"Zamyślanie" się systemu.

[Gość luq92]

Mam drobny problem ze swoim XP SP3. Mianowicie system potrafi się ściąć na 2-3 minuty lub w ogóle przestaje reagować. Np podczas włączania programu od neta (Era Mobile Connect) potrafi go tak ściąć, że nawet Menedżer Zadań nie odpowiada. Czasem wystarczy kilka razy kliknąć na zakładkę jakiegoś programu na pasku a czasem trzeba uruchomić ponownie system. O dziwo Start działa bez zarzutu tylko pulpit się "zawiesza". Skanowałem kompa Avirą i Malwarebytes Anti-Malware ale nic nie znalazł. Oba programy są aktualizowane na bieżąco.

Wstawiam log z RIST-a:

Logfile of random's system information tool 1.06 (written by random/random)

Run by Łukasz at 2009-10-14 09:18:27

Microsoft Windows XP Professional Dodatek Service Pack 3

System drive C: has 433 GB (91%) free of 477 GB

Total RAM: 3582 MB (82% free)


Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:22:01, on 2009-10-14

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Aqua Dock\Aqua Dock.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

C:\Documents and Settings\Łukasz\Pulpit\Wygląd XP\TrueTransparency\TrueTransparency.exe

C:\Documents and Settings\Łukasz\Pulpit\Wygląd XP\Yz Shadow\YzShadow.exe

C:\Program Files\AIMP2\AIMP2.exe

C:\Program Files\Nowe Gadu-Gadu\gg.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe

C:\Documents and Settings\Łukasz\Pulpit\OC\Core Temp\Core Temp.exe

C:\Documents and Settings\Łukasz\Pulpit\RSIT.exe

C:\Program Files\trend micro\Łukasz.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)

O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Łukasz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll

O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24\RivaTuner.exe" /S

O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM

O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Aqua Dock] C:\Program Files\Aqua Dock\Aqua Dock.exe

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

O4 - Global Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{ED496F8B-4234-4EAA-8C48-5DB337E1C8AA}: NameServer = 213.158.199.1 213.158.199.5

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe


--

End of file - 5746 bytes


======Registry dump======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

Yahoo! Companion BHO - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll [2005-04-13 327748]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}]

IEPluginBHO Class - C:\Documents and Settings\Łukasz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll [2009-07-27 42088]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - &Yahoo! Companion - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll [2005-04-13 327748]

{3041d03e-fd4b-44e0-b742-2d9b88305f98} - Foxit Toolbar - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-09-19 16844800]

"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2009-07-09 1657376]

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-07-14 86016]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-07-14 13877248]

"RivaTunerStartupDaemon"=C:\Program Files\RivaTuner v2.24\RivaTuner.exe [2009-02-25 2781184]

"LogonStudio"=C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe [2002-09-03 987187]

"BootSkin Startup Jobs"=C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe [2004-04-26 270336]

"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

"Aqua Dock"=C:\Program Files\Aqua Dock\Aqua Dock.exe [2003-11-01 386560]

"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]


C:\Documents and Settings\All Users\Menu Start\Programy\Autostart

RocketDock.lnk - C:\Program Files\RocketDock\RocketDock.exe


C:\Documents and Settings\Łukasz\Menu Start\Programy\Autostart

Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

"NoDrives"=0


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=

"NoDrives"=


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\Nowe Gadu-Gadu\gg.exe"="C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\Documents and Settings\Łukasz\Pulpit\PES 2009\pes2009.exe"="C:\Documents and Settings\Łukasz\Pulpit\PES 2009\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"

"C:\gry\Electronic Arts\Dead Space\Dead Space.exe"="C:\gry\Electronic Arts\Dead Space\Dead Space.exe:*:Enabled:Dead Space ?"

"C:\gry\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe"="C:\gry\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander"

"C:\gry\EA Games\Need For Speed Underground\Speed.exe"="C:\gry\EA Games\Need For Speed Underground\Speed.exe:*:Enabled:Speed"

"C:\gry\Ubisoft\Far Cry 2\bin\FarCry2.exe"="C:\gry\Ubisoft\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2"

"C:\gry\Ubisoft\Far Cry 2\bin\FC2Launcher.exe"="C:\gry\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater"

"C:\gry\Ubisoft\Far Cry 2\bin\FC2Editor.exe"="C:\gry\Ubisoft\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor"

"C:\gry\City Interactive\Dark Sector\DS.exe"="C:\gry\City Interactive\Dark Sector\DS.exe:*:Enabled:Dark Sector"

"C:\gry\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\biahh.exe"="C:\gry\Ubisoft\Gearbox Software\Brothers in Arms - Hell's Highway\Binaries\biahh.exe:*:Enabled:biahh"

"C:\gry\Codemasters\FUEL\FUEL.exe"="C:\gry\Codemasters\FUEL\FUEL.exe:*:Enabled:FUEL"

"C:\gry\CAPCOM\RESIDENT EVIL 5\RE5DX9.EXE"="C:\gry\CAPCOM\RESIDENT EVIL 5\RE5DX9.EXE:*:Enabled:RESIDENT EVIL 5 (DX9)"

"C:\gry\CAPCOM\RESIDENT EVIL 5\RE5DX10.EXE"="C:\gry\CAPCOM\RESIDENT EVIL 5\RE5DX10.EXE:*:Enabled:RESIDENT EVIL 5 (DX10)"

"C:\Documents and Settings\Łukasz\Pulpit\Wheelman\Binaries\WheelmanGame-Final.exe"="C:\Documents and Settings\Łukasz\Pulpit\Wheelman\Binaries\WheelmanGame-Final.exe:*:Enabled:WheelmanGame-Final"

"C:\Documents and Settings\Łukasz\Pulpit\Counter-Strike 1.6\hl.exe"="C:\Documents and Settings\Łukasz\Pulpit\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"

"C:\gry\Valve\hl.exe"="C:\gry\Valve\hl.exe:*:Enabled:Half-Life Launcher"

"C:\gry\Valve\hltv.exe"="C:\gry\Valve\hltv.exe:*:Enabled:HLTV Launcher"


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12bfc6e7-81e2-11de-8a62-ad27ccddc0be}]

shell\AutoRun\command - lcw.exe

shell\open\command - lcw.exe


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd9c0043-81dd-11de-8a61-b12ad7fe6a02}]

shell\AutoRun\command - I:\AutoRun.exe


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e334a0a2-85ee-11de-8a80-001d7dd0161e}]

shell\AutoRun\command - I:\AutoRun.exe



======List of files/folders created in the last 1 months======


2009-10-14 09:18:27 ----D---- C:\rsit

2009-10-13 20:31:29 ----D---- C:\Program Files\Lightsmark 2008

2009-10-10 21:18:41 ----D---- C:\Program Files\Paint.NET

2009-10-10 10:31:30 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\VSO

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcr90.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcr80d.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcr80.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcr70.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcp90.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcp80.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcp71.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcp70.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\msvcm90.dll

2009-10-09 15:37:34 ----A---- C:\WINDOWS\system32\dwmapi.dll

2009-10-09 15:37:32 ----A---- C:\WINDOWS\system32\Vista.Emulation.dll

2009-10-09 15:37:32 ----A---- C:\WINDOWS\system32\msvcm80.dll

2009-10-09 15:37:32 ----A---- C:\WINDOWS\system32\msjava.dll

2009-10-09 15:37:32 ----A---- C:\WINDOWS\system32\M2000Twn.dll

2009-10-09 15:37:21 ----A---- C:\WINDOWS\system32\D3DX10d_39.dll

2009-10-09 15:37:21 ----A---- C:\WINDOWS\system32\d3dx10.dll

2009-10-09 15:37:21 ----A---- C:\WINDOWS\system32\D3D10SDKLayers.DLL

2009-10-09 15:37:21 ----A---- C:\WINDOWS\system32\d2d1.dll

2009-10-09 15:37:21 ----A---- C:\WINDOWS\system32\CompressATI2.dll

2009-10-09 15:37:21 ----A---- C:\WINDOWS\system32\avrt.dll

2009-10-07 19:42:04 ----D---- C:\WINDOWS\USB Vibration

2009-10-06 20:05:42 ----D---- C:\Program Files\Common Files\Adobe Systems Shared

2009-10-06 19:54:10 ----A---- C:\WINDOWS\ulead32.ini

2009-10-06 19:54:10 ----A---- C:\log.txt

2009-10-01 17:02:19 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\FUEL

2009-10-01 16:03:35 ----D---- C:\WINDOWS\system32\xlive

2009-10-01 16:03:35 ----D---- C:\Program Files\Microsoft Games for Windows - LIVE

2009-09-30 16:49:21 ----A---- C:\WINDOWS\system32\XAudio2_5.dll

2009-09-30 16:49:20 ----A---- C:\WINDOWS\system32\xactengine3_5.dll

2009-09-30 16:49:20 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll

2009-09-30 16:49:19 ----A---- C:\WINDOWS\system32\d3dx11_42.dll

2009-09-30 16:49:19 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll

2009-09-30 16:49:18 ----A---- C:\WINDOWS\system32\d3dx10_42.dll

2009-09-30 16:49:17 ----A---- C:\WINDOWS\system32\D3DX9_42.dll

2009-09-30 16:23:22 ----HD---- C:\WINDOWS\msdownld.tmp

2009-09-29 18:31:52 ----D---- C:\Program Files\ALLPlayer

2009-09-29 17:23:25 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Avery

2009-09-29 17:21:41 ----N---- C:\WINDOWS\system32\PCDLIB32.DLL

2009-09-29 17:21:41 ----D---- C:\Program Files\Common Files\Ulead Systems

2009-09-29 17:20:23 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems

2009-09-29 17:14:10 ----D---- C:\WINDOWS\74224F8D4A1748169EDB7BB854DE532C.TMP

2009-09-29 16:46:09 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\Dark Sector

2009-09-29 16:45:04 ----D---- C:\WINDOWS\DD1865F0AD7340FBB23E1822E02396FF.TMP

2009-09-27 19:35:33 ----D---- C:\Program Files\Nowe Gadu-Gadu

2009-09-27 15:06:11 ----D---- C:\WINDOWS\SxsCaPendDel

2009-09-22 16:34:05 ----A---- C:\WINDOWS\system32\XAudio2_4.dll

2009-09-22 16:34:05 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll

2009-09-22 16:34:05 ----A---- C:\WINDOWS\system32\D3DX9_41.dll

2009-09-22 16:34:05 ----A---- C:\WINDOWS\system32\d3dx10_41.dll

2009-09-22 16:34:05 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll

2009-09-22 16:34:04 ----A---- C:\WINDOWS\system32\xactengine3_4.dll

2009-09-22 16:34:04 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll

2009-09-21 18:33:56 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\Microsoft Games

2009-09-19 21:55:10 ----SD---- C:\ComboFix

2009-09-19 21:55:09 ----A---- C:\WINDOWS\system32\CF26615.exe

2009-09-19 10:00:03 ----RASHD---- C:\autorun.inf

2009-09-16 19:21:15 ----A---- C:\WINDOWS\system32\PnkBstrA.exe

2009-09-16 19:20:55 ----A---- C:\WINDOWS\system32\PnkBstrB.exe

2009-09-16 19:15:28 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\Leadertech


======List of files/folders modified in the last 1 months======


2009-10-14 09:21:56 ----D---- C:\Program Files\trend micro

2009-10-14 09:21:31 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #2.txt

2009-10-14 08:51:54 ----SHD---- C:\WINDOWS\Installer

2009-10-14 08:43:40 ----D---- C:\WINDOWS

2009-10-14 07:41:16 ----A---- C:\WINDOWS\NeroDigital.ini

2009-10-14 07:25:06 ----D---- C:\WINDOWS\temp

2009-10-14 06:53:05 ----D---- C:\Program Files\Mozilla Firefox

2009-10-14 06:52:11 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\AIMP

2009-10-14 06:50:41 ----D---- C:\WINDOWS\system32\CatRoot2

2009-10-14 06:50:32 ----A---- C:\WINDOWS\LogonStudio.ini

2009-10-13 22:20:41 ----A---- C:\WINDOWS\SchedLgU.Txt

2009-10-13 20:41:31 ----D---- C:\WINDOWS\Prefetch

2009-10-13 20:41:28 ----RD---- C:\Program Files

2009-10-13 20:31:39 ----SD---- C:\Documents and Settings\Łukasz\Dane aplikacji\Microsoft

2009-10-12 16:28:27 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\Nowe Gadu-Gadu

2009-10-11 19:53:31 ----D---- C:\WINDOWS\system32

2009-10-11 18:05:57 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP

2009-10-10 21:23:13 ----D---- C:\WINDOWS\WinSxS

2009-10-10 21:23:00 ----RSD---- C:\WINDOWS\assembly

2009-10-10 17:34:24 ----D---- C:\WINDOWS\system32\DirectX

2009-10-10 17:34:23 ----HD---- C:\WINDOWS\inf

2009-10-10 17:24:45 ----D---- C:\gry

2009-10-09 17:00:34 ----D---- C:\Program Files\Common Files

2009-10-09 13:44:39 ----D---- C:\Program Files\LIVEUPDATE

2009-10-07 20:02:06 ----HD---- C:\Program Files\InstallShield Installation Information

2009-10-06 20:12:55 ----D---- C:\Documents and Settings\Łukasz\Dane aplikacji\Adobe

2009-10-06 20:06:58 ----D---- C:\Program Files\Adobe

2009-10-06 20:06:10 ----D---- C:\Program Files\Common Files\Adobe

2009-10-04 19:04:56 ----A---- C:\WINDOWS\BRWMARK.INI

2009-10-04 15:45:18 ----D---- C:\Program Files\SpeedFan

2009-10-01 16:03:35 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft

2009-09-30 16:26:10 ----D---- C:\Program Files\AGEIA Technologies

2009-09-30 16:25:36 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

2009-09-29 17:23:25 ----RSD---- C:\WINDOWS\Fonts

2009-09-27 15:04:00 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help

2009-09-27 15:03:55 ----D---- C:\Program Files\Common Files\Microsoft Shared

2009-09-26 15:47:43 ----D---- C:\WINDOWS\Minidump

2009-09-26 09:51:28 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2009-09-22 22:02:04 ----D---- C:\WINDOWS\system32\drivers

2009-09-19 21:55:10 ----D---- C:\Qoobox

2009-09-19 16:08:19 ----D---- C:\WINDOWS\Cursors

2009-09-16 19:15:19 ----D---- C:\WINDOWS\system32\LogFiles


======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======


R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]

R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]

R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]

R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-07-28 55656]

R2 BrPar;BrPar; C:\WINDOWS\System32\drivers\BrPar.sys [2000-07-24 19537]

R2 cpuz132;cpuz132; \??\C:\WINDOWS\system32\drivers\cpuz132_x32.sys []

R3 ALSysIO;ALSysIO; \??\C:\DOCUME~1\UKASZ~1\USTAWI~1\Temp\ALSysIO.sys []

R3 HDAudBus;Sterownik magistrali Microsoft UAA dla High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]

R3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2007-04-20 100992]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-09-19 4617728]

R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-07-14 7741664]

R3 RivaTuner32;RivaTuner32; \??\C:\Program Files\RivaTuner v2.24\RivaTuner32.sys []

R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-09-19 101504]

R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]

R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]

R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]

R3 usbstor;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]

S3 aefdn39w;aefdn39w; C:\WINDOWS\system32\drivers\aefdn39w.sys []

S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys []

S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []

S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []

S3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]

S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []

S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]

S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

S4 WS2IFSL;Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]


======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======


R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-04-19 75304]

R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-07-14 168004]

S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-10-06 72704]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]

S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-05-04 267824]

S3 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-09-16 183112]

S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]

S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]


-----------------EOF-----------------

[Sevard]

Sprawdź pliki:

C:\ComboFix\catchme.sys

C:\WINDOWS\system32\drivers\aefdn39w.sys

C:\DOCUME~1\UKASZ~1\USTAWI~1\Temp\ALSysIO.sys

C:\WINDOWS\gdrv.sys

na VirusTotal.

Poza tym napisz co już robiłeś. Wklej log z pełnego skanu Malwarebytes' Anti-Malware i przeskanuj kompa programem Dr.Web CureIt!.

Otwórz notatnik, wklej do niego to co poniżej:

Windows Registry Editor Version 5.00


[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12bfc6e7-81e2-11de-8a62-ad27ccddc0be}]


[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd9c0043-81dd-11de-8a61-b12ad7fe6a02}]


[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e334a0a2-85ee-11de-8a80-001d7dd0161e}]

zapisz to jako fix.reg i uruchom.

Poza tym poszukaj na dysku pliku lcw.exe (najprawdopodobniej będzie bezpośrednio na dysku C, jeśli będzie taka potrzeba użyj KillBox-a). Ponadto zdezynfekuj wszystkie używane ostatnio pamięci przenośne za pomocą Flash Disinfector-a.

To chyba chwilowo na tyle.