Problem Z Zamykaniem Systemu

[pentliczek]

Mam problem jak klikam na START/Wyłącz to pojawia się klepsydra i muszę pare minut czekać aż się włączy okienko z wyłączaniem itd.

 

Problem występuje po kilkunasto minutowej pracy z windowsem, po tym jak włącze windowsa jest OK.

 

Próbowałem czyścić rejestr, skanować dysk, defragmentować, bawiłem się jv16, odkurzaczem i dalej nic.

 

Logi:

Logfile of HijackThis v1.99.1

Scan saved at 16:43:32, on 2007-06-12

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\nvsvc32.exe

H:\gry\Steam\Steam.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\explorer.exe

C:\Program Files\HijackThis\HijackThis.exe

 

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"

O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm

O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe

[CatchMe]

Więc tak:

 

*Proszę o logi:

- Silent Runners

- ComboFix

- Gmer (z 2 opcji)

[pentliczek]

SILENT RUNNERS:

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}"(Default)" = "(empty string)" [file not found]"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]"kis" = ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"" ["Kaspersky Lab"]HKLM\Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer"										\StubPath   = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"				   \InProcServer32\(Default) = "deskpan.dll" [file not found]"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"				   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {HKLM...CLSID} = "WinRAR"				   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"  -> {HKLM...CLSID} = "AlcoholShellEx"				   \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]"{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson File Manager"  -> {HKLM...CLSID} = "Sony Ericsson File Manager"				   \InProcServer32\(Default) = "C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"]"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"  -> {HKLM...CLSID} = "Microsoft Office Outlook"				   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"				   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"  -> {HKLM...CLSID} = (no title provided)				   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Ochrona WWW"  -> {HKLM...CLSID} = "Ochrona WWW"				   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll" ["Kaspersky Lab"]"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"  -> {HKLM...CLSID} = "DesktopContext Class"				   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"  -> {HKLM...CLSID} = "NVIDIA CPL Extension"				   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {HKLM...CLSID} = "Desktop Explorer"				   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {HKLM...CLSID} = (no title provided)				   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {HKLM...CLSID} = "nView Desktop Context Menu"				   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]HKLM\Software\Classes\PROTOCOLS\Filter\<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"  -> {HKLM...CLSID} = (no title provided)				   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"  -> {HKLM...CLSID} = (no title provided)				   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll" ["Kaspersky Lab"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {HKLM...CLSID} = "WinRAR"				   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {HKLM...CLSID} = "WinRAR"				   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"  -> {HKLM...CLSID} = (no title provided)				   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll" ["Kaspersky Lab"]WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"  -> {HKLM...CLSID} = "WinRAR"				   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]Group Policies {GPedit.msc branch and setting}:-----------------------------------------------Note: detected settings may not have any effect.HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000001{unrecognized setting}"ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000001{unrecognized setting}HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|Shutdown: Allow system to be shut down without having to log on}"undockwithoutlogon" = (REG_DWORD) hex:0x00000001{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|Devices: Allow undock without having to log on}Active Desktop and Wallpaper:-----------------------------Active Desktop may be disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateDisplayed if Active Desktop enabled and wallpaper not set by Group Policy:HKCU\Software\Microsoft\Internet Explorer\Desktop\General\"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"Displayed if Active Desktop disabled and wallpaper not set by Group Policy:HKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\!ALL!\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

 

COMBO FIX

ComboFix 07-06-11.3 - C:\Documents and Settings\!ALL!\Pulpit\ComboFix.exe"!ALL!" - 2007-06-12 19:03:18 - Dodatek Service Pack 2  NTFS  (((((((((((((((((((((((((   Files Created from 2007-05-12 to 2007-06-12  )))))))))))))))))))))))))))))))2007-06-12 19:03	49,152	--a------	C:\WINDOWS\nircmd.exe2007-06-12 15:03	<DIR>	d--------	C:\WINDOWS\LastGood2007-06-12 00:06	23	--ahs----	C:\WINDOWS\system32\efbebfcbbbcad_r.dll2007-06-12 00:06	<DIR>	d--------	C:\Program Files\jv16 PowerTools 20072007-06-11 23:59	100,489	--a------	C:\WINDOWS\UninstallFirefox.exe2007-06-11 23:02	<DIR>	d--------	C:\Program Files\Odkurzacz2007-06-07 01:48	5,632	--a------	C:\WINDOWS\system32\drivers\Entech64.sys2007-06-07 00:12	<DIR>	d--------	C:\Program Files\MadOnion.com2007-06-06 16:44	<DIR>	d--------	C:\Program Files\prime952007-06-06 16:44	<DIR>	d--------	C:\Program Files\cpu-z2007-06-06 16:34	<DIR>	d-a------	C:\Program Files\SUPER_PI2007-06-05 23:44	<DIR>	d--------	C:\Program Files\refreshlock2007-06-05 21:51	3,972	--a------	C:\WINDOWS\system32\drivers\PciBus.sys2007-06-05 21:51	21,664	--a------	C:\WINDOWS\system32\drivers\Entech.sys2007-06-05 21:51	<DIR>	d--------	C:\WINDOWS\system32\Futuremark2007-06-05 17:55	<DIR>	d--------	C:\Program Files\TVTool2007-06-05 17:24	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\DANEAP~1\NVIDIA2007-06-05 17:22	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles2007-06-05 17:17	208,896	--a------	C:\WINDOWS\system32\nvudisp.exe2007-06-05 17:17	<DIR>	d--------	C:\WINDOWS\nview2007-06-03 17:01	<DIR>	d--------	C:\WINDOWS\Hitman Kryptonim 472007-05-30 17:13	68,888	--a------	C:\WINDOWS\system32\xinput1_3.dll2007-05-30 17:13	3,426,072	--a------	C:\WINDOWS\system32\d3dx9_32.dll2007-05-30 17:13	251,672	--a------	C:\WINDOWS\system32\xactengine2_5.dll2007-05-30 17:13	237,848	--a------	C:\WINDOWS\system32\xactengine2_4.dll2007-05-30 17:13	2,414,360	--a------	C:\WINDOWS\system32\d3dx9_31.dll2007-05-30 17:13	15,128	--a------	C:\WINDOWS\system32\x3daudio1_1.dll2007-05-29 16:59	<DIR>	d--------	C:\DOCUME~1\!ALL!\DANEAP~1\Disney Interactive Studios2007-05-29 16:14	<DIR>	d--------	C:\WINDOWS\Prefetch2007-05-29 16:08	<DIR>	d--------	C:\Program Files\Fic_Products2007-05-25 20:27	552	--a------	C:\WINDOWS\system32\d3d8caps.dat2007-05-25 19:26	<DIR>	d--------	C:\Program Files\Driver Cleaner Pro2007-05-21 23:07	870,784	--a------	C:\WINDOWS\system32\ati3d1ag.dll2007-05-21 23:07	32,768	--a------	C:\WINDOWS\system32\ativtmxx.dll2007-05-21 22:51	<DIR>	d--------	C:\DOCUME~1\!ALL!\DANEAP~1\ATI2007-05-18 14:59	<DIR>	d--------	C:\Program Files\NAPI-PROJEKT2007-05-12 22:08	<DIR>	d--------	C:\DOCUME~1\!ALL!\DANEAP~1\Gadu-Gadu((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))2007-06-12 16:34:29	--------	d-----w	C:\Program Files\HLSW2007-06-12 15:42:10	--------	d-----w	C:\DOCUME~1\!ALL!\DANEAP~1\teamspeak22007-06-12 13:10:42	--------	d-----w	C:\Program Files\Windows NT2007-06-12 12:56:29	--------	d-----w	C:\DOCUME~1\!ALL!\DANEAP~1\uTorrent2007-06-11 21:59:28	4,652	----a-w	C:\WINDOWS\mozver.dat2007-06-11 21:49:00	--------	d-----w	C:\Program Files\GIMP-2.02007-06-11 21:42:04	--------	d--h--w	C:\Program Files\InstallShield Installation Information2007-06-11 21:16:18	--------	d-----w	C:\DOCUME~1\!ALL!\DANEAP~1\Azureus2007-06-11 21:15:45	--------	d-----w	C:\Program Files\Windows Media Connect 22007-06-11 21:15:45	--------	d-----w	C:\Program Files\DC++2007-06-11 20:17:05	--------	d-----w	C:\Program Files\TP2007-06-11 11:38:54	80,560	----a-w	C:\WINDOWS\system32\perfc015.dat2007-06-11 11:38:54	461,228	----a-w	C:\WINDOWS\system32\perfh015.dat2007-06-10 19:13:17	--------	d-----w	C:\Program Files\mIRC2007-06-07 12:56:18	--------	d-----w	C:\Program Files\BitComet2007-06-05 14:36:52	--------	d-----w	C:\DOCUME~1\!ALL!\DANEAP~1\ATI2007-05-29 19:26:05	--------	d-----w	C:\DOCUME~1\!ALL!\DANEAP~1\Skype2007-05-29 14:59:21	--------	d-----w	C:\DOCUME~1\!ALL!\DANEAP~1\Disney Interactive Studios2007-05-26 19:29:51	--------	d-----w	C:\Program Files\BearShare2007-05-12 20:08:08	--------	d-----w	C:\DOCUME~1\!ALL!\DANEAP~1\Gadu-Gadu2007-05-12 19:55:06	--------	d-----w	C:\Program Files\Gadu-Gadu2007-04-19 12:14:14	208,896	----a-w	C:\WINDOWS\system32\nvusmb.exe2007-04-19 12:14:14	208,896	----a-w	C:\WINDOWS\system32\nvunrm.exe2007-04-19 12:14:14	208,896	----a-w	C:\WINDOWS\system32\NVUNINST.EXE2007-04-19 12:14:14	208,896	----a-w	C:\WINDOWS\system32\nvuide.exe2007-04-19 12:14:14	208,896	----a-w	C:\WINDOWS\system32\nvugart.exe2007-04-19 11:26:00	888,832	----a-w	C:\WINDOWS\system32\nvmobls.dll2007-04-19 11:26:00	86,016	----a-w	C:\WINDOWS\system32\nvmctray.dll2007-04-19 11:26:00	81,920	----a-w	C:\WINDOWS\system32\nvwddi.dll2007-04-19 11:26:00	794,624	----a-w	C:\WINDOWS\system32\nvcplui.exe2007-04-19 11:26:00	7,700,480	----a-w	C:\WINDOWS\system32\nvcpl.dll2007-04-19 11:26:00	581,632	----a-w	C:\WINDOWS\system32\nvhwvid.dll2007-04-19 11:26:00	5,644,288	----a-w	C:\WINDOWS\system32\nvoglnt.dll2007-04-19 11:26:00	5,619,712	----a-w	C:\WINDOWS\system32\nvdisps.dll2007-04-19 11:26:00	5,255,168	----a-w	C:\WINDOWS\system32\nvdispsr.dll2007-04-19 11:26:00	466,944	----a-w	C:\WINDOWS\system32\nvshell.dll2007-04-19 11:26:00	458,752	----a-w	C:\WINDOWS\system32\nvmccssr.dll2007-04-19 11:26:00	45,056	----a-w	C:\WINDOWS\system32\nvmccsrs.dll2007-04-19 11:26:00	442,368	----a-w	C:\WINDOWS\system32\nvappbar.exe2007-04-19 11:26:00	425,984	----a-w	C:\WINDOWS\system32\keystone.exe2007-04-19 11:26:00	4,543,616	----a-w	C:\WINDOWS\system32\nv4_disp.dll2007-04-19 11:26:00	35,840	----a-w	C:\WINDOWS\system32\nvcodins.dll2007-04-19 11:26:00	35,840	----a-w	C:\WINDOWS\system32\nvcod.dll2007-04-19 11:26:00	335,872	----a-w	C:\WINDOWS\system32\nvwrses.dll2007-04-19 11:26:00	335,872	----a-w	C:\WINDOWS\system32\nvwrsel.dll2007-04-19 11:26:00	327,680	----a-w	C:\WINDOWS\system32\nvwrsfr.dll2007-04-19 11:26:00	327,680	----a-w	C:\WINDOWS\system32\nvwrsesm.dll2007-04-19 11:26:00	323,584	----a-w	C:\WINDOWS\system32\nvwrspt.dll2007-04-19 11:26:00	323,584	----a-w	C:\WINDOWS\system32\nvwrsit.dll2007-04-19 11:26:00	323,584	----a-w	C:\WINDOWS\system32\nvrshe.dll2007-04-19 11:26:00	323,584	----a-w	C:\WINDOWS\system32\nvrsar.dll2007-04-19 11:26:00	319,488	----a-w	C:\WINDOWS\system32\nvwrsptb.dll2007-04-19 11:26:00	319,488	----a-w	C:\WINDOWS\system32\nvwrsnl.dll2007-04-19 11:26:00	315,392	----a-w	C:\WINDOWS\system32\nvwrsru.dll2007-04-19 11:26:00	315,392	----a-w	C:\WINDOWS\system32\nvwrshu.dll2007-04-19 11:26:00	311,296	----a-w	C:\WINDOWS\system32\nvwrsde.dll2007-04-19 11:26:00	311,296	----a-w	C:\WINDOWS\system32\nvexpbar.dll2007-04-19 11:26:00	303,104	----a-w	C:\WINDOWS\system32\nvwrstr.dll2007-04-19 11:26:00	303,104	----a-w	C:\WINDOWS\system32\nvwrssl.dll2007-04-19 11:26:00	303,104	----a-w	C:\WINDOWS\system32\nvwrsfi.dll2007-04-19 11:26:00	3,988,384	----a-w	C:\WINDOWS\system32\drivers\nv4_mini.sys2007-04-19 11:26:00	3,203,072	----a-w	C:\WINDOWS\system32\nvgamesr.dll2007-04-19 11:26:00	3,035,136	----a-w	C:\WINDOWS\system32\nvgames.dll2007-04-19 11:26:00	299,008	----a-w	C:\WINDOWS\system32\nvwrssk.dll2007-04-19 11:26:00	299,008	----a-w	C:\WINDOWS\system32\nvwrsno.dll2007-04-19 11:26:00	294,912	----a-w	C:\WINDOWS\system32\nvwrssv.dll2007-04-19 11:26:00	294,912	----a-w	C:\WINDOWS\system32\nvwrspl.dll2007-04-19 11:26:00	294,912	----a-w	C:\WINDOWS\system32\nvwrsda.dll2007-04-19 11:26:00	286,720	----a-w	C:\WINDOWS\system32\nvwrseng.dll2007-04-19 11:26:00	286,720	----a-w	C:\WINDOWS\system32\nvwrscs.dll2007-04-19 11:26:00	286,720	----a-w	C:\WINDOWS\system32\nvnt4cpl.dll2007-04-19 11:26:00	282,624	----a-w	C:\WINDOWS\system32\nvwrsar.dll2007-04-19 11:26:00	278,528	----a-w	C:\WINDOWS\system32\nvwrshe.dll2007-04-19 11:26:00	278,528	----a-w	C:\WINDOWS\system32\nvrsfr.dll2007-04-19 11:26:00	274,432	----a-w	C:\WINDOWS\system32\nvrsit.dll2007-04-19 11:26:00	274,432	----a-w	C:\WINDOWS\system32\nvrses.dll2007-04-19 11:26:00	274,432	----a-w	C:\WINDOWS\system32\nvrsel.dll2007-04-19 11:26:00	270,336	----a-w	C:\WINDOWS\system32\nvrsde.dll2007-04-19 11:26:00	266,240	----a-w	C:\WINDOWS\system32\nvrspt.dll2007-04-19 11:26:00	266,240	----a-w	C:\WINDOWS\system32\nvrsnl.dll2007-04-19 11:26:00	266,240	----a-w	C:\WINDOWS\system32\nvrsesm.dll2007-04-19 11:26:00	262,144	----a-w	C:\WINDOWS\system32\nvrsru.dll2007-04-19 11:26:00	262,144	----a-w	C:\WINDOWS\system32\nvrsptb.dll2007-04-19 11:26:00	262,144	----a-w	C:\WINDOWS\system32\nvrsja.dll2007-04-19 11:26:00	258,048	----a-w	C:\WINDOWS\system32\nvrsko.dll2007-04-19 11:26:00	253,952	----a-w	C:\WINDOWS\system32\nvrshu.dll2007-04-19 11:26:00	249,856	----a-w	C:\WINDOWS\system32\nvrstr.dll2007-04-19 11:26:00	249,856	----a-w	C:\WINDOWS\system32\nvrssl.dll2007-04-19 11:26:00	249,856	----a-w	C:\WINDOWS\system32\nvrssk.dll2007-04-19 11:26:00	249,856	----a-w	C:\WINDOWS\system32\nvrspl.dll2007-04-19 11:26:00	249,856	----a-w	C:\WINDOWS\system32\nvrsno.dll2007-04-19 11:26:00	245,760	----a-w	C:\WINDOWS\system32\nvrssv.dll2007-04-19 11:26:00	245,760	----a-w	C:\WINDOWS\system32\nvrsda.dll2007-04-19 11:26:00	241,664	----a-w	C:\WINDOWS\system32\nvrsfi.dll2007-04-19 11:26:00	241,664	----a-w	C:\WINDOWS\system32\nvrseng.dll2007-04-19 11:26:00	241,664	----a-w	C:\WINDOWS\system32\nvrscs.dll2007-04-19 11:26:00	229,376	----a-w	C:\WINDOWS\system32\nvmccs.dll2007-04-19 11:26:00	221,184	----a-w	C:\WINDOWS\system32\nvrszhc.dll2007-04-19 11:26:00	212,992	----a-w	C:\WINDOWS\system32\nvwrsja.dll2007-04-19 11:26:00	212,992	----a-w	C:\WINDOWS\system32\nvapi.dll(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))  *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"@"="" [][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]"NoLowDiskSpaceChecks"=1 (0x1)"ClearRecentDocsOnExit"=1 (0x1)[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]AutoRun\command- M:\LaunchU3.exe[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35a0e5d1-6373-11db-8029-001485bf554b}]AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exeOpen(&0)\command- L:\Recycled\ctfmon.exe[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8cb3290-4e1d-11db-8181-001485bf554b}]AutoRun\command- L:\LaunchU3.exe**************************************************************************catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.netRootkit scan 2007-06-12 19:04:20Windows 5.1.2600 Dodatek Service Pack 2 NTFSscanning hidden processes ...scanning hidden autostart entries ...scanning hidden files ...**************************************************************************[HKEY_LOCAL_MACHINE\system\ControlSet001\Hardware Profiles\0001\System\ControlSet001\Services\ati2mtag][HKEY_LOCAL_MACHINE\system\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\ATI2MTAG][HKEY_LOCAL_MACHINE\system\ControlSet003\Hardware Profiles\0001\System\ControlSet001\Services\ati2mtag][HKEY_LOCAL_MACHINE\system\ControlSet001\Hardware Profiles\0001\System\ControlSet001\Services\ati2mtag][HKEY_LOCAL_MACHINE\system\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\ATI2MTAG][HKEY_LOCAL_MACHINE\system\ControlSet003\Hardware Profiles\0001\System\ControlSet001\Services\ati2mtag][HKEY_LOCAL_MACHINE\system\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\TSDDD][HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TSDDD][HKEY_LOCAL_MACHINE\system\ControlSet001\Hardware Profiles\0001\System\ControlSet001\Services\ati2mtag][HKEY_LOCAL_MACHINE\system\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\ATI2MTAG][HKEY_LOCAL_MACHINE\system\ControlSet003\Hardware Profiles\0001\System\ControlSet001\Services\ati2mtag]Completion time: 2007-06-12 19:05:18	--- E O F ---

GMER:

 

http://wklej.org/id/3e2ecbe979

[CatchMe]

Nie widać nic szkodliwego...

 

Dla pewności przeskanuj to ...

C:\WINDOWS\system32\efbebfcbbbcad_r.dll

na www.virustotal.com.

Ale wydaje mi się, że jest to pliczek od cracka Jv16PT. 8O

[pentliczek]

To się utworzyło dziś ok. godziny 24:00 tak więc pewnie jv16 bo o tej godzinie to instalowałem 8O a problem mam od 2-3 dni

 

Tak więc co może być przyczyną 8O bo reinstalla na prawdę mi się nie chcę robić

[CatchMe]

1. Ściągnij: WWDC

- Zmień wszystkie opcje z disable na enable i uruchom ponownie komputer.

- Prawidłowy układ portów przedstawia zdjęcie:

http://www.firewallleaktester.com/images_site/wwdc.jpg

* NetBIOS może być żółty.

 

 

Ściągnij: KillBox`a

1. Zaznaczasz Delete on reboot, w polu full path of file wklej ścieżkę pliku:

C:\WINDOWS\system32\efbebfcbbbcad_r.dll

2. Następnie klikasz na czerwony krzyżyk X - nastąpi restart komputera.

 

Pobierz program SDFix

 

 

* Dwuklik na SDFix.exe następnie program wypakuje się na dysk systemowy (standardowo C:\SDFix)

 

* Zrestartuj komputer i wejdź do trybu awaryjnego z obsługą sieci (klawisz F8 przed bootem Windowsa)

 

* Wejdź do folderu z SDFix kliknij dwa razy na plik RunThis.bat

 

* Wciśnij Y nastąpi proces usuwania.

 

* Kiedy usuwanie się ukończy wciśnij dowolny klawisz (Any Key). Nastąpi restart komputera.

 

* Po restarcie SDFix uruchomi się ponownie, żeby dokończyć proces usuwania kiedy pojawi się w oknie programu Finished, wciśnij dowolny klawisz do zakończenia scryptu i załadowania ikon na pulpicie.

 

* Pokaż Report.txt znajdujący się w folderze SDFix.

 

 

- Po akcjach nowe logi. 8O

[pentliczek]

Z SDFix jest problem, bo mam klawiaturę na USB, i cos nie wykrywa przed bootem. Masz jakąś rade? Bo nie mam teraz klawy na PS2

[CatchMe]

Po prostu omiń punkt z SDFIX i zastosuj w trybie awaryjnym AVG AS: www.ewido.net 8O

[pentliczek]

No tak ale jak wejsc w ten tryb awaryjny bez klawiatury PS/2 8O Bo na usb cos nie chce wyskoczyc okienko po wcisnieicu F8

[ULLISSES]

Poszukaj w bios opcji "USB Legacy" lub coś podobnego - generalnie opcja aktywuje USB dla "Dos" i nie tylko.

[pentliczek]

Poszukaj w bios opcji "USB Legacy" lub coś podobnego - generalnie opcja aktywuje USB dla "Dos" i nie tylko.

Dzięki.

Oto logi z SDFixa:

 

SDFix: Version 1.87Run by !ALL! on 2007-06-14 at 13:31Microsoft Windows XP [Wersja 5.1.2600]Running From: C:\SDFixSafe Mode:Checking Services: Restoring Windows Registry ValuesRestoring Windows Default Hosts File Restoring Missing Security Center Service Restoring Missing SharedAccess Service Rebooting...Normal Mode:Checking Files:No Trojan Files FoundRemoving Temp Files...ADS Check:Checking C:\WINDOWS\C:\WINDOWSNo streams found. Checking C:\WINDOWS\system32C:\WINDOWS\system32No streams found. Checking C:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeNo streams found. Checking C:\WINDOWS\system32\ntoskrnl.exeC:\WINDOWS\system32\ntoskrnl.exeNo streams found. 								 Final Check:Remaining Services:------------------Authorized Application Key Export:[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]"C:\\Program Files\\HLSW\\hlsw.exe"="C:\\Program Files\\HLSW\\hlsw.exe:*:Enabled:hlsw""H:\\gry\\Steam\\steamapps\\pieniadz\\counter-strike\\hl.exe"="H:\\gry\\Steam\\steamapps\\****\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher""%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"Remaining Files:---------------Listing Files with Hidden Attributes:C:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Windows Media Player\mplayer2.exeC:\Program Files\Windows Media Player\wmplayer.exeListing User Accounts:Konta uľytkownik˘w dla \\PLN!ALL!					Administrator			ASPNET				   Go†					 Pomocnik				 Polecenie zostao wykonane pomylnie.								 Finished

[CatchMe]

Jak się czuje system. ComboFix nadal listuje C:\WINDOWS\system32\efbebfcbbbcad_r.dll ?

[pentliczek]

Problem dalej występuje 8O

 

A tego pliku combofix nie wykrywa.

[CatchMe]

Wina nie leży po stronie szkodników... 8O

[pentliczek]

W takim razie czy móglby ktoś mi ten temat przenieść do innego działu np. Podstawowe zagadnienia albo Windows, może akurat ktoś się wypowie jeszcze i mi pomoże. Bo wszystkiego co pisało na forum raczej próbowałem. A reinstalla nie chcę mi się robić.

[CatchMe]

Załóż nowy temat. A ja ten wątek zamknę. 8O Pozdrawiam 8O