Rozwiązany: Nie moge zakonczyc żadnego procesu

[DzikuXXX]

No wiec ost zauwazylem ze na moim lapku (Dell D600) nie moge zabic zadnego procesu "Operacja nie moze byc zakonczona. Odmowa dostepu". Czy to firefox czy explorer cokolwiek. Konto administratorskie, mam zainstalowane COMODO (antywirus, firewall itd. wszystko wlaczone) i wlasnie robie pelny skan Malwarebytes.

[Sevard]

Poza logiem z Malwarebytes' daj też logi z OTL oraz GMERa (jeśli masz system 32-bitowy).

Jeśli chodzi o logi, to tak:

1. Uruchom program OTL. W OTL pozaznaczaj opcje Infekcja LOP - Sprawdzanie oraz Infekcja Purity - Sprawdzanie, Skanuj wszystkich użytkowników (resztę zostaw bez zmian), poza tym we wszystkich sekcjach zaznacz opcję Użyj filtrowania i kliknij Skanuj.

Jeśli masz system 32-bitowy, to wykonaj dwa kolejne kroki.

2. Jeśli masz jakieś programy emulujące napędy, to ściągnij program Defogger, uruchom go i wyłącz nim emulację napędów. Następnie uruchom ponownie system.

3. Ściągnij program GMER. Nie zmieniaj żadnych opcji i kliknij przycisk Szukaj. Po zakończeniu pracy zostaniesz poinformowany, że log został zapisany w schowku. Otwórz notatnik, wklej go i zapisz na dysku.

W przypadku problemów z GMERem spróbuj uruchomić go w trybie awaryjnym, jeśli i to się nie uda, to będzie trzeba kombinować inaczej.

Na forum zamieść logi z Malwarebytes', OTL (otl.txt oraz extras.txt) i GMERa. Daj je albo jako załączniki do posta, albo wrzuć na wklej.org, a tu daj linka.

[DzikuXXX]

MBAM nic nie wykrył. OTL:

OTL Extras logfile created on: 2011-04-14 18:45:14 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Documents and Settings\Admin\Moje dokumenty\Pobieranie

Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd


1 023,00 Mb Total Physical Memory | 446,00 Mb Available Physical Memory | 44,00% Memory free

2,00 Gb Paging File | 2,00 Gb Available in Paging File | 77,00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]


%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 14,65 Gb Total Space | 6,51 Gb Free Space | 44,43% Space Free | Partition Type: NTFS

Drive D: | 41,24 Gb Total Space | 29,36 Gb Free Space | 71,19% Space Free | Partition Type: NTFS


Computer Name: DZIK-2LCT7SC2FE | User Name: Admin | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l


[HKEY_USERS\S-1-5-21-507921405-1383384898-1343024091-1003\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

htmlfile [edit] -- "D:\Microsoft Office 2007\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "D:\Microsoft Office 2007\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Xfire\Xfire.exe" = C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire -- (Xfire Inc.)

"C:\Program Files\Gadu-Gadu 10\gg.exe" = C:\Program Files\Gadu-Gadu 10\gg.exe:*:Enabled:Gadu-Gadu 10 -- (GG Network S.A.)

"D:\Gry\CABAL Online (EU)\launcher\update\ESTdnheadless.exe" = D:\Gry\CABAL Online (EU)\launcher\update\ESTdnheadless.exe:*:Enabled:EST! download engine -- ()

"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)


========== HKEY_LOCAL_MACHINE Uninstall List ==========


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel

"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6.5

"{20c31435-2a0a-4580-be8b-ac06fc243ca4}" = Python 2.7

"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java 6 Update 24

"{350C97C2-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4B9369FA-AED8-47E7-B01F-0A3BEA7F24E4}" = Dell Client Configuration Toolkit

"{675F03FF-46A0-4FC9-862B-60BA1DC8E9AA}" = Commandos 3 - Destination Berlin

"{6B714273-F9B5-4C11-A920-F06FC5B4DA80}" = Rollercoaster Tycoon 2

"{6FF4B5E9-F1E8-4622-B97C-A1E5344F56AF}" = Zeus Pan Olimpu - Złota Edycja

"{73F1BDB7-11E1-11D5-9DC6-00C04F2FC33B}" = OMCI

"{75ECB77B-A2FD-444B-977A-D5B7ACD80D85}" = Fallout Tactics

"{7E369B27-13E2-41A5-9879-358EE1C8B5AD}" = Broadcom Gigabit Integrated Controller

"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper

"{82CE6B7B-9665-4E29-8CE0-DD993484B38D}" = Oprogramowanie Intel? PROSet/Wireless WiFi

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{87CC8013-56D1-43E1-A0A5-AD406B4EBA95}" = Opera 10.63

"{89ECB1E5-4477-4E01-81CA-734B21EF4C3C}" = Dell OpenManage Client Connector

"{8B5A671D-6471-4A3D-8B44-3177B00E104C}" = Cezar III

"{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (Polish) 12

"{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007

"{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007

"{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007

"{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007

"{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007

"{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007

"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver

"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = C-Major Audio

"{AB699F4B-A587-4681-ACF2-147AD372A2B3}" = Dell OpenManage Management Station

"{AC76BA86-7AD7-1045-7B44-A93000000001}" = Adobe Reader 9.3.4 - Polish

"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet

"{C5BED10B-42A9-4142-B4C2-008C0FDE27D5}" = O2Micro Smartcard Driver

"{CC6B1BB4-4E06-4A5B-A166-B371B551324B}" = COMODO Internet Security

"{D5F881C2-B134-474E-AA60-B25DD218AE0D}" = Crash Analysis Tool

"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"All ATI Software" = ATI - Software Uninstall Utility

"Ashampoo Burning Studio 10_is1" = Ashampoo Burning Studio 10.0.4

"ATI Display Driver" = ATI Display Driver

"Blender" = Blender (remove only)

"CCleaner" = CCleaner

"CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D480 MDC V.92 Modem

"conduitEngine" = Conduit Engine

"Dell TrueMobile GPRS Driver" = Dell TrueMobile GPRS Driver

"Dell TrueMobile GPRS Manager" = Dell TrueMobile GPRS Manager

"FreePascal_is1" = Free Pascal 2.4.0

"Freez FLV to AVI/MPEG/WMV Converter v1.6_is1" = Freez FLV to AVI/MPEG/WMV Converter

"Gadu-Gadu 10" = Gadu-Gadu 10

"Gothic" = Gothic

"HOMESTUDENTR" = Microsoft Office Home and Student 2007

"InstallShield_{C5BED10B-42A9-4142-B4C2-008C0FDE27D5}" = O2Micro Smartcard Driver

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)

"ProInst" = Intel PROSet Wireless

"Sacked" = Sacked - Your last day (Deinstallation)

"Winamp" = Winamp

"Windows Media Format Runtime" = Windows Media Format Runtime

"Windows XP Service Pack" = Windows XP Service Pack 2

"WinRAR archiver" = Archiwizator WinRAR

"Xfire" = Xfire (remove only)

"XfireXO Toolbar" = XfireXO Toolbar

========== HKEY_USERS Uninstall List ==========


[HKEY_USERS\S-1-5-21-507921405-1383384898-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Winamp Detect" = Detektor Winampa

========== Last 10 Event Log Errors ==========


[ Application Events ]

Error - 2011-03-20 15:06:16 | Computer Name = DZIK-2LCT7SC2FE | Source = crypt32 | ID = 131080

Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej

 listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,

 wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu.  


Error - 2011-03-27 18:48:50 | Computer Name = DZIK-2LCT7SC2FE | Source = crypt32 | ID = 131080

Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej

 listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,

 wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu.  


Error - 2011-03-27 18:48:50 | Computer Name = DZIK-2LCT7SC2FE | Source = crypt32 | ID = 131080

Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej

 listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,

 wystąpił błąd: Określony serwer nie może wykonać żądanej operacji.  


Error - 2011-04-04 00:59:06 | Computer Name = DZIK-2LCT7SC2FE | Source = crypt32 | ID = 131080

Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej

 listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,

 wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu.  


Error - 2011-04-05 15:47:08 | Computer Name = DZIK-2LCT7SC2FE | Source = Application Error | ID = 1000

Description = Aplikacja powodująca błąd gothic.exe, wersja 0.0.0.0, moduł powodujący

 błąd gothic.exe, wersja 0.0.0.0, adres błędu 0x000f731e.


Error - 2011-04-06 11:55:22 | Computer Name = DZIK-2LCT7SC2FE | Source = Application Error | ID = 1000

Description = Aplikacja powodująca błąd gothic.exe, wersja 0.0.0.0, moduł powodujący

 błąd unknown, wersja 0.0.0.0, adres błędu 0x0bc6003c.


Error - 2011-04-11 10:50:36 | Computer Name = DZIK-2LCT7SC2FE | Source = crypt32 | ID = 131080

Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej

 listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>,

 wystąpił błąd: Operacja została zwrócona, ponieważ przekroczono limit czasu.  


[ System Events ]

Error - 2011-04-14 11:04:48 | Computer Name = DZIK-2LCT7SC2FE | Source = NetBT | ID = 4321

Description = Nie można zarejestrować nazwy ?MSHOME         :1d? w interfejsie o

 adresie IP 10.0.0.66.  Komputer o adresie IP 10.0.0.68 nie zezwolił na przejęcie 

tej nazwy  przez ten komputer.


Error - 2011-04-14 11:09:59 | Computer Name = DZIK-2LCT7SC2FE | Source = NetBT | ID = 4321

Description = Nie można zarejestrować nazwy ?MSHOME         :1d? w interfejsie o

 adresie IP 10.0.0.66.  Komputer o adresie IP 10.0.0.68 nie zezwolił na przejęcie 

tej nazwy  przez ten komputer.


Error - 2011-04-14 11:15:10 | Computer Name = DZIK-2LCT7SC2FE | Source = NetBT | ID = 4321

Description = Nie można zarejestrować nazwy ?MSHOME         :1d? w interfejsie o

 adresie IP 10.0.0.66.  Komputer o adresie IP 10.0.0.68 nie zezwolił na przejęcie 

tej nazwy  przez ten komputer.


Error - 2011-04-14 11:20:21 | Computer Name = DZIK-2LCT7SC2FE | Source = NetBT | ID = 4321

Description = Nie można zarejestrować nazwy ?MSHOME         :1d? w interfejsie o

 adresie IP 10.0.0.66.  Komputer o adresie IP 10.0.0.68 nie zezwolił na przejęcie 

tej nazwy  przez ten komputer.


Error - 2011-04-14 11:25:32 | Computer Name = DZIK-2LCT7SC2FE | Source = NetBT | ID = 4321

Description = Nie można zarejestrować nazwy ?MSHOME         :1d? w interfejsie o

 adresie IP 10.0.0.66.  Komputer o adresie IP 10.0.0.68 nie zezwolił na przejęcie 

tej nazwy  przez ten komputer.


Error - 2011-04-14 11:29:30 | Computer Name = DZIK-2LCT7SC2FE | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi NICCONFIGSVC z powodu następującego błędu:

   %%2


Error - 2011-04-14 11:29:40 | Computer Name = DZIK-2LCT7SC2FE | Source = DCOM | ID = 10016

Description = Zgodnie z ustawieniami uprawnień domyślne ustawienia komputera nie

 jest udzielane uprawnienie Lokalne Aktywacja do aplikacji serwera COM z identyfikatorem

 klasy   {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}   użytkownikowi ZARZĄDZANIE NT\USŁUGA

 SIECIOWA o identyfikatorze zabezpieczeń (S-1-5-20). To uprawnienie zabezpieczeń

 można modyfikować przy użyciu narzędzia administracyjnego usług składowych.


Error - 2011-04-14 11:29:40 | Computer Name = DZIK-2LCT7SC2FE | Source = DCOM | ID = 10016

Description = Zgodnie z ustawieniami uprawnień domyślne ustawienia komputera nie

 jest udzielane uprawnienie Lokalne Aktywacja do aplikacji serwera COM z identyfikatorem

 klasy   {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}   użytkownikowi ZARZĄDZANIE NT\USŁUGA

 SIECIOWA o identyfikatorze zabezpieczeń (S-1-5-20). To uprawnienie zabezpieczeń

 można modyfikować przy użyciu narzędzia administracyjnego usług składowych.


Error - 2011-04-14 11:29:40 | Computer Name = DZIK-2LCT7SC2FE | Source = DCOM | ID = 10016

Description = Zgodnie z ustawieniami uprawnień domyślne ustawienia komputera nie

 jest udzielane uprawnienie Lokalne Aktywacja do aplikacji serwera COM z identyfikatorem

 klasy   {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}   użytkownikowi ZARZĄDZANIE NT\USŁUGA

 SIECIOWA o identyfikatorze zabezpieczeń (S-1-5-20). To uprawnienie zabezpieczeń

 można modyfikować przy użyciu narzędzia administracyjnego usług składowych.


Error - 2011-04-14 11:30:15 | Computer Name = DZIK-2LCT7SC2FE | Source = NetBT | ID = 4321

Description = Nie można zarejestrować nazwy ?MSHOME         :1d? w interfejsie o

 adresie IP 10.0.0.66.  Komputer o adresie IP 10.0.0.68 nie zezwolił na przejęcie 

tej nazwy  przez ten komputer.



< End of report >

OTL logfile created on: 2011-04-14 18:45:14 - Run 1

OTL by OldTimer - Version 3.2.22.3     Folder = C:\Documents and Settings\Admin\Moje dokumenty\Pobieranie

Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd


1 023,00 Mb Total Physical Memory | 446,00 Mb Available Physical Memory | 44,00% Memory free

2,00 Gb Paging File | 2,00 Gb Available in Paging File | 77,00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]


%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 14,65 Gb Total Space | 6,51 Gb Free Space | 44,43% Space Free | Partition Type: NTFS

Drive D: | 41,24 Gb Total Space | 29,36 Gb Free Space | 71,19% Space Free | Partition Type: NTFS


Computer Name: DZIK-2LCT7SC2FE | User Name: Admin | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========


PRC - [2011-04-14 18:42:27 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Moje dokumenty\Pobieranie\OTL.exe

PRC - [2011-03-24 10:42:56 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2011-03-20 14:09:39 | 002,548,552 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

PRC - [2011-03-20 14:09:13 | 001,803,224 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

PRC - [2010-03-23 04:30:54 | 000,362,408 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\OpenManage\Client\Iap.exe

PRC - [2009-11-03 15:48:54 | 000,874,768 | ---- | M] (Intel? Corporation) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe

PRC - [2009-11-03 15:45:52 | 000,348,160 | ---- | M] (Intel? Corporation) -- C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe

PRC - [2009-11-03 15:45:48 | 001,372,160 | ---- | M] (Intel? Corporation) -- C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe

PRC - [2009-11-03 15:42:00 | 000,909,312 | ---- | M] (Intel? Corporation) -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

PRC - [2009-11-03 15:35:14 | 001,202,448 | ---- | M] (Intel? Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

PRC - [2009-11-03 15:33:48 | 000,473,360 | ---- | M] (Intel? Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

PRC - [2006-06-29 12:13:32 | 001,032,192 | ---- | M] (Dell Inc) -- C:\Program Files\Dell\QuickSet\quickset.exe

PRC - [2005-10-07 14:13:38 | 000,176,128 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe

PRC - [2005-07-27 16:41:08 | 000,045,056 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe

PRC - [2005-01-20 17:37:00 | 000,041,076 | ---- | M] (Dell Computer Corporation) -- C:\Program Files\Dell\OpenManage\OMCC\iws\bin\win32\omaws32.exe

PRC - [2005-01-20 17:32:56 | 000,028,794 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\OpenManage\OMCC\oma\bin\omsad32.exe

PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2004-06-28 23:56:12 | 000,045,056 | R--- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\hidfind.exe


========== Modules (SafeList) ==========


MOD - [2011-04-14 18:42:27 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Moje dokumenty\Pobieranie\OTL.exe

MOD - [2011-03-20 14:14:19 | 000,285,480 | ---- | M] (COMODO) -- C:\WINDOWS\system32\guard32.dll

MOD - [2004-08-04 00:42:34 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll


========== Win32 Services (SafeList) ==========


SRV - File not found [Auto | Stopped] --  -- (NICCONFIGSVC)

SRV - File not found [Disabled | Stopped] --  -- (HidServ)

SRV - File not found [Auto | Running] --  -- (ccadmin)

SRV - [2011-03-20 14:09:13 | 001,803,224 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)

SRV - [2010-06-20 17:41:00 | 003,813,096 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)

SRV - [2010-03-23 04:30:54 | 000,362,408 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\OpenManage\Client\Iap.exe -- (Iap)

SRV - [2009-11-03 15:48:54 | 000,874,768 | ---- | M] (Intel? Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel?

SRV - [2009-11-03 15:45:52 | 000,348,160 | ---- | M] (Intel? Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe -- (WLANKEEPER) Intel?

SRV - [2009-11-03 15:42:00 | 000,909,312 | ---- | M] (Intel? Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe -- (S24EventMonitor) Intel?

SRV - [2009-11-03 15:33:48 | 000,473,360 | ---- | M] (Intel? Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel?

SRV - [2005-01-20 17:32:56 | 000,028,794 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\OpenManage\OMCC\oma\bin\omsad32.exe -- (omccomsad)


========== Driver Services (SafeList) ==========


DRV - [2011-03-20 14:14:14 | 000,094,784 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\inspect.sys -- (Inspect)

DRV - [2011-03-20 14:14:12 | 000,027,576 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp)

DRV - [2011-03-20 14:14:11 | 000,239,368 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdGuard.sys -- (cmdGuard)

DRV - [2011-03-20 14:14:11 | 000,015,592 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmderd.sys -- (cmderd)

DRV - [2011-01-19 22:19:26 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2010-03-08 22:58:36 | 000,020,480 | R--- | M] (Dell Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)

DRV - [2009-11-11 04:26:02 | 002,216,064 | ---- | M] (Intel? Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Sterownik karty Intel?

DRV - [2008-08-13 16:23:56 | 000,011,904 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)

DRV - [2006-05-10 15:00:16 | 000,156,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)

DRV - [2006-03-26 14:22:14 | 000,051,200 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)

DRV - [2006-03-13 11:38:23 | 000,006,656 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)

DRV - [2005-09-28 20:57:18 | 000,113,847 | R--- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2005-08-12 17:50:46 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)

DRV - [2005-05-03 15:09:28 | 001,033,728 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.SYS -- (HSF_DPV)

DRV - [2005-05-03 15:08:50 | 000,208,384 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)

DRV - [2005-05-03 15:08:44 | 000,705,408 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2005-04-21 21:58:38 | 000,092,550 | ---- | M] (O2Micro) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ozscr.sys -- (OZSCR)

DRV - [2005-01-04 11:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\npptNT2.sys -- (NPPTNT2)

DRV - [2004-11-15 15:37:52 | 000,264,440 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\stac97.sys -- (STAC97) Audio Driver (WDM)

DRV - [2004-06-10 22:57:04 | 000,746,496 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2001-10-26 18:07:38 | 000,036,425 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-21-507921405-1383384898-1343024091-1003\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-507921405-1383384898-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-04-13 20:06:37 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-03-24 10:43:06 | 000,000,000 | ---D | M]


[2010-07-28 14:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Extensions

[2011-04-13 19:39:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\a9xivpcn.default\extensions

[2010-12-03 21:30:47 | 000,000,000 | ---D | M] (Zynga Toolbar) -- C:\Documents and Settings\Admin\Dane aplikacji\Mozilla\Firefox\Profiles\a9xivpcn.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}

[2011-04-14 18:43:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2010-08-20 23:32:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2011-04-14 18:43:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

[2010-08-20 23:32:17 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2011-02-02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2010-12-08 00:25:00 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

[2010-09-22 18:30:54 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml

[2010-09-22 18:30:54 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml

[2010-09-22 18:30:54 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml

[2010-09-22 18:30:54 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml

[2010-09-22 18:30:54 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml

[2010-09-22 18:30:54 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml


O1 HOSTS File: ([2001-10-26 17:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-507921405-1383384898-1343024091-1003\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfir.dll (Conduit Ltd.)

O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)

O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)

O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel? Corporation)

O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel? Corporation)

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-507921405-1383384898-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_24)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1

O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()

O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010-07-28 12:52:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{3198cda0-d170-11df-8eac-000e355c7e21}\Shell - "" = AutoRun

O33 - MountPoints2\{3198cda0-d170-11df-8eac-000e355c7e21}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O33 - MountPoints2\{3198cda3-d170-11df-8eac-000e355c7e21}\Shell - "" = AutoRun

O33 - MountPoints2\{3198cda3-d170-11df-8eac-000e355c7e21}\Shell\AutoRun\command - "" = F:\AutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========


[2011-04-14 18:44:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2011-04-14 18:43:01 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2011-04-14 18:43:00 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2011-04-14 18:43:00 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2011-04-02 20:47:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Gothic

[2011-04-02 20:44:19 | 000,327,168 | ---- | C] (InstallShield Software Corporation) -- C:\WINDOWS\IsUn0415.exe

[2011-04-01 18:06:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Rollercoaster Tycoon 2

[2011-03-18 17:12:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Google

[2011-03-18 17:12:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Google

[2011-03-18 17:11:57 | 000,000,000 | ---D | C] -- C:\Program Files\Google

[2011-03-18 17:11:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Google

[2010-07-28 13:52:19 | 000,131,072 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========


[2011-04-14 17:29:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011-04-02 21:06:44 | 000,004,096 | ---- | M] () -- C:\WINDOWS\d3dx.dat

[2011-04-02 20:47:41 | 000,000,579 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Gothic.lnk

[2011-03-27 21:34:46 | 000,008,051 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\user_image.php.jpeg

[2011-03-27 21:34:27 | 000,245,056 | ---- | M] () -- C:\Documents and Settings\Admin\Pulpit\rakdos-demon-lord.jpg

[2011-03-27 14:30:39 | 000,356,068 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat

[2011-03-27 14:30:39 | 000,311,938 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011-03-27 14:30:39 | 000,049,910 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat

[2011-03-27 14:30:39 | 000,040,326 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011-03-20 14:14:19 | 000,285,480 | ---- | M] (COMODO) -- C:\WINDOWS\System32\guard32.dll

[2011-03-20 14:14:14 | 000,094,784 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys

[2011-03-20 14:14:12 | 000,027,576 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys

[2011-03-20 14:14:11 | 000,239,368 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdGuard.sys

[2011-03-20 14:14:11 | 000,015,592 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmderd.sys

[2011-03-19 17:22:46 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========


[2011-04-02 21:06:44 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat

[2011-04-02 20:47:40 | 000,000,579 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Gothic.lnk

[2011-03-27 21:34:45 | 000,008,051 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\user_image.php.jpeg

[2011-03-27 21:34:24 | 000,245,056 | ---- | C] () -- C:\Documents and Settings\Admin\Pulpit\rakdos-demon-lord.jpg

[2011-03-11 09:17:49 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011-02-26 03:19:32 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll

[2010-11-08 17:41:17 | 000,008,192 | ---- | C] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010-11-08 17:36:43 | 008,676,883 | ---- | C] () -- C:\WINDOWS\System32\NCMedia2.dll

[2010-11-08 17:36:43 | 000,758,018 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2010-11-08 17:36:43 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2010-07-28 14:59:10 | 001,029,921 | ---- | C] () -- C:\WINDOWS\System32\drivers\sfi.dat

[2010-07-28 14:28:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010-07-28 14:21:35 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\QSLLPSVCShare

[2010-07-28 13:52:17 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe

[2010-07-28 13:52:17 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll

[2010-07-28 13:45:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\setup.INI

[2010-07-28 13:40:51 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2010-07-28 13:39:53 | 000,140,440 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010-07-28 13:14:09 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll

[2010-07-28 12:54:57 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2010-07-28 12:49:38 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2004-08-02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2001-10-26 19:30:20 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2001-10-26 18:15:16 | 000,356,068 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat

[2001-10-26 18:15:16 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat

[2001-10-26 18:15:16 | 000,049,910 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat

[2001-10-26 18:15:16 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat

[2001-08-23 15:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001-08-23 15:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001-08-17 23:30:24 | 000,311,938 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001-08-17 23:30:24 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001-08-17 23:30:24 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001-08-17 23:30:22 | 000,040,326 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001-08-17 23:15:38 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001-07-22 04:41:32 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2001-07-22 00:36:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001-07-22 00:36:04 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001-07-22 00:24:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== LOP Check ==========


[2010-12-09 16:13:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\.minecraft

[2010-11-08 18:35:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Ashampoo

[2010-07-30 12:04:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Blender Foundation

[2011-01-20 11:55:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\DAEMON Tools Lite

[2010-10-29 12:20:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Gadu-Gadu 10

[2010-08-30 14:51:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Dane aplikacji\Opera

[2010-11-08 18:34:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo

[2011-01-19 22:19:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite

[2010-07-28 15:32:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10

========== Purity Check ==========




< End of report >

Log z GMERa nie chcial wejsc wiec

http://wklejto.pl/95445

[Sevard]

W logach z OTL nie widać śladów infekcji. W logu z GMERa nic nie widać, bo nie została prawidłowo wyłączona emulacja napędów. Tym razem wyłącz ją i dopiero wtedy przeprowadź skan. Z innych rzeczy, które widać - masz strasznie nieaktualny system. Dotyczy to tak samego systemu, jak i dodatkowego oprogramowania typu Adobe Reader, czy Adobe Flash. Wypada coś z tym zrobić.

Jeśli chodzi o problem, to proponuję spróbować przywrócić domyślne ustawienia zabezpieczeń za pomocą secedit.

[DzikuXXX]

Nowe logi link.

[Sevard]

Czysto. Wyłącz Piaskownicę w Comodo Internet Security i zobacz, czy nadal jest to samo.

Możesz też spróbować przywrócić domyślne zasady zabezpieczeń. Tu masz opisane jak to zrobić.

[DzikuXXX]

Problem po prostu wziął i zniknał. Do zamkniecia.

[Sevard]

Problem rozwiązany, więc temat zamykam.

W razie potrzeby otwarcia tematu, proszę o kontakt przez PW.