morwin utworzono 25 marca 2015 utworzono 25 marca 2015 Witam Laptop Toshiba Sattelite 300A Windows vista 32bit, miałem ciągłe problemy z wirusami, cały czas powracały, okazało się że to zainfekowany router, wymieniłem go ponieważ był archaiczny teraz prosiłbym o sprawdzenie czy są jeszcze jakieś pozostałości na komputerze po infekcji. Nie mogę uruchomić większości programów, pojawia się błąd "System nie może uzysklać dostępu do określonego urządzenia, ścieżki lub pliku", ale Adwcleanera i FRST uruchomiłem poprzez CMD (odziwo działa). FRST.txt [log]Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015 Ran by Ja (administrator) on JA-PC on 25-03-2015 18:04:41 Running from F:\ Loaded Profiles: Ja (Available profiles: Ja) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Polski (Polska) Internet Explorer Version 9 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (IObit) C:\Program Files\IObit\Advanced SystemCare 8\ASCService.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (IObit) C:\Program Files\IObit\Advanced SystemCare 8\Monitor.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (IObit) C:\Program Files\IObit\Advanced SystemCare 8\ASCTray.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (IObit) C:\Program Files\IObit\IObit Uninstaller\UninstallMonitor.exe (Microsoft Corporation) C:\Windows\System32\cmd.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKU\S-1-5-21-2382593646-536633303-284044230-1000\...\Run: [Advanced SystemCare 8] => C:\Program Files\IObit\Advanced SystemCare 8\ASCTray.exe [2426144 2014-11-25] (IObit) HKU\S-1-5-21-2382593646-536633303-284044230-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2382593646-536633303-284044230-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2382593646-536633303-284044230-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll [2015-01-12] (IObit) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-01-10] (AVAST Software) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\sm4n57ae.default FF Homepage: hxxp://allegro.pl/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation) FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\sm4n57ae.default\Extensions\iobitascsurfingprotection@iobit.com [2015-01-12] FF Extension: Adblock Plus - C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\sm4n57ae.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-13] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-10] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2015-01-10] Chrome: ======= CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-01-10] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-10] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AdvancedSystemCareService8; C:\Program Files\IObit\Advanced SystemCare 8\ASCService.exe [815392 2014-11-04] (IObit) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-10] (AVAST Software) S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2631456 2014-11-26] (IObit) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-18] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2015-01-10] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [73480 2015-01-10] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55240 2015-01-10] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2015-01-10] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2015-01-10] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2015-01-10] (AVAST Software) R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57928 2015-01-10] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2015-01-10] () R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO32.SYS [23840 2015-01-12] (REALiX(tm)) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-18] (Microsoft Corporation) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 catchme; \??\C:\Users\Ja\AppData\Local\Temp\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-25 18:03 - 2015-03-25 18:04 - 00000000 ____D () C:\FRST 2015-03-25 17:54 - 2015-03-25 17:56 - 00000000 ____D () C:\AdwCleaner 2015-03-25 17:25 - 2015-03-25 17:25 - 00015621 _____ () C:\ComboFix.txt 2015-03-25 17:11 - 2015-03-25 17:26 - 00000000 ____D () C:\ddddddd 2015-03-25 17:11 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-03-25 17:11 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-03-25 17:11 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-03-25 17:11 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-03-25 17:11 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-03-25 17:11 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-03-25 17:11 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-03-25 17:11 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-03-25 17:10 - 2015-03-25 17:25 - 00000000 ____D () C:\Qoobox 2015-03-25 17:10 - 2015-03-25 17:24 - 00000000 ____D () C:\Windows\erdnt 2015-03-25 17:06 - 2015-03-25 17:06 - 02168320 _____ () C:\Users\Ja\Downloads\adwcleaner_4.113.exe 2015-03-25 17:02 - 2015-03-25 17:03 - 05615749 _____ (Swearware) C:\Users\Ja\Downloads\ComboFix.exe 2015-03-23 18:42 - 2015-03-23 18:42 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2015-03-16 11:51 - 2015-03-16 11:51 - 02171392 _____ () C:\Users\Ja\Downloads\adwcleaner_4.112_www.INSTALKI.pl.exe 2015-03-16 11:50 - 2015-03-16 11:51 - 02171392 _____ () C:\Users\Ja\Downloads\AdwCleaner(1).exe 2015-03-16 11:47 - 2015-03-25 17:29 - 00006852 _____ () C:\Windows\PFRO.log 2015-03-16 11:44 - 2015-03-16 11:44 - 02171392 _____ () C:\Users\Ja\Downloads\AdwCleaner.exe 2015-03-16 11:44 - 2015-03-16 11:44 - 02171392 _____ () C:\Users\Ja\Desktop\AdwCleaner(1).exe 2015-03-12 03:10 - 2015-02-26 01:18 - 02064384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-03-12 03:10 - 2015-01-29 02:35 - 00975360 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-03-12 03:10 - 2015-01-29 02:35 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2015-03-12 03:05 - 2015-02-20 03:03 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-03-12 03:05 - 2015-02-20 01:28 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-03-12 03:04 - 2015-02-26 03:01 - 03604408 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-03-12 03:04 - 2015-02-26 03:01 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-03-12 03:04 - 2015-01-21 03:02 - 00807936 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll 2015-03-12 03:04 - 2015-01-09 03:04 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-03-12 03:04 - 2015-01-09 01:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-03-12 03:03 - 2015-03-06 05:01 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-03-12 03:02 - 2014-10-13 02:12 - 02264064 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2015-03-12 03:01 - 2015-02-18 03:02 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2015-03-11 11:09 - 2015-02-21 18:37 - 12375040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-03-11 11:09 - 2015-02-21 18:34 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-03-11 11:09 - 2015-02-21 18:29 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-03-11 11:09 - 2015-02-21 18:28 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-03-11 11:09 - 2015-02-21 18:22 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-03-11 11:09 - 2015-02-21 18:21 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-03-11 11:09 - 2015-02-21 18:21 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-03-11 11:09 - 2015-02-21 18:20 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-03-11 11:09 - 2015-02-21 18:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-03-11 11:09 - 2015-02-21 18:19 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-03-11 11:09 - 2015-02-21 18:19 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-03-11 11:09 - 2015-02-21 18:19 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-03-11 11:09 - 2015-02-21 18:19 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-03-11 11:09 - 2015-02-21 18:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-03-11 11:09 - 2015-02-21 18:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-03-11 11:09 - 2015-02-21 18:18 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-03-11 11:09 - 2015-02-21 18:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-03-11 11:09 - 2015-02-21 18:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-03-11 11:09 - 2015-02-21 18:18 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-03-11 11:09 - 2015-02-21 18:18 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-03-11 11:09 - 2015-02-21 18:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-03-11 11:09 - 2015-02-21 18:17 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-03-07 14:17 - 2015-03-07 14:19 - 00000000 ____D () C:\Users\Ja\Desktop\ROCZEK OLEŃKI FILMIKI ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-25 18:03 - 2006-11-02 13:52 - 01130175 _____ () C:\Windows\WindowsUpdate.log 2015-03-25 17:57 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-03-25 17:57 - 2006-11-02 13:47 - 00004048 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-03-25 17:57 - 2006-11-02 13:47 - 00004048 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-03-25 17:40 - 2006-11-02 14:01 - 00030988 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-03-25 17:29 - 2015-01-10 19:17 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2015-03-25 17:25 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default 2015-03-25 17:25 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public 2015-03-25 17:22 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini 2015-03-25 17:05 - 2015-01-10 19:02 - 00021504 _____ () C:\Users\Ja\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-03-25 17:05 - 2006-12-05 06:22 - 00714160 _____ () C:\Windows\system32\perfh015.dat 2015-03-25 17:05 - 2006-12-05 06:22 - 00151000 _____ () C:\Windows\system32\perfc015.dat 2015-03-25 17:05 - 2006-11-02 11:33 - 01613794 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-03-25 17:01 - 2015-01-10 19:53 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-03-24 10:17 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2015-03-24 09:43 - 2015-01-10 20:10 - 00000000 ____D () C:\Users\Ja\Desktop\2013-04-22 kamazz 22.42013 2015-03-23 06:23 - 2015-01-12 08:14 - 00000000 ____D () C:\ProgramData\ProductData 2015-03-20 20:01 - 2015-01-10 20:10 - 00000000 ____D () C:\Users\Ja\Desktop\zdj do ogł 2015-03-17 20:07 - 2015-01-10 20:10 - 00000000 ____D () C:\Users\Ja\Desktop\ogłoszenia 2015-03-12 03:29 - 2006-11-02 13:47 - 00300024 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-03-12 03:10 - 2015-01-10 21:21 - 00000000 ____D () C:\Windows\system32\MRT 2015-03-12 03:06 - 2006-11-02 11:24 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2015-02-24 04:23 - 2015-01-10 20:07 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe ==================== Files in the root of some directories ======= 2015-01-10 20:03 - 2015-01-10 20:03 - 0000172 _____ () C:\Users\Ja\AppData\Roaming\ex_log.txt 2015-01-10 19:02 - 2015-01-10 19:38 - 0000680 _____ () C:\Users\Ja\AppData\Local\d3d9caps.dat 2015-01-10 19:02 - 2015-03-25 17:05 - 0021504 _____ () C:\Users\Ja\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini Some content of TEMP: ==================== C:\Users\Ja\AppData\Local\temp\Quarantine.exe C:\Users\Ja\AppData\Local\temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-03-25 18:06 ==================== End Of Log ============================[/log] Addition.txt [log]Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015 Ran by Ja at 2015-03-25 18:05:30 Running from F:\ Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated) Advanced SystemCare 8 (HKLM\...\Advanced SystemCare 8_is1) (Version: 8.0.3 - IObit) Avast Free Antivirus (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software) HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5051&SUBSYS_1179) (Version: - ) Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - ) IObit Uninstaller (HKLM\...\IObitUninstall) (Version: 4.1.5.24 - IObit) Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Polski) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1045) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation) Mozilla Firefox 36.0.4 (x86 pl) (HKLM\...\Mozilla Firefox 36.0.4 (x86 pl)) (Version: 36.0.4 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla) Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - plk) (Version: - Microsoft Corporation) Surfing Protection (HKLM\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit) The Bat! Professional v5.3.8 (HKLM\...\{1B557E79-DA3D-4C2A-9A2C-BFED2D2D2C43}) (Version: 5.3.8.0 - Ritlabs) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 05-02-2015 11:55:09 Zaplanowany punkt kontrolny 10-02-2015 09:26:10 Windows Update 12-02-2015 09:10:29 Windows Update 12-02-2015 09:24:57 Windows Update 13-02-2015 03:00:15 Windows Update 17-02-2015 08:15:49 Windows Update 24-02-2015 08:19:51 Windows Update 03-03-2015 08:42:35 Windows Update 10-03-2015 08:42:56 Windows Update 12-03-2015 03:00:19 Windows Update 17-03-2015 07:52:18 Windows Update 24-03-2015 08:23:51 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 11:23 - 2015-03-25 17:22 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0DB6E679-9A15-48F4-A66A-C5D164575012} - System32\Tasks\ASC8_PerformanceMonitor => C:\Program Files\IObit\Advanced SystemCare 8\Monitor.exe [2014-11-26] (IObit) Task: {251FC824-BF7F-4459-8BA6-953D547EB247} - System32\Tasks\Driver Booster SkipUAC (Ja) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe Task: {27178E78-E701-4EC2-A3E7-F352290B94BE} - System32\Tasks\ASC8_SkipUac_Ja => C:\Program Files\IObit\Advanced SystemCare 8\ASC.exe [2014-11-26] (IObit) Task: {4E1B8F2B-412C-4E81-AB7C-6245CC388EF8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated) Task: {77845986-A3CA-4CAE-9F6E-43779BA6619D} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => C:\Windows\servicing\vsp1ceip.exe [2008-01-18] (Microsoft Corporation) Task: {98F41D64-BAB3-4B0B-8DCC-B536EDDFF8E6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-10] (AVAST Software) Task: {A3B2056E-4F99-4102-9468-E3111A27FE85} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {A473FF03-CFF8-4850-886C-78CA9AB95B0B} - System32\Tasks\Uninstaller_SkipUac_Ja => C:\Program Files\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-11-04] (IObit) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============== 2015-01-12 08:14 - 2013-10-25 12:08 - 00517408 _____ () C:\Program Files\IObit\Advanced SystemCare 8\sqlite3.dll 2015-03-25 17:02 - 2015-03-25 17:02 - 02923008 _____ () C:\Program Files\AVAST Software\Avast\defs\15032500\algo.dll 2015-01-12 08:14 - 2013-01-15 18:48 - 00348992 _____ () C:\Program Files\IObit\Advanced SystemCare 8\madExcept_.bpl 2015-01-12 08:14 - 2013-01-15 18:48 - 00183616 _____ () C:\Program Files\IObit\Advanced SystemCare 8\madBasic_.bpl 2015-01-12 08:14 - 2013-01-15 18:48 - 00051008 _____ () C:\Program Files\IObit\Advanced SystemCare 8\madDisAsm_.bpl 2015-01-12 08:14 - 2014-10-16 10:26 - 00622880 _____ () C:\Program Files\IObit\Advanced SystemCare 8\ProductStatistics.dll 2015-01-10 19:39 - 2015-01-10 19:39 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll 2015-03-13 19:09 - 2015-03-13 19:09 - 38714440 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2015-01-12 08:14 - 2013-01-15 18:47 - 00893248 _____ () C:\Program Files\IObit\Advanced SystemCare 8\webres.dll 2015-01-12 08:14 - 2013-01-15 18:48 - 00348992 _____ () C:\Program Files\IObit\IObit Uninstaller\madExcept_.bpl 2015-01-12 08:14 - 2013-01-15 18:48 - 00183616 _____ () C:\Program Files\IObit\IObit Uninstaller\madBasic_.bpl 2015-01-12 08:14 - 2013-01-15 18:48 - 00051008 _____ () C:\Program Files\IObit\IObit Uninstaller\madDisAsm_.bpl ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2382593646-536633303-284044230-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\Wallpaper\img24.jpg DNS Servers: 192.168.1.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) ==================== Accounts: ============================= Administrator (S-1-5-21-2382593646-536633303-284044230-500 - Administrator - Disabled) Gość (S-1-5-21-2382593646-536633303-284044230-501 - Limited - Disabled) Ja (S-1-5-21-2382593646-536633303-284044230-1000 - Administrator - Enabled) => C:\Users\Ja ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (03/25/2015 05:42:18 PM) (Source: EventSystem) (EventID: 4609) (User: ) Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c Error: (03/25/2015 05:40:55 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/25/2015 05:28:18 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Interfejs jest nieznany Error: (03/25/2015 05:28:17 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/23/2015 06:20:38 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/23/2015 06:20:37 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/17/2015 08:20:38 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/17/2015 08:20:38 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/16/2015 09:39:55 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/16/2015 09:39:54 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście System errors: ============= Error: (03/25/2015 06:01:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: LiveUpdate1 Error: (03/25/2015 05:58:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Usługa listy sieciRozpoznawanie lokalizacji w sieci%%1068 Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Usługa listy sieciRozpoznawanie lokalizacji w sieci%%1068 Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Usługa listy sieciRozpoznawanie lokalizacji w sieci%%1068 Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Usługa listy sieciRozpoznawanie lokalizacji w sieci%%1068 Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: AFD aswRdr aswRvrt aswSnx aswSP aswTdi aswVmm DfsC HWiNFO32 NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx Wanarpv6 ws2ifsl Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Usługa listy sieciRozpoznawanie lokalizacji w sieci%%1068 Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Rozpoznawanie lokalizacji w sieciUsługa interfejsu magazynu sieciowego%%1068 Error: (03/25/2015 05:43:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Połączenia siecioweUsługa interfejsu magazynu sieciowego%%1068 Microsoft Office Sessions: ========================= Error: (03/25/2015 05:42:18 PM) (Source: EventSystem) (EventID: 4609) (User: ) Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c Error: (03/25/2015 05:40:55 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/25/2015 05:28:18 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Interfejs jest nieznany Error: (03/25/2015 05:28:17 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/23/2015 06:20:38 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/23/2015 06:20:37 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/17/2015 08:20:38 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/17/2015 08:20:38 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/16/2015 09:39:55 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście Error: (03/16/2015 09:39:54 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: ) Description: Nieprawidłowe dojście CodeIntegrity Errors: =================================== Date: 2015-01-11 12:27:58.816 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-11 12:27:58.754 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-11 12:27:58.691 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-11 12:27:58.613 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-11 12:27:58.551 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz Percentage of memory in use: 48% Total physical RAM: 2037.67 MB Available physical RAM: 1051.68 MB Total Pagefile: 4314.61 MB Available Pagefile: 3339.66 MB Total Virtual: 2047.88 MB Available Virtual: 1881.57 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:116.21 GB) (Free:68.55 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Data) (Fixed) (Total:115.21 GB) (Free:94.63 GB) NTFS Drive f: () (Removable) (Total:29.31 GB) (Free:1.63 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 4D3DF35F) Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27) Partition 2: (Active) - (Size=116.2 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=115.2 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 29.3 GB) (Disk ID: 2BCD4389) Partition 1: (Active) - (Size=29.3 GB) - (Type=07 NTFS) ==================== End Of Log ============================[/log]
Zayfi komentarz 27 marca 2015 komentarz 27 marca 2015 Otwórz notatnik i wklej CloseProcesses: HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2382593646-536633303-284044230-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...d=ie&ar=msnhome HKU\S-1-5-21-2382593646-536633303-284044230-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 catchme; \??\C:\Users\Ja\AppData\Local\Temp\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] EmptyTemp: plik zapisz jako fixlist.txt i umieść na dysku F. Uruchom FRST i kliknij w Fix. Przedstaw raport fixlog.txt. 2. Odinstaluj z panelu programów Surfing Protection i IObit Uninstaller 3. Przedstaw raport z Combofixa C:\ComboFix.txt
Wciąż szukasz rozwiązania problemu? Napisz teraz na forum!
Możesz zadać pytanie bez konieczności rejestracji - wystarczy, że wypełnisz formularz.