Autoodtwarzanie Windows 7

[Arnoldo]

Tak jak w temacie. A dokładniej problem polega na braku autoodtwarzania płytek po włożeniu do napędu. Zawsze muszę otwierać zawartość z ikonki ręcznie. W panelu sterowania, autoodtwarzanie włączone dla wszystkich nośników i urządzeń.

Ma ktoś jakieś pomysły co z tym zrobić?

[Arnoldo]

Akurat tak prostą czynność próbowałem zrobić. Bez skutku oczywiście. Problem musi leżeć gdzieś głębiej zakopany w systemie.

[[Ekspert] Hakken]

Instalowałeś ostatnio VMware ?

[helmud7543]

W kluczach rejestru HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer i HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer znajdź NoDriveTypeAutoRun i ustaw wartość szesnastkową na 91. Po restarcie powinno być ok.

[Arnoldo]

Zrzut ekranu ze ścieżki pierwszej wygląda tak:

natomiast klucz drugi wygląda tak:

Także czegoś ewidentnie tu brakuje, coś jest ewidentnie w tym rejestrze pochrzanione.

[helmud7543]

Otwórz notatnik i wpisz w nim:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoDriveTypeAutoRun"=-

Kliknij zapisz jako, wybierz Wszystkie pliki i zapisz plik jako cośtam.reg. Uruchom ten plik, potwierdź chęć zmian w rejestrze (gdyby pojawił się komunikat). Otwórz jeszcze raz rejestr i ustaw wartość NoDriveTypeAutoRun jak napisałem wcześniej. Zrestartuj komputer - powinno być ok.

[Arnoldo]

Niestety mimo, że komunikat był, że zmiany zostały pomyślnie wprowadzone do rejestru to w rzeczywistości nie ma żadnych zmian. Wszystko jest ja było poprzednio na zamieszczonych obrazkach.

[helmud7543]

Hakken pytał czy instalowałeś VMware? Instalowałeś?

[[Ekspert] Hakken]

W zasadzie to nie tylko VMware, ale również Nero, PowerISO, Magical ISO, i inne programy tworzące napędy wirtualne - one mogą psuć autorun, więc mógłbyś spróbować je usunąć (jeśli takie masz).

Co więcej:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDRom

Powinno być 1

[Arnoldo]

Mam zainstalowany nero oraz daemon tools lite. Odinstalowanie tych programów przywróci rejestr do stanu normalności? Poza tym jednak ich używam, także jak to zrobić, żeby pogodzić jedno z drugim?

[[Ekspert] Hakken]

usunięcie tych programów i naprawianie rejesstru opisane wcześniej powinno pomóc. Jeśli chcesz tych programów używać no to cóż, coś za coś, ale wydaje mi się, że autorun nie jest aż tak ważny.

Sam decyduj, ale pewności, że usunięcie tych programów pomoże nie mamy.

[Arnoldo]

Usunąłem te programy. Naprawiłem rejestr podanym sposobem. Nie przyniósł rezultatu. Żadne zmiany nie zostały wprowadzone. Cały czas wygląda to tak jak na screenach, które zamieściłem.

[Arnoldo]

Podbijam temat. Jakieś dalsze sugestie, pomysły?

[helmud7543]

Następna w kolejce jest infekcja. Zapoznaj się z podwieszonym tematem w dziale Programy.

[Arnoldo]

Myślę, że infekcję można prawie napewno wykluczyć. Komputer regularnie jest skanowany antywirusem (comodo), na bieżąco aktualizowanym itd.

[helmud7543]

Są następujące możliwości. Albo jakiś program (złośliwy lub celowo zainstalowany) nie pozwala na wprowadzenie zmian, albo po ich wprowadzeniu skutecznie wprowadza swoje. Trudno jednak zgadywać, jaki to program... Może jednak daj logi jakie podaje się przy infekcji - zobaczymy, co tam masz zainstalowane.

[Arnoldo]

Podaję log z RISTa

Logfile of random's system information tool 1.09 (written by random/random)

Run by Arnoldo at 2012-04-23 11:33:57

Microsoft Windows 7 Professional  Service Pack 1

System drive C: has 59 GB (38%) free of 155 GB

Total RAM: 4095 MB (72% free)


Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:34:00, on 2012-04-23

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v8.00 (8.00.7601.17514)

Boot mode: Normal


Running processes:

C:\Windows\SysWOW64\HsMgr.exe

C:\Program Files (x86)\Xfire\Xfire.exe

C:\Users\Arnoldo\Desktop\RSIT.exe

C:\Program Files (x86)\trend micro\Arnoldo.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.searchcompletion.com/?si=10180&home=1

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.searchcompletion.com/?si=10180&home=1

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.searchcompletion.com/?si=10180&home=1

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.searchcompletion.com/?si=10180&home=1

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll

O2 - BHO: Complitly - {D27FC31C-6E3D-4305-8D53-ACDAEFA5F862} - C:\Users\Arnoldo\AppData\Roaming\Complitly\Complitly.dll

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'USŁUGA SIECIOWA')

O4 - Startup: Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &P&obierz &za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs:      C:\Windows\SysWOW64\guard32.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: BitComet Disk Boost Service (BITCOMET_HELPER_SERVICE) - www.BitComet.com - C:\Program Files\BitComet\tools\BitCometService.exe

O23 - Service: COMODO Internet Security Helper Service (cmdagent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)


--

End of file - 6910 bytes


=========Mozilla firefox=========


ProfilePath - C:\Users\Arnoldo\AppData\Roaming\Mozilla\Firefox\Profiles\2v8hleih.default


prefs.js - "browser.search.useDBForOrder" -  false

prefs.js - "browser.startup.homepage" -  "http://www.wp.pl"

prefs.js - "extensions.enabledItems" -  "{3205B348-523A-4fac-9BC4-9939CBF583B0}:2.1.5, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13"

prefs.js - "keyword.URL" -  "http://search.searchcompletion.com/?bs=1&si=10180&q="


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe? Flash? Player 10.1 Plugin

"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@esn.me/esnsonar,version=0.70.4]

"Description"=ESN Sonar browser plugin

"Path"=C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@esn/esnlaunch,version=1.104.0]

"Description"=

"Path"=C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@esn/esnlaunch,version=1.118.0]

"Description"=

"Path"=C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll


C:\Program Files (x86)\Mozilla Firefox\extensions\

{972ce4c6-7e08-4474-a285-3208198ce6fd}


C:\Program Files (x86)\Mozilla Firefox\components\

browser.xpt

browserdirprovider.dll

brwsrcmp.dll

components.list

compreg.dat

FeedConverter.js

FeedProcessor.js

FeedWriter.js

fuelApplication.js

GPSDGeolocationProvider.js

jar50.dll

jsconsole-clhandler.js

jsd3250.dll

NetworkGeolocationProvider.js

nsAddonRepository.js

nsBadCertHandler.js

nsBlocklistService.js

nsBrowserContentHandler.js

nsBrowserGlue.js

nsCloseAllWindows.js

nsContentDispatchChooser.js

nsContentPrefService.js

nsDefaultCLH.js

nsDictionary.js

nsDownloadManagerUI.js

nsExtensionManager.js

nsFormAutoComplete.js

nsHandlerService.js

nsHelperAppDlg.js

nsINIProcessor.js

nsIQTScriptablePlugin.xpt

nsLivemarkService.js

nsLoginInfo.js

nsLoginManager.js

nsLoginManagerPrompter.js

nsMicrosummaryService.js

nsPlacesAutoComplete.js

nsPlacesDBFlush.js

nsPlacesTransactionsService.js

nsPostUpdateWin.js

nsPrivateBrowsingService.js

nsProxyAutoConfig.js

nsSafebrowsingApplication.js

nsSearchService.js

nsSearchSuggestions.js

nsSessionStartup.js

nsSessionStore.js

nsSetDefaultBrowser.js

nsSidebar.js

nsTaggingService.js

nsTryToClose.js

nsUpdateService.js

nsUpdateServiceStub.js

nsUpdateTimerManager.js

nsUrlClassifierLib.js

nsUrlClassifierListManager.js

nsURLFormatter.js

nsWebHandlerApp.js

nsXmlRpcClient.js

pluginGlue.js

storage-Legacy.js

storage-mozStorage.js

txEXSLTRegExFunctions.js

WebContentConverter.js

xpinstal.dll

xpti.dat


C:\Program Files (x86)\Mozilla Firefox\plugins\

npnul32.dll

nsIQTScriptablePlugin.xpt


C:\Program Files (x86)\Mozilla Firefox\searchplugins\

allegro-pl.png

allegro-pl.src

allegro-pl.xml

Complitly.xml

fbc-pl.xml

google-pl.gif

google-pl.src

google.xml

merlin-pl.png

merlin-pl.src

merlin-pl.xml

pbi-pl.png

pbi-pl.src

pwn-pl.png

pwn-pl.src

pwn-pl.xml

wikipedia-pl.png

wikipedia-pl.src

wikipedia-pl.xml

wp-pl.png

wp-pl.src

wp-pl.xml


C:\Users\Arnoldo\AppData\Roaming\Mozilla\Firefox\Profiles\2v8hleih.default\extensions\

{3205B348-523A-4fac-9BC4-9939CBF583B0}

{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}

{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}


======Registry dump======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]

BitComet Helper - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll [2011-04-11 767280]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D27FC31C-6E3D-4305-8D53-ACDAEFA5F862}]

Complitly - C:\Users\Arnoldo\AppData\Roaming\Complitly\Complitly.dll [2011-04-13 139768]


C:\Users\Arnoldo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Xfire.lnk - C:\Program Files (x86)\Xfire\Xfire.exe


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="     C:\Windows\SysWOW64\guard32.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}


[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=0

"ConsentPromptBehaviorUser"=3

"EnableLUA"=0

"EnableUIADesktopToggle"=0

"PromptOnSecureDesktop"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoActiveDesktop"=1

"NoActiveDesktopChanges"=1

"ForceActiveDesktopOn"=0


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"vidc.uyvy"=msyuv.dll

"vidc.yuy2"=msyuv.dll

"vidc.yvyu"=msyuv.dll

"vidc.iyuv"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"vidc.yvu9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\SysWOW64\l3codeca.acm

"vidc.cvid"=iccvid.dll

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

"wave2"=wdmaud.drv

"midi2"=wdmaud.drv

"mixer2"=wdmaud.drv

"aux2"=wdmaud.drv

"wave3"=wdmaud.drv

"midi3"=wdmaud.drv

"mixer3"=wdmaud.drv

"aux3"=wdmaud.drv

"wave4"=wdmaud.drv

"midi4"=wdmaud.drv

"mixer4"=wdmaud.drv

"vidc.DIVX"=DivX.dll

"vidc.xvid"=xvidvfw.dll

"VIDC.XFR1"=xfcodec.dll

"msacm.ac3filter"=ac3filter.acm

"msacm.voxacm160"=vct3216.acm

"msacm.scg726"=scg726.acm

"msacm.alf2cd"=alf2cd.acm

"msacm.ac3acm"=AC3ACM.acm

"vidc.dvsd"=mcdvd_32.dll

"vidc.mpg4"=mpg4c32.dll

"vidc.mp42"=mpg4c32.dll

"vidc.mp43"=mpg4c32.dll


======File associations======


.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*


======List of files/folders created in the last 1 month======


2012-04-20 21:45:34 ----D---- C:\Program Files (x86)\Deep Silver

2012-04-20 14:08:50 ----D---- C:\rsit

2012-04-20 14:08:50 ----D---- C:\Program Files (x86)\trend micro

2012-04-19 17:48:53 ----D---- C:\Program Files (x86)\Wiedźmin Edycja Rozszerzona

2012-04-16 20:01:02 ----RA---- C:\Windows\SysWOW64\tmp80AF.tmp

2012-04-16 19:50:09 ----D---- C:\Program Files (x86)\DAEMON Tools Lite

2012-04-12 17:57:17 ----D---- C:\Program Files (x86)\THQ

2012-04-09 19:50:39 ----D---- C:\Program Files (x86)\1C Company

2012-04-07 20:08:54 ----D---- C:\ProgramData\EA Logs

2012-04-07 14:37:16 ----D---- C:\Program Files (x86)\Common Files\SWF Studio

2012-04-07 14:36:24 ----D---- C:\Program Files (x86)\LucasArts

2012-03-25 20:23:57 ----D---- C:\Program Files (x86)\Common Files\AVSMedia

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\xvidvfw.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\xvidcore.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\msxml3a.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\msvcr70.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\msvcp70.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\mpg4c32.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\mfc70.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\mcdvd_32.dll

2012-03-25 20:23:57 ----A---- C:\Windows\SysWOW64\GdiPlus.dll


======List of files/folders modified in the last 1 month======


2012-04-22 23:16:33 ----D---- C:\Windows\System32

2012-04-22 23:16:33 ----D---- C:\Windows\inf

2012-04-22 17:55:45 ----D---- C:\Program Files (x86)\Steam

2012-04-22 17:54:24 ----D---- C:\Users\Arnoldo\AppData\Roaming\Xfire

2012-04-20 23:09:31 ----D---- C:\ProgramData\Xfire

2012-04-20 22:01:57 ----D---- C:\Users\Arnoldo\AppData\Roaming\Skype

2012-04-20 21:52:28 ----D---- C:\Windows\Temp

2012-04-20 21:52:13 ----RSD---- C:\Windows\assembly

2012-04-20 21:51:43 ----SHD---- C:\System Volume Information

2012-04-20 21:45:34 ----RD---- C:\Program Files (x86)

2012-04-20 21:06:19 ----D---- C:\Windows\Prefetch

2012-04-20 12:32:16 ----D---- C:\Windows

2012-04-19 18:01:32 ----SHD---- C:\Windows\Installer

2012-04-19 17:50:11 ----HD---- C:\Program Files (x86)\InstallShield Installation Information

2012-04-17 22:18:20 ----D---- C:\Users\Arnoldo\AppData\Roaming\BitComet

2012-04-16 20:41:25 ----D---- C:\Windows\winsxs

2012-04-16 20:31:54 ----D---- C:\Windows\SysWOW64

2012-04-16 20:31:54 ----D---- C:\Program Files (x86)\Common Files\microsoft shared

2012-04-16 20:01:02 ----A---- C:\Windows\SysWOW64\wrap_oal.dll

2012-04-16 20:01:02 ----A---- C:\Windows\SysWOW64\OpenAL32.dll

2012-04-16 20:00:20 ----D---- C:\Windows\Logs

2012-04-15 22:10:35 ----D---- C:\Users\Arnoldo\AppData\Roaming\Winamp

2012-04-14 16:49:59 ----D---- C:\Users\Arnoldo\AppData\Roaming\BESTplayer

2012-04-14 13:17:30 ----D---- C:\Program Files (x86)\Common Files

2012-04-10 14:11:06 ----SD---- C:\ProgramData\Microsoft

2012-04-10 14:11:06 ----D---- C:\Windows\Registration

2012-04-09 22:50:36 ----D---- C:\Program Files (x86)\ChomikBox

2012-04-07 20:36:53 ----A---- C:\Windows\SysWOW64\PnkBstrB.exe

2012-04-07 20:10:56 ----D---- C:\Program Files (x86)\Battlelog Web Plugins

2012-04-07 20:08:54 ----HD---- C:\ProgramData

2012-04-07 19:50:06 ----D---- C:\Program Files (x86)\Origin

2012-04-07 14:36:13 ----D---- C:\Program Files (x86)\Common Files\InstallShield

2012-03-25 20:23:59 ----RSD---- C:\Windows\Fonts


======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======


R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys []

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []

R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys []

R1 cmderd;COMODO Internet Security Eradication Driver; C:\Windows\System32\DRIVERS\cmderd.sys []

R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys []

R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys []

R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys []

R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys []

R1 networx;networx; C:\Windows\system32\drivers\networx.sys []

R3 cmudaxp;ASUS Xonar DG Audio Interface; C:\Windows\system32\drivers\cmudaxp.sys []

R3 RTL8023x64;Sterownik Realtek 10/100 NIC Family NDIS x64; C:\Windows\system32\DRIVERS\Rtnic64.sys []

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-06-06 11856]

R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\WmBEnum.sys []

R3 WmXlCore;Logitech Translation Layer Driver; C:\Windows\system32\drivers\WmXlCore.sys []

S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys []

S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []

S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys []

S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys []

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys []

S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys []

S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys []

S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys []

S3 WmFilter;Logitech Gaming HID Filter Driver; C:\Windows\system32\drivers\WmFilter.sys []

S3 WmHidLo;Logitech Gaming USB Filter Driver; C:\Windows\system32\drivers\WmHidLo.sys []

S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\Windows\system32\drivers\WmVirHid.sys []


======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======


R2 cmdagent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2012-03-11 2815496]

R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []

R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2012-01-22 76888]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-06-14 2026304]

R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 20992]

S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]

S3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service; C:\Program Files\BitComet\tools\BitCometService.exe [2010-12-28 1296728]

S3 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]

S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2009-07-16 316664]

S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]

S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]


-----------------EOF-----------------

[helmud7543]

Nie mam pojęcia co może powoodwać ten problem. Może poproś o pomoc Sevarda albo kogoś innego obytego chociażby w usuwaniu infekcji.