-08-03 22:44 285696 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:10 . 2004-08-03 22:44 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 17:13 . 2004-08-03 22:44 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-10 17:09 . 2004-08-04 00:38 2067328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 14:07 . 2004-08-03 22:37 1847040 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-03 22:39 2190336 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2004-08-03 22:44 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:53 . 2004-08-03 22:44 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:53 . 2004-08-03 22:44 731136 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:53 . 2004-08-03 22:43 686592 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:53 . 2004-08-03 22:43 722944 ----a-w c:\windows\system32\ntdll.dll
2009-02-06 10:39 . 2001-10-26 19:30 35328 ----a-w c:\windows\system32\sc.exe
2007-10-29 15:21 . 2007-10-29 15:21 108 --sha-r c:\windows\neoqaz2.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-02-19 1471728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"LogonType"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-05-05 28544]
.
.
------- Skan uzupełniający -------
.
TCP: {FCB66E03-7629-42B7-9D75-67613009211E} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\root\Dane aplikacji\Mozilla\Firefox\Profiles\[u]0[/u]5ejd0xg.default\
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-05 20:34
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
Czas ukończenia: 2009-05-05 20:36
ComboFix-quarantined-files.txt 2009-05-05 18:36
Przed: 2 773 700 608 bajtów wolnych
Po: 2 796 511 232 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
140 --- E O F --- 2009-04-23 12:47