Laptop wyłącza się

groh1 · 27 Sierpień 2007 13:39

Witam.

Kolega dostarczył mi swojego laptopa. Komputer wyłącza się po około minucie pracy (również w trybie awaryjnym).

Za każdym razem jest to poprzedzone pojawieniem się kolejnego - 4-go procesu svchost.exe. Ze względu na opisany wyżej problem nie mogę przeprowadzić skanowania żadnym programem antywirusowym.

Proszę o pomoc. W logu z Hijack nie ma raczej nic podejrzanego, ale proszę o jego analizę.

Logfile of HijackThis v1.99.1 Scan saved at 15:10:37, on 2007-08-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HPQ\IAM\bin\asghost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\WINDOWS\SMINST\Scheduler.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Documents and Settings\kix\Pulpit\hijackthis\HijackThis.exe C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll O4 - HKLM…\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM…\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start O4 - HKLM…\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM…\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM…\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM…\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule O4 - HKLM…\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM…\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM…\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe O4 - HKLM…\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe O4 - HKLM…\Run: [scheduler] C:\WINDOWS\SMINST\Scheduler.exe O4 - HKLM…\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll O20 - Winlogon Notify: SysLoad - C:\WINDOWS\SYSTEM32\libsysinfo.dll O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

Gutek · 27 Sierpień 2007 17:48

Daj log z Combofixa

groh1 · 28 Sierpień 2007 08:55

Oto Log z ComboFix’a.

http://wklej.org/id/1be91c4986

jessica · 28 Sierpień 2007 09:57

Jeśli nie masz jakiegoś narzędzia usuwającego, to ściągnij OTMoveIt

Do pola Paste List of Files/Folders to be Moved wklej poniższe ścieżki:

Następnie wciśnij przycisk MoveIt!

Pojawi się komunikat, że jest potrzebny restart do usunięcia podanych plików/folderów- wciśnij Yes.

Po restarcie usuń ręcznie folder C:** _OTMoveIt** (Prawoklik >>> Usuń >>> Opróżnij Kosz).

Następnie:

Ten drugi klucz (powyżej) to z infekcji na pendrive.

To jest chyba dobre, ale że jest podpięte do “svchost”, to lepiej niech to sprawdzi SDFix

Uwaga: SDFix da się użyć tylko w Trybie Awaryjnym!

Daj z niego raport.txt znajdujący się w jego folderze.

jessi

groh1 · 28 Sierpień 2007 14:52

Komputer przestał się wyłączać.

Oto log

SDFix: Version 1.100 Run by kix on 2007-08-28 at 16:27 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\sdfix\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\25.TMP - Deleted C:\26.TMP - Deleted C:\27.TMP - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\sdfix\SDFix\backups\backups.zip Files with Hidden Attributes: C:\WINDOWS\SoftwareDistribution\Download\02ec37ec946ef377971d8300cdcd818f\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\0300c0210ca0c3725210067af2e4882c\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\03ddd87c1fa8f5b7c7a8520d3d9ebaa5\BITB.tmp C:\WINDOWS\SoftwareDistribution\Download\22d177b61fde58f114e05dfd9b70c96d\BITB.tmp C:\WINDOWS\SoftwareDistribution\Download\2c7c094c07d8ab1c6d2c7df6e96d2df0\BITD.tmp C:\WINDOWS\SoftwareDistribution\Download\4594f50665d34bef5af87c38b6953ce2\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\470c50ee23affed25b509c745d0a64f5\BITB.tmp C:\WINDOWS\SoftwareDistribution\Download\4c41adde360d8087c4b4dd4e2d835dec\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\4d39b1b575a5584d11abd56a8de2f045\BITB.tmp C:\WINDOWS\SoftwareDistribution\Download\4eeb59f084e20038b23f012bb616a593\BIT12.tmp C:\WINDOWS\SoftwareDistribution\Download\510fd197909dd722575ec6e361c56938\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\55fe03e59c7b98ebc21dc3c36e54eaf0\BITD.tmp C:\WINDOWS\SoftwareDistribution\Download\67363d1e42ce421cde25a6a620fabf78\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\682d2cf7aea7ce4519b74af38fab1d72\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\6d3e4a8f99a381f392de0d99b22fc9a6\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\7bfd24c44368c1f4c08da0b18d20b54e\BITE.tmp C:\WINDOWS\SoftwareDistribution\Download\81968cc7f0ee4f3ea56bf21096a0eb8a\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\89b70ceab9c1882c80e33e4e8d6798ba\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\8fc9362cdeea2d9e312dca7d0ae818ee\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\91fddbfe4bf8b53b7311c79086873d73\BITD.tmp C:\WINDOWS\SoftwareDistribution\Download\929cd614a46aa170511c3292b3848eb2\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\93f2b91bb6cc5cb38584bf245cd36cae\BITC.tmp C:\WINDOWS\SoftwareDistribution\Download\94ccbe980556f2828ed2d3768c02f4dd\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\955f27c5c4f218cbb2ef80aaafccb6df\BITB.tmp C:\WINDOWS\SoftwareDistribution\Download\99c63b8154c86bb80bd4d4ef1f97d4ee\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\9fde447cfd86a360844378b784e73f37\BITE.tmp C:\WINDOWS\SoftwareDistribution\Download\a23edd26fc03189a66774c8772cf784c\BITE.tmp C:\WINDOWS\SoftwareDistribution\Download\a700888399b59cee38c0ae52e87f0a91\BITF.tmp C:\WINDOWS\SoftwareDistribution\Download\a973a4b0bff52375def6ea55f54d9f60\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\abf37927fe96bc682b342849c5743771\BITC.tmp C:\WINDOWS\SoftwareDistribution\Download\b96f4018a5a1e8840e523891e4664d45\BITD.tmp C:\WINDOWS\SoftwareDistribution\Download\baf5873d097c20aedd3e06e2ff27a933\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\c19b98120b549d8ec167c8c057545675\BITC.tmp C:\WINDOWS\SoftwareDistribution\Download\cb5082794321f9e3ef2207013c7be9e9\BITC.tmp C:\WINDOWS\SoftwareDistribution\Download\cceb21cd2a7a35a4e5b1d264978f4dfd\BITC.tmp C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\da4f9530bbf808442a49c750952b9170\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\df4c8391579dd99f8d7ffa70e2eb37c3\BITC.tmp C:\WINDOWS\SoftwareDistribution\Download\e6a7525a4b32c7adb3b1c81ba8f28cb5\BITA.tmp C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\BITB.tmp C:\WINDOWS\SoftwareDistribution\Download\f34ea1aa600dc2889509baa1a15ec8f8\BIT9.tmp C:\WINDOWS\SoftwareDistribution\Download\f57c255e25adcef74d2dff8c5940b09c\BITB.tmp C:\WINDOWS\SoftwareDistribution\Download\fd43c53f6dd72556f6c8c981a93ce522\BITB.tmp Finished

Gutek · 28 Sierpień 2007 15:00

Daj log z Deckard’s System Scanner - http://forum.dobreprogramy.pl/viewtopic.php?t=36654

groh1 · 28 Sierpień 2007 15:29

Proszę

Deckard’s System Scanner v20070826.66 Run by kix on 2007-08-28 17:21:24 Computer is in Normal Mode. -------------------------------------------------------------------------------- – System Restore -------------------------------------------------------------- Successfully created a Deckard’s System Scanner Restore Point. – Last 5 Restore Point(s) – 24: 2007-08-28 15:21:27 UTC - RP30 - Deckard’s System Scanner Restore Point 23: 2007-08-28 08:31:54 UTC - RP29 - ComboFix created restore point 22: 2007-08-27 15:36:43 UTC - RP28 - Removed Alcohol 120% 21: 2007-08-27 07:01:19 UTC - RP27 - Installed AVG 7.5 20: 2007-08-27 07:01:05 UTC - RP26 - Removed AVG 7.5 – First Restore Point – 1: 2007-05-02 07:34:26 UTC - RP7 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. Total Physical Memory: 504 MiB (512 MiB recommended). – HijackThis (run as kix.exe) ------------------------------------------------- Unable to find log (file not found); running clone. – HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-08-28 17:21:52 Platform: Windows XP Dodatek Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\HPQ\IAM\Bin\asghost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\ESET\nod32krn.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ESET\nod32kui.exe C:\Program Files\Option\GlobeTrotter Mobility Manager\GlobeTrotter Mobility Manager.exe C:\Program Files\Option\GlobeTrotter Mobility Manager\VirtualWirelessDevice.exe C:\Documents and Settings\kix\Pulpit\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl … r=iesearch O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll O4 - HKEY_LOCAL_MACHINE…\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKEY_LOCAL_MACHINE…\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKEY_LOCAL_MACHINE…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKEY_LOCAL_MACHINE…\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start O4 - HKEY_LOCAL_MACHINE…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKEY_LOCAL_MACHINE…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra ‘Tools’ menuitem: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/ … vc1dmo.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/sh … wflash.cab O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - “C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe” O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - “C:\Program Files\Common Files\LightScribe\LSSrvc.exe” O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - “C:\Program Files\Eset\nod32krn.exe” O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe – File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL “%1”,%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser “%1”,%* – Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- S3 catchme - c:\docume~1\kix\ustawi~1\temp\catchme.sys (file missing) S3 GTIPCI21 - c:\windows\system32\drivers\gtipci21.sys (file missing) S3 SYMIDSCO - c:\progra~1\common~1\symant~1\symcdata\idsdefs\20070628.003\symidsco.sys (file missing) S3 tifm21 - c:\windows\system32\drivers\tifm21.sys (file missing) – Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 PCA (PC Angel) - c:\windows\sminst\pcangel.exe S3 WmcCds (Windows Media Connect (WMC)) - c:\program files\windows media connect\mswmccds.exe S3 WmcCdsLs (Pomocnik programu Windows Media Connect (WMC)) - c:\program files\windows media connect\mswmcls.exe – Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Broadcom 802.11b/g WLAN Device ID: PCI\VEN_14E4&DEV_4311&SUBSYS_1364103C&REV_01\4&BF41672&0&00E0 Manufacturer: Broadcom Name: Broadcom 802.11b/g WLAN PNP Device ID: PCI\VEN_14E4&DEV_4311&SUBSYS_1364103C&REV_01\4&BF41672&0&00E0 Service: BCM43XX Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Karta sieciowa 1394 Device ID: V1394\NIC1394\292D4B0C23F99 Manufacturer: Microsoft Name: Karta sieciowa 1394 PNP Device ID: V1394\NIC1394\292D4B0C23F99 Service: NIC1394 Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Broadcom 440x 10/100 Integrated Controller Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_30AA103C&REV_02\4&2EC23395&0&70F0 Manufacturer: Broadcom Name: Broadcom 440x 10/100 Integrated Controller PNP Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_30AA103C&REV_02\4&2EC23395&0&70F0 Service: bcm4sbxp – Files created between 2007-07-28 and 2007-08-28 ----------------------------- 2007-08-27 16:39:17 0 -rahs---- C:\MSDOS.SYS 2007-08-27 16:39:17 0 -rahs---- C:\IO.SYS 2007-08-27 16:39:05 0 d-------- C:\WINDOWS\ERUNT 2007-08-27 15:04:23 4368 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-27 15:04:14 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-27 15:04:14 53248 --a------ C:\WINDOWS\system32\Process.exe http://www.beyondlogic.org; Command Line Process Utility> 2007-08-27 15:04:14 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-27 10:11:13 299392 --a------ C:\WINDOWS\system32\imon.dll 2007-08-27 09:32:04 0 d-------- C:\WINDOWS\pss 2007-08-11 21:49:18 0 d-------- C:\Program Files\Common Files\SWF Studio – Find3M Report --------------------------------------------------------------- 2007-08-28 16:34:40 436560 --a------ C:\WINDOWS\system32\perfh015.dat 2007-08-28 16:34:40 67496 --a------ C:\WINDOWS\system32\perfc015.dat 2007-08-27 17:53:02 0 d-------- C:\Program Files\Fingerprint Sensor 2007-07-09 22:47:02 0 d-------- C:\Documents and Settings\kix\Dane aplikacji\Sun 2007-07-06 16:53:29 0 d-------- C:\Program Files\Common Files\InstallShield 2007-07-06 16:52:57 0 d-------- C:\Program Files\Common Files\Sonic Shared 2007-07-06 16:52:54 0 d-------- C:\Program Files\Common Files 2007-07-06 16:52:28 0 d-------- C:\Program Files\Sonic 2007-07-06 16:20:34 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-07-06 16:20:33 0 d-------- C:\Program Files\Symantec – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SoundMAXPnP”=“C:\Program Files\Analog Devices\Core\smax4pnp.exe” [2005-05-20 10:11] “SoundMAX”=“C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” [2005-05-06 14:06] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [2005-11-10 13:03] “PTHOSTTR”=“C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.exe” [2006-02-14 11:56] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2006-03-03 18:46] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-08-27 10:10] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard] C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll 2005-07-25 20:41 40960 C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] “Notification Packages”= scecli AsWlnPkg [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DVD Check.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DVD Check.lnk backup=C:\WINDOWS\pss\DVD Check.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Cognizance ASChannel – End of Deckard’s System Scanner: finished at 2007-08-28 17:24:15 ------------

Gutek · 28 Sierpień 2007 15:46

usuń wpisy HJT

groh1 · 29 Sierpień 2007 07:21

Pomogło. Dziękuję serdecznie.