Problem z zalogowaniem się do facebooka

[kosodrzewina1]

Nie mogę wejść na stronę facebooka. Pojawia się komuniakt: Błąd 324 (net::ERR_EMPTY_RESPONSE): Serwer zakończył połączenie bez wysyłania jakichkolwiek danych. Mogę wejść na wszytskie inne strony więc nie mam problemu z połączeniem internetowym.

Proszę o pomoc

OTL.Txt=Notatnik

OTL logfile created on: 2012-05-12 20:57:51 - Run 1
OTL by OldTimer - Version 3.2.42.3 Folder = F:\Google Chrome
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

3,00 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 69,74% Memory free
4,84 Gb Paging File | 3,96 Gb Available in Paging File | 81,78% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 1,90 Gb Free Space | 9,73% Space Free | Partition Type: NTFS
Drive D: | 148,44 Gb Total Space | 137,31 Gb Free Space | 92,51% Space Free | Partition Type: NTFS
Drive E: | 148,44 Gb Total Space | 125,08 Gb Free Space | 84,26% Space Free | Partition Type: NTFS
Drive F: | 149,35 Gb Total Space | 133,68 Gb Free Space | 89,51% Space Free | Partition Type: NTFS

Computer Name: YAMO | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-05-12 20:56:12 | 000,595,456 | ---- | M] (OldTimer Tools) -- F:\Google Chrome\OTL.exe
PRC - [2012-04-28 04:07:02 | 001,224,176 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe
PRC - [2012-02-03 14:34:58 | 000,793,048 | ---- | M] (PC Tools) -- C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
PRC - [2011-08-02 09:33:30 | 004,910,912 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe
PRC - [2010-12-16 07:19:28 | 012,984,928 | ---- | M] (GG Network S.A.) -- C:\Program Files\Gadu-Gadu 10\gg.exe
PRC - [2009-06-12 13:29:27 | 000,575,616 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
PRC - [2009-06-12 13:29:26 | 000,461,952 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32.exe
PRC - [2008-06-25 17:28:24 | 000,174,688 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
PRC - [2008-06-25 15:43:10 | 000,055,904 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\ORSP Client\fsorsp.exe
PRC - [2008-06-25 15:42:56 | 000,686,688 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
PRC - [2008-06-25 15:42:50 | 000,232,088 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
PRC - [2008-06-25 15:42:48 | 000,404,064 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
PRC - [2008-06-25 15:42:48 | 000,182,936 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
PRC - [2008-06-25 15:42:48 | 000,125,592 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
PRC - [2008-06-25 15:42:48 | 000,117,400 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
PRC - [2008-06-25 15:42:32 | 000,604,768 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
PRC - [2008-06-25 15:41:54 | 000,510,560 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\FWES\program\fsdfwd.exe
PRC - [2008-06-25 15:41:34 | 000,215,648 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
PRC - [2008-06-25 15:41:34 | 000,043,680 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
PRC - [2008-06-25 15:41:32 | 000,344,160 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
PRC - [2008-06-25 15:41:04 | 000,490,080 | ---- | M] (F-Secure Corporation) -- C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
PRC - [2007-08-11 15:50:00 | 000,331,264 | ---- | M] () -- C:\Program Files\NetMeter\NetMeter.exe
PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2012-05-12 12:28:49 | 000,134,144 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.5_0\BabylonChromeToolBar.dll
MOD - [2012-05-04 20:01:18 | 008,797,856 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
MOD - [2012-04-28 04:07:01 | 000,444,400 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\18.0.1025.168\ppgooglenaclpluginchrome.dll
MOD - [2012-04-28 04:06:59 | 003,915,248 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\18.0.1025.168\pdf.dll
MOD - [2012-04-28 04:05:34 | 000,122,880 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\18.0.1025.168\avutil-51.dll
MOD - [2012-04-28 04:05:33 | 000,220,672 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\18.0.1025.168\avformat-53.dll
MOD - [2012-04-28 04:05:32 | 001,747,456 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\18.0.1025.168\avcodec-53.dll
MOD - [2012-04-28 03:09:18 | 008,743,584 | ---- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
MOD - [2012-04-19 15:04:30 | 000,481,792 | ---- | M] () -- C:\Documents and Settings\Admin\Dane aplikacji\BabylonToolbar\CR\BUSolution.dll
MOD - [2010-12-16 07:20:20 | 000,217,696 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gglog.dll
MOD - [2010-12-16 07:20:18 | 000,123,488 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggipcradioproxy.dll
MOD - [2010-12-16 07:20:16 | 000,017,504 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggipc.dll
MOD - [2010-12-16 07:20:12 | 000,027,744 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggcrypto.dll
MOD - [2010-12-16 07:20:10 | 000,356,960 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggcommon.dll
MOD - [2010-08-06 21:01:42 | 002,404,352 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\QtCore4.dll
MOD - [2010-08-06 21:01:42 | 001,515,520 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\QtScript4.dll


2.
Extras.Txt-Notatnik
OTL Extras logfile created on: 2012-05-12 20:57:51 - Run 1
OTL by OldTimer - Version 3.2.42.3 Folder = F:\Google Chrome
Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

3,00 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 69,74% Memory free
4,84 Gb Paging File | 3,96 Gb Available in Paging File | 81,78% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 1,90 Gb Free Space | 9,73% Space Free | Partition Type: NTFS
Drive D: | 148,44 Gb Total Space | 137,31 Gb Free Space | 92,51% Space Free | Partition Type: NTFS
Drive E: | 148,44 Gb Total Space | 125,08 Gb Free Space | 84,26% Space Free | Partition Type: NTFS
Drive F: | 149,35 Gb Total Space | 133,68 Gb Free Space | 89,51% Space Free | Partition Type: NTFS

Computer Name: YAMO | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1390067357-630328440-725345543-1003\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[kominekl]

Logi.

Oba logi są poucinane. Zrób nowe logi z OTL -> http://hotfix.pl/articles.php?article_id=143 i TDSSKiller -> http://www.hotfix.pl/instrukcja-obslugi ... r-a341.htm. Wklej je na -> Dostępne tylko dla zarejestrowanych użytkowników i podaj nam tu linki do nich.

[kosodrzewina1]

Dostępne tylko dla zarejestrowanych użytkowników
Dostępne tylko dla zarejestrowanych użytkowników

[kominekl]

DRV - [2005-10-13 15:46:08 | 000,035,328 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfsync03.sys -- (sfsync03) StarForce Protection Synchronization Driver (version 3.x)
DRV - [2005-09-29 19:01:51 | 000,066,048 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005-08-10 14:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005-05-16 15:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{58E65E96-6649-4CBE-9382-35326D694E6F}" = MSN Toolbar Platform
"BabylonToolbar" = Babylon toolbar on IE
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Registry Mechanic_is1" = PC Tools Registry Mechanic 11.0
"Shop for HP Supplies" = Shop for HP Supplies

To zbędne oprogramowanie. Wpisy odnoszące się do DRV to pozostałości po sterownikach starych zapór StarForce. Kolejne to zbędne paski narzędziowe i inny śmieć. Co do PCTools to użyjemy po prostu czego innego . Odinstaluj to wszystko.

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKU\S-1-5-21-1390067357-630328440-725345543-1003..\Run: [ALLUpdate] C:\Program Files\ALLPlayer\ALLUpdate.exe ()
O4 - HKU\S-1-5-21-1390067357-630328440-725345543-1003..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe ()
O4 - HKU\S-1-5-21-1390067357-630328440-725345543-1003..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

To zbędne wpisy w autostarcie. Wejdź w START -> URUCHOM -> Msconfig -> Usługi -> odznacz usługę -> NVIDIA Display Driver Service (NVSVC). Resztę usunę poniższym skryptem.

O33 - MountPoints2\{ef23d7c0-437a-11e1-9ae5-00241d39c408}\Shell - "" = AutoRun
O33 - MountPoints2\{ef23d7c0-437a-11e1-9ae5-00241d39c408}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.hta

Ciekawa sprawa. To zapis pozostałości infekcji z pamięci przenośnej. Z podłączonymi pamięciami przenośnymi użyj USBFix`a z opcji Deletion -> http://www.hotfix.pl/uzytkowanie-progra ... x-a310.htm i zaprezentuj uzyskany log.

Logi.

Uruchom OTL -> w oknie Własne opcje skanowania/skrypt wklej:

:OTL

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TBPANEL.SYS -- (Cardex)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (axbtbqht)
IE - HKU\S-1-5-21-1390067357-630328440-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Dostępne tylko dla zarejestrowanych użytkowników
IE - HKU\S-1-5-21-1390067357-630328440-725345543-1003\..\SearchScopes,DefaultScope = {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}
IE - HKU\S-1-5-21-1390067357-630328440-725345543-1003\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}
IE - HKU\S-1-5-21-1390067357-630328440-725345543-1003\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\4.0.0357.1\Firefox [2011-07-31 16:28:48 | 000,000,000 | ---D | M]
CHR - Extension: Babylon Toolbar = C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.5_0\
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Admin\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [GEST] m‘|\ü File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKU\S-1-5-21-1390067357-630328440-725345543-1003..\Run: [ChomikBox] C:\Program Files\ChomikBox\ChomikBox.exe File not found
O4 - HKU\S-1-5-21-1390067357-630328440-725345543-1003..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray File not found
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:D1B5B4F1

:Files
C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google\Update
C:\Program Files\MSN Toolbar
C:\Documents and Settings\Admin\Dane aplikacji\BabylonToolbar
C:\Program Files\BabylonToolbar
C:\Program Files\DTLite4413-0173.exe
C:\WINDOWS\tasks\*.job
C:\WINDOWS\tasks\SA.DAT
C:\Documents and Settings\Admin\Dane aplikacji\Registry Mechanic
C:\Documents and Settings\All Users\Dane aplikacji\Easy Driver Pro
C:\Documents and Settings\All Users\Dane aplikacji\G Data
C:\Documents and Settings\All Users\Dane aplikacji\TEMP
C:\Documents and Settings\All Users\Dane aplikacji\{1C784526-6D15-423B-B312-9B13AFEAB996}

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
"NvCplDaemon"=-
"NvMediaCenter"=-
"nwiz"=-
[HKEY_USERS\S-1-5-21-1390067357-630328440-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run]
"ALLUpdate"=-
"C:\Program Files\NetMeter\NetMeter.exe"=-
"DAEMON Tools Lite"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptyflash]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL -> http://hotfix.pl/articles.php?article_id=143 + log z TDSSKiller -> http://www.hotfix.pl/instrukcja-obslugi ... r-a341.htm.