Nagły spadek wydajności komputera (szybkość startu)

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 17:15

mam problem, bo od jakiegoś czasu totalnie spadła mi wydajność komputera. włączenie systemu niby wygląda normalnie, ale trzeba czekać około 3 minut zanim się system skończy ładować (wcześniej to było o wiele szybciej), a 1-2 minut zanim np. odpali się firefox czy inne programy. (przy okazji też jest problem jak pobieram jakiś plik, jak jest 99% i kilka sekund, firefox się wiesza na około 30 sekund. praktycznie zawsze)
też mnie zastanawia jedna rzecz, bo zawsze jak wybiorę "wyłącz komputer" zanim zacznie się wyłączać minie około 2 minut a później jeszcze wyskakuje okienko (takie jak wtedy, kiedy program nie odpowiada) z wyborem "Zakończ teraz". program nazywa się "n" (tak jedna mała litera n)

log z gmera - komputer się zresetował sam z siebie na końcu. po ponownym uruchomieniu komputera wyskoczył komunikat, że system odzyskał sprawność po poważnym błędzie. włączę go jeszcze raz, i jak sytuacja się nie powtórzy dam loga później.

log z otl

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-06-21 17:10:31 - Run 2 OTL by OldTimer - Version 3.2.6.1 Folder = C:\Documents and Settings\Fibi\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 100,00 Mb Available Physical Memory | 39,00% Memory free 618,00 Mb Paging File | 353,00 Mb Available in Paging File | 57,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 38,16 Gb Total Space | 18,23 Gb Free Space | 47,75% Space Free | Partition Type: NTFS Drive D: | 19,08 Gb Total Space | 8,10 Gb Free Space | 42,46% Space Free | Partition Type: NTFS Drive E: | 19,07 Gb Total Space | 15,35 Gb Free Space | 80,51% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: FIBI Current User Name: Fibi Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) .txt [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found [HKEY_USERS\S-1-5-21-2025429265-789336058-1060284298-1003\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Java\jre1.6.0_05\bin\javaw.exe" = C:\Program Files\Java\jre1.6.0_05\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.) "C:\Program Files\Psi\psi.exe" = C:\Program Files\Psi\psi.exe:*:Enabled:psi -- () "C:\Program Files\Ipswitch\WS_FTP Professional\wsftpgui.exe" = C:\Program Files\Ipswitch\WS_FTP Professional\wsftpgui.exe:*:Enabled:WS_FTP Pro Application -- (Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421) "C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "C:\Program Files\NAPI-PROJEKT\napisy.exe" = C:\Program Files\NAPI-PROJEKT\napisy.exe:*:Enabled:napisy.exe -- () "C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- File not found "C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com) "C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com) "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation) "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe" = C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service -- (Cisco Systems, Inc.) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00000415-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium "{036FD544-AED6-3F33-856D-A2292D0CF471}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - PLK "{08BF6EA5-120D-462D-ADE0-912A77DBCB2E}" = Cisco Network Magic "{0CE5F45E-F6CC-4638-B0DD-BB7F6EF56713}" = HP Deskjet D1500 Printer Driver Software 10.0 Rel .3 "{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox "{1871FE54-36AA-478F-B374-A46BA54474CC}" = ESET NOD32 Antivirus "{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20 "{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1 "{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5 "{305468A6-DE2D-43ba-A168-2F45A97A89DA}" = DJ_SF_03_D1500_Software_Min "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = SAGEM F@st 800-840 "{588AA47B-9115-44D3-B2E5-4F10BC659D6C}" = Nokia PC Connectivity Solution "{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{77296E63-8C19-462B-ABA1-F510750A8C51}" = Nokia PC Suite "{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0 "{7C77393F-8237-3825-A88A-AFAF3C69C072}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - PLK "{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme "{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan "{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport "{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer "{AC76BA86-7AD7-1045-7B44-A81200000003}" = Adobe Reader 8 - Polish "{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}" = Ipswitch WS_FTP Professional 2007 "{B1421599-A42D-47ef-B512-B9B0317BD599}" = DJ_SF_03_D1500_Software "{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1 "{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0 "{c6922d7f-c698-4d9e-9671-8b3de04d1511}" = DJ_AIO_03_F2200_Software_Min "{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg "{D77D43B5-ED55-426b-B67B-E21F804F6102}" = HP Deskjet F2200 All-In-One Driver Software 10.0 Rel .3 "{db18dc72-cd20-4801-be82-f5d2caeec4d7}" = DJ_AIO_03_F2200_Software "{E4DD8B33-6F9B-41C5-96FF-5DBF27ED23E7}" = Nokia Connectivity Cable Driver "{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0 "{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer "{F31E509D-3597-324E-83CF-0C160B2320F0}" = Microsoft .NET Framework 3.5 Language Pack - plk "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "{FC467B61-F890-4E29-8585-365DAB66F13E}" = Pure Networks Platform "010D072E91408D6B7C6FC65489B6D30C027605F5" = Windows Driver Package - Nokia Modem (04/06/2006 6.8.0.17) "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "Adobe Shockwave Player" = Adobe Shockwave Player "AP Guitar Tuner 1.02" = AP Guitar Tuner 1.02 "Diablo II" = Diablo II "Eset NOD32 v3.0.642 FiX1.2 by TemDono_is1" = NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up "GoldWave v5.55" = GoldWave v5.55 "Guitar Pro 5_is1" = Guitar Pro 5.2 "Hydrogen" = Hydrogen "IrfanView" = IrfanView (remove only) "KLiteCodecPack_is1" = K-Lite Codec Pack 3.9.0 Full "LastFM_is1" = Last.fm 1.5.4.24567 "Linren CD Ripper" = Linren CD Ripper "Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5 "Microsoft .NET Framework 3.5 Language Pack - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 — PLK "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "Mozilla Thunderbird (2.0.0.24)" = Mozilla Thunderbird (2.0.0.24) "MPPL 08" = MPPL 08 "NapiProjekt_is1" = NapiProjekt 1.0.6.9 "Nero - Burning Rom!UninstallKey" = Nero OEM "Network MagicUninstall" = Network Magic "NVIDIA Drivers" = NVIDIA Drivers "Picasa2" = Picasa 2 "Psi" = Psi (remove only) "PSPad editor_is1" = PSPad editor "SopCast" = SopCast 3.2.9 "Streamripper" = Streamripper (Remove only) "SystemRequirementsLab" = System Requirements Lab "Tibia Auto" = NSIS Example2 "Tibia_is1" = Tibia "uTorrent" = µTorrent "Vista Drive Icon" = Vista Drive Icon 1.4 "WIC" = Windows Imaging Component "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 2 "WinRAR archiver" = Archiwizator WinRAR "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-2025429265-789336058-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Facebook Plug-In" = Facebook Plug-In "foobar2000" = foobar2000 v0.9.5.2 "Sansa Updater" = Sansa Updater [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2010-03-09 17:48:15 | Computer Name = FIBI | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd psi.exe, wersja 0.0.0.0, moduł powodujący błąd psi.exe, wersja 0.0.0.0, adres błędu 0x000ba07a. Error - 2010-03-23 15:54:41 | Computer Name = FIBI | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd 158.exe, wersja 0.0.0.0, moduł powodujący błąd 158.exe, wersja 0.0.0.0, adres błędu 0x00001b5c. Error - 2010-03-28 07:44:44 | Computer Name = FIBI | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.2180, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x676c8062. Error - 2010-04-14 07:02:07 | Computer Name = FIBI | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 6.0.2900.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2010-04-14 07:05:37 | Computer Name = FIBI | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 6.0.2900.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2010-05-02 14:41:16 | Computer Name = FIBI | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd fifa08.exe, wersja 0.0.0.0, moduł powodujący błąd fifa08.exe, wersja 0.0.0.0, adres błędu 0x001c659f. Error - 2010-05-07 08:09:32 | Computer Name = FIBI | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 6.0.2900.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2010-05-30 09:51:23 | Computer Name = FIBI | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca wsftpgui.exe, wersja 2007.0.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2010-06-12 17:25:57 | Computer Name = FIBI | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd psi.exe, wersja 0.0.0.0, moduł powodujący błąd psi.exe, wersja 0.0.0.0, adres błędu 0x000ba07a. Error - 2010-06-16 04:28:21 | Computer Name = FIBI | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca psi.exe, wersja 0.0.0.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2010-06-21 07:13:29 | Computer Name = FIBI | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys) z powodu następującego błędu: %%2 Error - 2010-06-21 07:13:29 | Computer Name = FIBI | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą Eset Nod32 Boot. Error - 2010-06-21 07:13:29 | Computer Name = FIBI | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Eset Nod32 Boot z powodu następującego błędu: %%1053 Error - 2010-06-21 09:28:03 | Computer Name = FIBI | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys) z powodu następującego błędu: %%2 Error - 2010-06-21 09:28:03 | Computer Name = FIBI | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą Eset Nod32 Boot. Error - 2010-06-21 09:28:03 | Computer Name = FIBI | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Eset Nod32 Boot z powodu następującego błędu: %%1053 Error - 2010-06-21 11:04:48 | Computer Name = FIBI | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys) z powodu następującego błędu: %%2 Error - 2010-06-21 11:04:48 | Computer Name = FIBI | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą Eset Nod32 Boot. Error - 2010-06-21 11:04:48 | Computer Name = FIBI | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Eset Nod32 Boot z powodu następującego błędu: %%1053 Error - 2010-06-21 11:04:55 | Computer Name = FIBI | Source = System Error | ID = 1003 Description = Kod błędu 10000050, parametr 1 fc958000, parametr 2 00000000, parametr 3 f3d70fec, parametr 4 00000000. < End of report >

Kod: Zaznacz wszystko: OTL logfile created on: 2010-06-21 17:10:31 - Run 2 OTL by OldTimer - Version 3.2.6.1 Folder = C:\Documents and Settings\Fibi\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 100,00 Mb Available Physical Memory | 39,00% Memory free 618,00 Mb Paging File | 353,00 Mb Available in Paging File | 57,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 38,16 Gb Total Space | 18,23 Gb Free Space | 47,75% Space Free | Partition Type: NTFS Drive D: | 19,08 Gb Total Space | 8,10 Gb Free Space | 42,46% Space Free | Partition Type: NTFS Drive E: | 19,07 Gb Total Space | 15,35 Gb Free Space | 80,51% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: FIBI Current User Name: Fibi Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-06-21 15:38:06 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Fibi\Pulpit\OTL.exe PRC - [2010-05-26 22:20:12 | 000,079,872 | ---- | M] (SanDisk Corporation) -- C:\Documents and Settings\Fibi\Dane aplikacji\SanDisk\Sansa Updater\SansaDispatch.exe PRC - [2010-04-03 11:00:51 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-11-16 10:04:30 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe PRC - [2009-11-16 10:03:32 | 002,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe PRC - [2009-07-07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe PRC - [2008-04-13 14:39:20 | 000,049,152 | ---- | M] (artArmin) -- C:\Program Files\Vista Drive Icon\DrvIcon.exe PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-06-21 15:38:06 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Fibi\Pulpit\OTL.exe MOD - [2004-08-04 00:42:34 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- -- (gusvc) SRV - [2009-11-16 10:12:54 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV - [2009-11-16 10:04:30 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2009-07-07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice) SRV - [2006-04-12 11:36:56 | 000,176,640 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- (ServiceLayer) SRV - [2001-10-26 19:30:00 | 000,003,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\regedt32.exe -- (NOD32FiXTemDono) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-16 10:06:50 | 000,096,408 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir) DRV - [2009-11-16 10:03:36 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2009-11-16 09:56:12 | 000,116,520 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2009-07-07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis) DRV - [2009-07-07 15:48:44 | 000,025,392 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp) DRV - [2008-06-10 21:05:20 | 000,223,128 | ---- | M] (DT Soft Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\dtscsi.sys -- (dtscsi) DRV - [2008-05-16 18:30:57 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi) DRV - [2007-03-08 14:34:46 | 004,027,840 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2006-09-24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan) DRV - [2006-08-11 15:42:42 | 003,958,496 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2006-03-24 08:32:00 | 000,127,488 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (Nokia USB Phone Parent) DRV - [2006-03-24 08:32:00 | 000,013,312 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (Nokia USB Port) DRV - [2006-03-24 08:32:00 | 000,013,312 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (Nokia USB Modem) DRV - [2006-03-24 08:32:00 | 000,008,704 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (Nokia USB Generic) DRV - [2005-08-10 12:43:22 | 000,041,984 | R--- | M] (D-Link ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dlkfet5b.sys -- (FETNDISB) DRV - [2004-08-04 00:07:56 | 000,059,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) Sterownik audio USB (WDM) DRV - [2004-08-03 23:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2001-08-17 23:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401) DRV - [1996-04-03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = wyborcza.pl/0,0.html?p=030 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2025429265-789336058-1060284298-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = wyborcza.pl/0,0.html?p=030 IE - HKU\S-1-5-21-2025429265-789336058-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "wyborcza.pl/0,0.html?p=030" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3 FF - prefs.js..extensions.enabledItems: {317B5128-0B0B-49b2-B2DB-1E7560E16C74}:2.5.13 FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.9 FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-04-03 15:38:22 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-06-16 21:05:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010-03-17 19:38:02 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2008-12-20 19:16:28 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-01-25 21:01:40 | 000,000,000 | ---D | M] [2009-01-11 21:52:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Extensions [2010-06-20 22:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions [2010-03-26 23:47:41 | 000,000,000 | ---D | M] (Screengrab) -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2010-06-05 12:13:35 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74} [2010-05-23 21:44:33 | 000,000,000 | ---D | M] (Stylish) -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2009-09-27 22:50:30 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2010-03-24 17:14:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66} [2009-09-27 14:57:47 | 000,000,000 | ---D | M] (Web Developer) -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2010-04-30 13:36:24 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009-01-31 17:23:43 | 000,004,431 | ---- | M] () -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\searchplugins\lingpl.xml [2008-05-07 19:11:15 | 000,001,779 | ---- | M] () -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\searchplugins\torrentz-search.xml [2010-01-09 22:16:28 | 000,001,979 | ---- | M] () -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\searchplugins\wrzuta.xml [2008-05-06 19:27:00 | 000,002,126 | ---- | M] () -- C:\Documents and Settings\Fibi\Dane aplikacji\Mozilla\Firefox\Profiles\c20ymn4q.default\searchplugins\wyszukiwanie-filmw-wideo-w-youtube.xml [2010-06-20 22:16:36 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010-05-31 20:47:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-05-31 20:46:11 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2010-03-14 12:27:12 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-03-14 12:27:12 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-03-14 12:27:12 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-03-14 12:27:12 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-03-14 12:27:12 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-03-14 12:27:12 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2008-07-08 22:53:28 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe (artArmin) O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKU\S-1-5-21-2025429265-789336058-1060284298-1003..\Run: [SansaDispatch] C:\Documents and Settings\Fibi\Dane aplikacji\SanDisk\Sansa Updater\SansaDispatch.exe (SanDisk Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2025429265-789336058-1060284298-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2025429265-789336058-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-2025429265-789336058-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-2025429265-789336058-1060284298-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.204.159.1 194.204.152.34 O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Fibi\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Fibi\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-05-06 00:19:43 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-06-21 15:36:53 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Fibi\Pulpit\OTL.exe [2010-06-21 15:20:16 | 000,880,624 | ---- | C] (Duplex Secure Ltd.) -- C:\Documents and Settings\Fibi\Pulpit\SPTDinst-v162-x86.exe [2010-06-15 17:21:22 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\ST6UNST.EXE [2010-06-14 11:28:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Fibi\Dane aplikacji\Facebook [2010-06-13 13:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Fibi\Dane aplikacji\Tibia [2010-06-13 13:14:30 | 000,000,000 | ---D | C] -- C:\Program Files\T [2010-06-01 18:34:47 | 000,094,208 | ---- | C] (Blizzard Entertainment) -- C:\WINDOWS\DIIUnin.exe [2010-06-01 18:27:30 | 000,000,000 | ---D | C] -- C:\Program Files\Diablo II [2010-05-31 20:48:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun [2010-05-31 20:47:07 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-05-31 20:47:07 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-05-31 20:47:06 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-05-31 20:47:05 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-06-21 17:04:37 | 000,081,191 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2010-06-21 17:04:12 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-06-21 17:04:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-06-21 15:38:06 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Fibi\Pulpit\OTL.exe [2010-06-21 15:30:07 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Fibi\Pulpit\4ts3348x.exe [2010-06-21 15:26:24 | 006,291,456 | -H-- | M] () -- C:\Documents and Settings\Fibi\NTUSER.DAT [2010-06-21 15:26:24 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Fibi\ntuser.ini [2010-06-21 15:25:58 | 004,126,012 | -H-- | M] () -- C:\Documents and Settings\Fibi\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-06-21 15:20:23 | 000,880,624 | ---- | M] (Duplex Secure Ltd.) -- C:\Documents and Settings\Fibi\Pulpit\SPTDinst-v162-x86.exe [2010-06-21 14:04:28 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010-06-21 14:04:23 | 000,154,624 | ---- | M] () -- C:\Documents and Settings\Fibi\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-06-20 22:04:57 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-06-15 17:21:56 | 000,001,215 | ---- | M] () -- C:\WINDOWS\ST6UNST.001 [2010-06-15 17:21:52 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ST6UNST.EXE [2010-06-15 17:21:23 | 000,000,341 | ---- | M] () -- C:\WINDOWS\ST6UNST.000 [2010-06-08 16:44:27 | 000,000,658 | ---- | M] () -- C:\WINDOWS\win.ini [2010-06-08 16:44:27 | 000,000,281 | RHS- | M] () -- C:\boot.ini [2010-06-08 16:44:27 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010-06-07 22:59:49 | 000,088,496 | ---- | M] () -- C:\Documents and Settings\Fibi\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2010-06-01 19:24:46 | 000,001,590 | ---- | M] () -- C:\Documents and Settings\Fibi\Pulpit\Diablo II - Lord of Destruction.lnk [2010-06-01 19:15:45 | 000,036,717 | ---- | M] () -- C:\WINDOWS\DIIUnin.dat [2010-06-01 19:04:23 | 000,043,520 | ---- | M] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2010-06-01 18:51:39 | 000,021,840 | ---- | M] () -- C:\WINDOWS\System32\SIntfNT.dll [2010-06-01 18:51:36 | 000,017,212 | ---- | M] () -- C:\WINDOWS\System32\SIntf32.dll [2010-06-01 18:51:34 | 000,012,067 | ---- | M] () -- C:\WINDOWS\System32\SIntf16.dll [2010-06-01 18:34:49 | 000,002,829 | ---- | M] () -- C:\WINDOWS\DIIUnin.pif [2010-06-01 18:34:47 | 000,094,208 | ---- | M] (Blizzard Entertainment) -- C:\WINDOWS\DIIUnin.exe [2010-05-31 20:46:02 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-05-31 20:46:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-05-31 20:46:01 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-05-31 20:46:01 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-05-31 20:45:58 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-05-31 17:03:06 | 000,322,728 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-06-21 15:30:06 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Fibi\Pulpit\4ts3348x.exe [2010-06-15 17:21:51 | 000,001,215 | ---- | C] () -- C:\WINDOWS\ST6UNST.001 [2010-06-15 17:21:21 | 005,657,192 | ---- | C] () -- C:\WINDOWS\Hero Editor.CAB [2010-06-15 17:21:21 | 000,000,341 | ---- | C] () -- C:\WINDOWS\ST6UNST.000 [2010-06-01 19:04:23 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2010-06-01 18:51:38 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll [2010-06-01 18:51:36 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll [2010-06-01 18:51:34 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll [2010-06-01 18:50:38 | 000,001,590 | ---- | C] () -- C:\Documents and Settings\Fibi\Pulpit\Diablo II - Lord of Destruction.lnk [2010-06-01 18:34:54 | 000,036,717 | ---- | C] () -- C:\WINDOWS\DIIUnin.dat [2010-06-01 18:34:49 | 000,002,829 | ---- | C] () -- C:\WINDOWS\DIIUnin.pif [2009-11-29 13:09:23 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-11-29 13:09:22 | 000,742,220 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008-11-09 20:21:13 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI [2008-07-11 21:37:03 | 001,867,776 | ---- | C] () -- C:\WINDOWS\System32\python24.dll [2008-06-25 10:17:52 | 000,000,031 | ---- | C] () -- C:\WINDOWS\GunzLauncher.INI [2008-05-07 23:18:01 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-05-06 12:36:24 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2008-05-06 12:13:02 | 000,000,784 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-05-06 09:24:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini [2008-05-06 09:19:23 | 000,000,046 | ---- | C] () -- C:\WINDOWS\adiras.ini [2008-05-06 00:58:56 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008-05-06 00:58:37 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008-05-06 00:58:24 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-05-06 00:58:24 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008-05-06 00:43:42 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2008-05-06 00:26:58 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2006-08-11 15:45:20 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006-08-11 15:43:10 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2006-08-11 15:43:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006-08-11 15:43:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006-08-11 15:43:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006-08-11 15:43:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006-08-11 15:43:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2005-12-07 12:31:00 | 000,202,752 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll [2002-03-25 21:02:14 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [1999-01-22 19:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [1996-04-03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys [1913-08-01 16:18:54 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll [color=#E56717]========== LOP Check ==========[/color] [2010-01-05 23:09:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ala\Dane aplikacji\foobar2000 [2009-12-22 10:17:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ala\Dane aplikacji\Thunderbird [2008-07-03 13:00:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations [2008-05-06 00:53:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET [2010-03-08 22:19:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\GoldWave [2008-07-03 13:07:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2008-05-21 00:27:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm [2008-07-03 13:01:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite [2009-01-25 12:34:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Syncrosoft [2008-07-08 17:31:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2008-09-15 18:47:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems [2010-06-16 13:00:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\BESTplayer [2008-07-03 13:13:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Datalayer [2010-06-14 11:28:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Facebook [2009-10-25 11:39:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\FMZilla [2010-06-21 15:25:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\foobar2000 [2008-08-12 23:40:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\GanymedeNet [2008-09-09 20:19:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\gtk-2.0 [2008-06-25 18:46:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\ijjigame [2008-07-03 13:12:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Nokia [2008-07-05 13:18:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Nokia Multimedia Player [2010-01-30 12:37:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Notepad++ [2009-09-25 21:38:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\OpenCandy [2009-09-06 17:39:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\OpenOffice.org [2010-02-05 21:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Opera [2008-07-03 13:02:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\PC Suite [2010-04-11 21:28:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\SanDisk [2010-01-30 12:38:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Spider Player [2009-04-09 15:44:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\STOIK [2009-12-19 17:44:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\streamripper [2008-05-21 20:12:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Styler [2008-05-06 01:04:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Thunderbird [2010-06-13 13:15:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Tibia [2008-09-15 18:42:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\Ulead Systems [2010-06-18 13:24:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fibi\Dane aplikacji\uTorrent [2010-04-26 15:30:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rysiek\Dane aplikacji\foobar2000 [2009-11-02 19:10:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rysiek\Dane aplikacji\OpenOffice.org [2009-11-12 22:14:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rysiek\Dane aplikacji\PC Suite [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:E41EAF13 < End of report >

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 19:24

Spróbuj wygenerować loga z Gmera w trybie awaryjnym. W samym OTL nie widzę nic szkodliwego

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 20:02

poszło.

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-06-21 20:01:38 Windows 5.1.2600 Dodatek Service Pack 2 Running: 4ts3348x.exe; Driver: C:\DOCUME~1\Fibi\USTAWI~1\Temp\pxtdypod.sys ---- Kernel code sections - GMER 1.0.15 ---- .text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF93F9360, 0x24526E, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1612] kernel32.dll!SetUnhandledExceptionFilter 7C810386 4 Bytes [C2, 04, 00, 00] ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET) AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET) AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2A 0x6D 0x7C 0x6C ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2A 0x6D 0x7C 0x6C ... Reg HKLM\SOFTWARE\Classes\CLSID\{5C082286-DD56-6B96-110FABAC317C22E3}\{17077DA0-F2D9-EF48-DBC13F521337D931}\{A783887F-564D-BBBA-662193019693FEBC} Reg HKLM\SOFTWARE\Classes\CLSID\{5C082286-DD56-6B96-110FABAC317C22E3}\{17077DA0-F2D9-EF48-DBC13F521337D931}\{A783887F-564D-BBBA-662193019693FEBC}@1D1OWFM6WKF6TLM3S2BGKKUUDG1 0x01 0x00 0x01 0x00 ... Reg HKLM\SOFTWARE\Classes\CLSID\{92E364B2-3C99-8131-FA38C55A9DF469B6}\{ED083C7B-BB22-E038-94448FA9BD51D19E}\{5592BF6F-6CA4-ED79-1454C42B0B348E21} Reg HKLM\SOFTWARE\Classes\CLSID\{92E364B2-3C99-8131-FA38C55A9DF469B6}\{ED083C7B-BB22-E038-94448FA9BD51D19E}\{5592BF6F-6CA4-ED79-1454C42B0B348E21}@1D1OWFM6WKF6TLM3S2BGKKUUDG1 0x01 0x00 0x01 0x00 ... Reg HKLM\SOFTWARE\Classes\CLSID\{99B3C19D-1110-E642-964288AEAF2709C8}\{40C615DA-7F31-9B5B-0DDF6E89F316E212}\{17EBF9A6-E64A-9733-B8ACE6C016E89E7C} Reg HKLM\SOFTWARE\Classes\CLSID\{99B3C19D-1110-E642-964288AEAF2709C8}\{40C615DA-7F31-9B5B-0DDF6E89F316E212}\{17EBF9A6-E64A-9733-B8ACE6C016E89E7C}@{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1 0x01 0x00 0x01 0x00 ... Reg HKLM\SOFTWARE\Classes\CLSID\{DCB42C02-2C7E-50EC-E2B5A792F7765BFB}\{38286259-1A12-EDE0-84E2CD6A1D76E8F7}\{2C2658AF-F73E-73C6-89D45D0D6FCCCFF2} Reg HKLM\SOFTWARE\Classes\CLSID\{DCB42C02-2C7E-50EC-E2B5A792F7765BFB}\{38286259-1A12-EDE0-84E2CD6A1D76E8F7}\{2C2658AF-F73E-73C6-89D45D0D6FCCCFF2}@{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1 0x01 0x00 0x01 0x00 ... Reg HKLM\SOFTWARE\Classes\CLSID\{E20DD46F-0CC4-5960-1B1F69E13D145F9C}\{B130274E-D0E8-282B-E7F07B1EE1210709}\{71D795F0-66AF-00D6-EF71DCAC5CDD95C3} Reg HKLM\SOFTWARE\Classes\CLSID\{E20DD46F-0CC4-5960-1B1F69E13D145F9C}\{B130274E-D0E8-282B-E7F07B1EE1210709}\{71D795F0-66AF-00D6-EF71DCAC5CDD95C3}@1D1OWFM6WKF6TLM3S2BGKKUUDG1 0x01 0x00 0x01 0x00 ... Reg HKLM\SOFTWARE\Classes\CLSID\{EDCF6AC6-CDE0-1F6D-043771A983FAB740}\{0B884C8F-0AAB-F925-A63B97C7F3A43931}\{965D33BD-6599-2D1D-7E8A152D666CAEE5} Reg HKLM\SOFTWARE\Classes\CLSID\{EDCF6AC6-CDE0-1F6D-043771A983FAB740}\{0B884C8F-0AAB-F925-A63B97C7F3A43931}\{965D33BD-6599-2D1D-7E8A152D666CAEE5}@{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1 0x01 0x00 0x01 0x00 ... ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 sector 61: malicious code @ sector 0x98a7fec size 0x1ca ---- EOF - GMER 1.0.15 ----

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 20:14

ten ostatni wpis w gmerze mi się nie podoba.

Pobierz takie narzędzie i zapisz bezpośrednio w roocie dysku fizycznego:
http://www2.gmer.net/mbr/mbr.exe

Uruchom i pokaż raport. będzie zapisany w roocie dysku.

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 20:16

Win32:Sality napisał(a):roocie dysku fizycznego:

dobrze kumam, że bezpośrednio na dysku C?

Kod: Zaznacz wszystko: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK malicious code @ sector 0x98a7fec size 0x1ca ! PE file found in sector at 0x098A7FEC !

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 20:21

Kumasz dobrze, a ja nie mam dobrych informacji. Mamy rootkita w Master Boot Record.

Czy to jest sprzęt od Della?

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 20:33

nie, oto konfiguracja komputera: Athlon XP 1250+, Ram 256 MB Kingstone, Płyta główna: kobian kob kt266a fdsx, geforce 7300gt 128mb zalman, hdd 80gb, ModeCom PFC MC 400W

edit: dysk to MAXTOR 80 GB, 8MB, IDE - 6Y080P0

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 20:51

Nie, nie o to chodziło. Po prostu po naprawie mbr na lapkach Della nie ma dostępu do czegośtam.

Zastartuj do trybu awaryjnego z wierszem polecenia.

Tam wpisz komendę:

C:\mbr.exe -f

Pamiętaj o spacji między e a myślnikiem!

Poczekaj chwilę, po czym zrestartuj komputer i pokaż nowego, normalnego loga z mbr.

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 21:07

tak jak powiedziałeś zrobiłem.

Kod: Zaznacz wszystko: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK malicious code @ sector 0x98a7fec size 0x1ca ! PE file found in sector at 0x098A7FEC !

ale log taki sam.

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 21:24

Jeszcze spróbujemy to zrobić z konsoli odzyskiwania w takim razie...

Masz konsolę albo płytę instalacyjną? Preferowana płyta instalacyjna albo z konsolą, bo czyszczenie z zewnątrz jest skuteczniejsze...

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 21:36

niestety, nie mam płyty :-|

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 21:43

Pobierz stąd obraz konsoli, wypal na czysty krążek i zastartuj z niej.
Otworzy Ci się konsola. Wpisujesz w niej komendę

fixmbr

czytasz jaki komunikat wyskoczy po pracy i mówisz mi

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 21:53

Win32:Sality napisał(a):Pobierz stąd obraz konsoli,

że tak to ujmę, nie ma linku

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 21:58

Jezu, przepraszam

http://www.fixitpc.pl/index.php?/topic/48-archiwalny-konsola-odzyskiwania-w-2000xp2003/

**Posty:** 2008 · przez **fibi07** 21 Cze 2010, 22:24

to teraz tak.

1. pobrałem tą konsolę, otworzyłem winrarem i wypaliłem na płytce.
2. ustawiłem w biosie bootowanie z cd na 1 miejscu, na 2 było hdd. szło cały czas z hdd.
3. w sumie, to od jakiegoś czasu (miesiąc? może dłużej, ale trochę to trwa) wyświetla mi się wybór między Recovery console XP a zwykłym startem XP. ale trwa to około sekundę, więc jakoś mi to nie przeszkadzało.

reasumując, nie udało mi się odpalić konsoli z CD, a z tej z hdd po wpisaniu komendy "fixmbr" wyskoczyło mi coś takiego: http://up.programosy.pl/foto/dsc00211_2.jpg wolę się upewnić, danych nie stracę na 100%?

**Posty:** 2183 · przez **NieWiem** 21 Cze 2010, 22:29

Ta operacja nigdy nie daje 100% pewności. Nie dam Ci jej ja, ani nikt inny.

Coś za coś.

**Posty:** 2008 · przez **fibi07** 22 Cze 2010, 11:19

zrobiłem po prostu backup danych i wpisałem to fixmbr... wynik, chyba taki sam:

Kod: Zaznacz wszystko: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK malicious code @ sector 0x98a7fec size 0x1ca ! PE file found in sector at 0x098A7FEC !

jak mówiłem, poszło z konsoli (z tego co ogarniam) z dysku (z tego wyboru, co pisałem wyżej). z bootowania z płyty nie chciało się włączyć. tylko stawało na "Boot CD:" i się windows odpalał.

**Posty:** 18165 · przez **wojtas** 22 Cze 2010, 11:23

taki log świadczy że jest OK :

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
malicious code @ sector 0x98a7fec size 0x1ca !
PE file found in sector at 0x098A7FEC !

tu nic nie ruszać, a malicious code to nie wiem być może jakieś resztki po programie emulującym (deamon itp) zostały i jest tak odczytywane...

Autor postu otrzymał pochwałę

**Posty:** 2008 · przez **fibi07** 22 Cze 2010, 11:28

wcześniej też tak było, więc cała operacja była niepotrzebna?

swoją drogą, zapomniałem tego komunikatu podać:

Kod: Zaznacz wszystko: Zapisywanie nowego głównego rekordu rozruchowego na dysku fizycznym \Device\Harddisk4\Partition0 Nowy główny rekord rozruchowy został zapisany pomyślnie.

**Posty:** 2183 · przez **NieWiem** 22 Cze 2010, 12:42

wcześniej też tak było, więc cała operacja była niepotrzebna?

Wychodzi na to, że tak.

Poszukałem po necie i znalazłem podobne informacje jak te, które dał wojtas. Wychodzi na to, że jest to pozostałość po czymś, co ingerowało w mbr i choć została sama ingerencja usunięta, to pozostały szczątki. Podobno jest to stan normalny.

Mój błąd, przepraszam.

Kto jest na forum