Prosze o sprawdzenie loga i dalsze instrukcje
Pozdrawiam
log z combofix
- Kod: Zaznacz wszystko
[code]ComboFix 09-05-05.04 - Kornelia 2009-05-06 13:52.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.48.1045.18.3069.1813 [GMT 2:00]
Uruchomiony z: c:\users\Kornelia\Desktop\ComboFix.exe
AV: System antywirusowy NOD32 2.70 *On-access scanning enabled* (Updated)
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\msetup
c:\windows\msetup\BASW-00503A55\data1.cab
c:\windows\msetup\BASW-00503A55\data1.hdr
c:\windows\msetup\BASW-00503A55\data2.cab
c:\windows\msetup\BASW-00503A55\engine32.cab
c:\windows\msetup\BASW-00503A55\layout.bin
c:\windows\msetup\BASW-00503A55\PlayCamera\Click.wav
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_chs_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_cht_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_deu_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_eng_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_esp_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_fra_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_ita_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_kor_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_ptg_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_rus_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\Help\PlayCamera_ukr_s.chm
c:\windows\msetup\BASW-00503A55\PlayCamera\HookDllPS2.dll
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\Back_Big.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\Back_Small.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbCancel.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbHelp.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbOk.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbOpen.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbPreviewOff.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbPreviewOn.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbRecordOff.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbRecordOn.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\gbSnap.bmp
c:\windows\msetup\BASW-00503A55\PlayCamera\Images\PlayCamera.ico
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_chs.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_cht.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_deu.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_eng.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_esp.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_fra.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_ita.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_kor.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_ptg.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_rus.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\Language\PlayCamera_ukr.txt
c:\windows\msetup\BASW-00503A55\PlayCamera\PlayCamera.exe
c:\windows\msetup\BASW-00503A55\PlayCamera\SSHook.dll
c:\windows\msetup\BASW-00503A55\PlayCamera\Uninst.ico
c:\windows\msetup\BASW-00503A55\setup.exe
c:\windows\msetup\BASW-00503A55\setup.ibt
c:\windows\msetup\BASW-00503A55\setup.ini
c:\windows\msetup\BASW-00503A55\setup.iss
c:\windows\msetup\BASW-00503A55\SWDesc.txt
c:\windows\msetup\MSetup.exe
c:\windows\msetup\MSetupLog.log
c:\windows\system32\f3PSSavr.scr
.
((((((((((((((((((((((((( Pliki utworzone od 2009-04-06 do 2009-05-06 )))))))))))))))))))))))))))))))
.
2009-05-05 12:25 . 2009-05-05 13:26 -------- d-----w c:\programdata\Google Updater
2009-05-05 12:25 . 2009-05-05 13:26 -------- d-----w c:\users\All Users\Google Updater
2009-04-17 11:59 . 2009-04-17 12:00 -------- d-----w c:\program files\Common Files\Adobe
2009-04-16 09:06 . 2009-02-13 08:49 1255936 ----a-w c:\windows\system32\lsasrv.dll
2009-04-13 17:51 . 2009-04-14 11:07 -------- d-----w c:\program files\blueconnect
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 10:56 . 2008-04-28 00:43 671666 ----a-w c:\windows\system32\perfh015.dat
2009-05-06 10:56 . 2008-04-28 00:43 132422 ----a-w c:\windows\system32\perfc015.dat
2009-05-06 00:15 . 2008-04-28 17:55 12 ----a-w c:\windows\bthservsdp.dat
2009-05-05 12:26 . 2008-08-13 18:56 -------- d-----w c:\program files\Google
2009-04-17 11:45 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-14 11:07 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstor.dat
2009-04-14 11:07 . 2006-11-02 10:25 51200 ----a-w c:\windows\inf\infpub.dat
2009-04-14 11:07 . 2006-11-02 10:25 143360 ----a-w c:\windows\inf\infstrng.dat
2009-04-04 17:46 . 2008-08-13 17:19 150816 ----a-w c:\users\Kornelia\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-01 15:19 . 2009-02-06 16:13 -------- d-----w c:\program files\Eset
2009-03-27 02:00 . 2009-03-27 02:00 -------- d-----w c:\program files\MSXML 4.0
2009-03-26 12:40 . 2008-04-28 18:04 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-26 12:38 . 2009-03-26 12:38 -------- d-----w c:\program files\Mathcad
2009-03-26 11:53 . 2009-03-26 11:53 96 ----a-w c:\users\Kornelia\AppData\Local\fusioncache.dat
2009-03-26 11:53 . 2009-03-26 11:35 -------- d-----w c:\program files\Solid Edge V16
2009-03-26 11:32 . 2009-03-26 11:31 -------- d-----w c:\program files\Solid Edge Mold Tooling V16
2009-03-26 11:11 . 2009-02-27 18:31 -------- d-----w c:\program files\SolidWorks
2009-03-26 11:05 . 2009-03-26 10:58 -------- d-----w c:\program files\Common Files\SolidWorks Shared
2009-03-26 11:04 . 2009-03-26 11:04 -------- d-----w c:\program files\Common Files\eDrawings2006
2009-03-26 10:58 . 2009-03-26 10:54 -------- d-----w c:\program files\Bluebeam Software
2009-03-26 10:58 . 2009-02-27 18:37 -------- d-----w c:\program files\Common Files\Bluebeam Software
2009-03-17 03:38 . 2009-04-16 09:06 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 09:06 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-13 17:45 . 2009-03-13 17:43 -------- d-----w c:\program files\ACE Mega CoDecS Pack
2009-03-12 14:59 . 2009-03-12 14:59 -------- d-----w c:\program files\Word XP-2003 - praktyczny kurs obsługi
2009-03-03 04:46 . 2009-04-16 09:07 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-16 09:07 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-16 09:06 827392 ----a-w c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-16 09:07 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-16 09:07 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-16 09:07 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-16 09:06 78336 ----a-w c:\windows\system32\ieencode.dll
2009-03-03 04:37 . 2009-04-16 09:07 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-16 09:07 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-16 09:07 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-16 09:07 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-16 09:07 17408 ----a-w c:\windows\system32\iashost.exe
2009-03-03 02:28 . 2009-04-16 09:06 26624 ----a-w c:\windows\system32\ieUnatt.exe
2009-02-13 08:49 . 2009-04-16 09:06 72704 ----a-w c:\windows\system32\secur32.dll
2009-02-09 03:10 . 2009-03-12 20:22 2033152 ----a-w c:\windows\system32\win32k.sys
2009-02-06 16:13 . 2009-02-06 16:15 298104 ----a-w c:\windows\system32\imon.dll
2009-02-06 16:13 . 2009-02-06 16:15 512096 ----a-w c:\windows\system32\drivers\amon.sys
2009-02-06 16:13 . 2009-02-06 16:15 15424 ----a-w c:\windows\system32\drivers\nod32drv.sys
2008-09-30 14:59 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-07-18 451872]
"Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2008-01-15 6290944]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-08-06 21738792]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-20 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-02-06 949376]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-06-13 4489216]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-24 723760]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoHotStart"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A1F5D48B-862B-44AC-867D-595180E979DB}"= c:\program files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
"{10F53FBF-D6A1-4568-9B7A-A0A65D3899E7}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{78E0BB59-D32D-4AC2-8B6F-86069190897A}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{F87C46E1-E798-4735-89E3-5C0D62029C80}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{45513126-C702-4E59-BA97-324FD0CF0F31}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{D90FD1FA-9A9D-4024-AF11-4BF7B7A8EE9B}c:\\program files\\tlen.pl\\tlen.exe"= UDP:c:\program files\tlen.pl\tlen.exe:Komunikator Tlen.pl
"UDP Query User{09AFF065-5202-4217-983E-1C8D2BA4DC1F}c:\\program files\\tlen.pl\\tlen.exe"= TCP:c:\program files\tlen.pl\tlen.exe:Komunikator Tlen.pl
"TCP Query User{AE21AD13-D2FE-42D1-9D97-2B99DCFC90F8}c:\\program files\\dc++\\dcplusplus.exe"= UDP:c:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{96F35CFC-5B22-41A0-9C1E-F3AE474DD21D}c:\\program files\\dc++\\dcplusplus.exe"= TCP:c:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{96A14EB8-139B-46C0-9AF4-10D96DDC93D5}c:\\program files\\wru\\wru.exe"= UDP:c:\program files\wru\wru.exe:Wru P2P Client
"UDP Query User{91DB91AB-7CC6-4665-828B-5C1A897CE1F7}c:\\program files\\wru\\wru.exe"= TCP:c:\program files\wru\wru.exe:Wru P2P Client
"TCP Query User{701BFD43-003B-4B5D-B7C2-ECCBF2A0366F}c:\\program files\\tlen.pl\\tlen.exe"= UDP:c:\program files\tlen.pl\tlen.exe:Komunikator Tlen.pl
"UDP Query User{5985434A-115A-4CE0-9436-150A057A7E36}c:\\program files\\tlen.pl\\tlen.exe"= TCP:c:\program files\tlen.pl\tlen.exe:Komunikator Tlen.pl
R1 nod32drv;nod32drv;c:\windows\System32\drivers\nod32drv.sys [2009-02-06 15424]
R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\System32\drivers\KMDFMEMIO.sys [2008-04-28 13312]
R3 VMC302;Vimicro Camera Service VMC302;c:\windows\System32\drivers\vmc302.sys [2008-04-28 242560]
S2 gupdate1c9cd7ca0b9a63c;Usługa Google Update (gupdate1c9cd7ca0b9a63c);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-05 133104]
S3 NETw2v32;Intel(R) PRO/Wireless 2915ABG Network Connection Driver for Windows Vista;c:\windows\System32\drivers\NETw2v32.sys [2006-11-02 2589184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40a1888d-6cec-11dd-9b76-0013776d657e}]
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL explore.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a94d69d-284c-11de-9d13-0013776d657e}]
\shell\AutoRun\command - G:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a94d6c3-284c-11de-9d13-0013776d657e}]
\shell\AutoRun\command - G:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aab69f86-3b45-11dd-b1f4-806e6f6e6963}]
\shell\AutoRun\command - E:\START.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Zawartość folderu 'Zaplanowane zadania'
2009-05-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-13 12:25]
2009-05-06 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-05 12:25]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.google.pl/
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm451YYPL
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 13:55
Windows 6.0.6001 Service Pack 1 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0[/u]000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0[/u]001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0[/u]002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Czas ukończenia: 2009-05-06 13:57
ComboFix-quarantined-files.txt 2009-05-06 11:57
Przed: 23 726 862 336 bajtów wolnych
Po: 23 961 866 240 bajtów wolnych
293 --- E O F --- 2009-05-04 14:13
[/code]
log z Hijackthis
- Kod: Zaznacz wszystko
[code]info.txt logfile of random's system information tool 1.06 2009-05-06 14:31:37
======Uninstall list======
-->MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}
ACE Mega CoDecS Pack-->"C:\Program Files\ACE Mega CoDecS Pack\unins000.exe"
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 9 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 8 - Polish-->MsiExec.exe /I{AC76BA86-7AD7-1045-7B44-A81200000003}
Agere Systems HDA Modem-->agrsmdel
Aktualizator Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
ALLPlayer V3.X-->"C:\Program Files\ALLPlayer\unins000.exe"
Archiwizator WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Atheros WLAN Client-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04983D37-2202-4295-94A2-8B547C66133F}\setup.exe" -l0x9
AutoCAD 2008 - English-->C:\Program Files\AutoCAD 2008\Setup\Setup.exe /P {5783F2D7-6001-0409-0002-0060B0CE6BBA} /M ACAD
AutoCAD 2009 - Polski-->C:\Program Files\AutoCAD 2009\Setup\Setup.exe /P {5783F2D7-7001-0415-0002-0060B0CE6BBA} /M ACAD
Autodesk Design Review 2009-->C:\Program Files\Autodesk\Autodesk Design Review\Setup\Setup.exe /P {450063AA-643B-417C-8CF5-405BA3F4EF40} /M ADR
Autodesk DWF Viewer 7-->MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}
Autodesk NavisWorks Freedom 2009-->C:\Program Files\Autodesk\NavisWorks Freedom 2009\setup\Setup.exe /P {196AD67D-9180-4A8C-BE53-E7C68D80AE33} /M FREEDOM
AVStation Now-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{FD53302C-8E7B-4730-8AD8-86A889BDBFAB} /l1033
Catalyst Control Center - Branding-->MsiExec.exe /I{2433BAD7-453F-473D-BE81-455E68940DEB}
Codec 8.3f-->"C:\Program Files\Codec\Uninstall\unins000.exe"
COSMOSWorks 2006 sp0-->MsiExec.exe /I{A919B913-52DE-4230-BFF2-0AEBE8DDE281}
DC++ 0.707-->"C:\Program Files\DC++\uninstall.exe"
Delftship professional evaluation program 3.2-->"C:\Program Files\Delftship\unins000.exe"
DVD Suite-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
DWGeditor-->MsiExec.exe /X{AC7190A0-EEA1-423C-A531-FCEB4E0EBBB1}
Easy Battery Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}\setup.exe" -l0x9 Remove
Easy Display Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17283B95-21A8-4996-97DA-547A48DB266F}\setup.exe" -l0x9 -removeonly
Easy Network Manager 3.0-->C:\Program Files\InstallShield Installation Information\{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}\setup.exe -runfromtemp -l0x0409
Easy SpeedUp Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF367AA4-070B-493C-9575-85BE59D789C9}\setup.exe" -l0x9 Remove
eDrawings 2006-->MsiExec.exe /I{8C47092F-B249-43CB-A780-40274329043D}
Google Chrome-->"C:\Program Files\Google\Chrome\Application\1.0.154.59\Installer\setup.exe" --uninstall --system-level
Google Earth-->MsiExec.exe /X{548EAC70-EE00-11DD-908C-005056806466}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
imagine digital freedom - Samsung-->MsiExec.exe /X{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}
LabelPrint 2.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.exe" -uninstall
Mathcad 14.0 M020 Help-->MsiExec.exe /I{205ACCD7-5342-4694-91F3-3A99E4FD5AA6}
Mathcad 14.0 M020 Resource Center-->MsiExec.exe /I{EBD38AE9-D52D-448D-9DB4-4D5F66E1DAFC}
Mathcad 14.0 M020-->MsiExec.exe /I{8796E14E-2031-463F-8A9A-31062B2652B4}
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110415-6000-11D3-8CFE-0150048383C9}
Microsoft SOAP Toolkit 2.0 SP2-->MsiExec.exe /I{36BEAD11-8577-49AD-9250-E06A50AE87B0}
Microsoft SQL Server Native Client-->MsiExec.exe /I{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}
Microsoft SQL Server Setup Support Files (English)-->MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
My Web Search (Cursor Mania)-->rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsbar.dll,O
NOD32 FiX-->"C:\Program Files\Eset\unins000.exe"
Nokia Connectivity Cable Driver-->MsiExec.exe /X{11964613-805F-432D-A12B-169554B793E7}
Nokia PC Suite-->C:\ProgramData\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Nokia_PC_Suite_6_84_10_3_EA.exe
Nokia PC Suite-->MsiExec.exe /I{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}
Pakiet sterowników systemu Windows - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pccswpddriver.inf_a419b392\pccswpddriver.inf
Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pccs_bluetooth.inf_48f6f624\pccs_bluetooth.inf
Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pccs_bluetooth.inf_51d2d3e1\pccs_bluetooth.inf
Pakiet sterowników systemu Windows - Nokia Modem (05/24/2007 6.84.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\nokbtmdm.inf_e5643fdd\nokbtmdm.inf
PC Connectivity Solution-->MsiExec.exe /I{99A40651-0BC2-4095-8F9A-A40FAB224FEF}
PDMWorks Clients 2006 sp0-->MsiExec.exe /I{A0E5B0BB-123A-40FC-868C-8C958AC9BDDD}
Play AVStation-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{955597D8-E5E1-474D-B647-60AC44566D24} /l1033
PlayCamera-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{804F1285-8CBF-408D-8CDC-D4D40003B2E4}\setup.exe" -l0x9
Power2Go 5.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe" -uninstall
PowerDirector-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" -uninstall
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
Real Alternative 1.8.4-->"C:\Program Files\Real Alternative\unins000.exe"
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Samsung Magic Doctor-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}\Setup.exe" -l0x9 Remove
Samsung Recovery Solution II-->C:\Program Files\InstallShield Installation Information\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}\setup.exe -runfromtemp -l0x0015 -removeonly
Samsung Update Plus-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{685707A4-911C-468D-BFC4-64A50E5E3A0C} /l1033
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Solid Edge Mold Tooling V16-->MsiExec.exe /I{A95DA0C8-4165-43A1-A77B-7B2159C5D6BE}
Solid Edge V16-->MsiExec.exe /I{664FF011-D057-4758-B2C1-78B0B78DD823}
SolidWorks 2006 SP0-->MsiExec.exe /I{BD5D42A6-272E-4128-B5C6-9800700DA2AA}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Antywirusowy NOD32-->C:\Program Files\Eset\Setup\setup.exe /UNINSTALL
Tlen.pl-->"C:\Program Files\Tlen.pl\uninstall.exe"
Total Commander (Remove or Repair)-->c:\totalcmd\tcuninst.exe
User Guide-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}\Setup.exe" -l0x9 Remove
VideoLAN VLC media player 0.8.6h-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vimicro UVC Camera-->C:\Program Files\InstallShield Installation Information\{71A51B09-E7D3-11DB-A386-005056C00008}\setup.exe -runfromtemp -l0x0009 -removeonly
WIDCOMM Bluetooth Software 6.0.1.5000-->MsiExec.exe /X{03D1988F-469F-4843-8E6E-E5FE9D17889D}
Word XP / 2003 - praktyczny kurs obsługi (część 1 i 2)-->C:\Windows\IsUn0415.exe -f"C:\Program Files\Word XP-2003 - praktyczny kurs obsługi\Kurs Word XP-2003 poziom podstawowy\Uninst.isu"
======Security center information======
AV: System antywirusowy NOD32 2.70
AS: Windows Defender (disabled)
======System event log======
Computer Name: Kornelia-PC
Event Code: 4
Message: Procesor 1 uwidacznia:
stany bezczynności: 2
stany wydajności: 4
stany dławienia: 8
Record Number: 67089
Source Name: Microsoft-Windows-Kernel-Processor-Power
Time Written: 20090410081042.441708-000
Event Type: Informacje
User: ZARZĄDZANIE NT\SYSTEM
Computer Name: Kornelia-PC
Event Code: 4201
Message: System wykrył, że karta sieciowa Loopback Pseudo-Interface 1 została podłączona do sieci i ma zainicjowane normalne działanie.
Record Number: 67090
Source Name: Tcpip
Time Written: 20090410081046.372933-000
Event Type: Informacje
User:
Computer Name: Kornelia-PC
Event Code: 4201
Message: System wykrył, że karta sieciowa Loopback Pseudo-Interface 1 została podłączona do sieci i ma zainicjowane normalne działanie.
Record Number: 67091
Source Name: Tcpip
Time Written: 20090410081046.372933-000
Event Type: Informacje
User:
Computer Name: Kornelia-PC
Event Code: 4201
Message: System wykrył, że karta sieciowa Połączenie lokalne została podłączona do sieci i ma zainicjowane normalne działanie.
Record Number: 67092
Source Name: Tcpip
Time Written: 20090410081046.497734-000
Event Type: Informacje
User:
Computer Name: Kornelia-PC
Event Code: 4201
Message: System wykrył, że karta sieciowa Połączenie lokalne została podłączona do sieci i ma zainicjowane normalne działanie.
Record Number: 67093
Source Name: Tcpip
Time Written: 20090410081046.497734-000
Event Type: Informacje
User:
=====Application event log=====
Computer Name: Kornelia-PC
Event Code: 1
Message: Usługa Centrum zabezpieczeń systemu Windows została uruchomiona.
Record Number: 15385
Source Name: SecurityCenter
Time Written: 20090506120643.000000-000
Event Type: Informacje
User:
Computer Name: Kornelia-PC
Event Code: 1001
Message: Liczniki wydajności dla usługi WmiApRpl (WmiApRpl) zostały pomyślnie usunięte. Dane rekordu zawierają nowe wartości wpisów Last Counter (ostatni licznik) i Last Help (ostatnia Pomoc) do Rejestru systemowego.
Record Number: 15386
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20090506121122.000000-000
Event Type: Informacje
User:
Computer Name: Kornelia-PC
Event Code: 1000
Message: Liczniki wydajności dla usługi WmiApRpl (WmiApRpl) zostały pomyślnie załadowane. Dane rekordu w sekcji danych zawierają nowe wartości indeksu przypisane do tej usługi.
Record Number: 15387
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20090506121123.000000-000
Event Type: Informacje
User:
Computer Name: Kornelia-PC
Event Code: 0
Message:
Record Number: 15388
Source Name: gusvc
Time Written: 20090506121701.000000-000
Event Type: Informacje
User:
Computer Name: Kornelia-PC
Event Code: 5
Message: Unsupported service control request (see data below)
Record Number: 15389
Source Name: LightScribeService
Time Written: 20090506123137.000000-000
Event Type: Informacje
User:
=====Security event log=====
Computer Name: Kornelia-PC
Event Code: 5038
Message: Funkcja sprawdzania integralności kodu wykryła, że skrót obrazu pliku jest nieprawidłowy. Plik mógł zostać uszkodzony z powodu nieautoryzowanej modyfikacji. Nieprawidłowy skrót może wskazywać potencjalny problem z urządzeniem dyskowym.
Nazwa pliku: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21955
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090506123135.544777-000
Event Type: Niepowodzenie inspekcji
User:
Computer Name: Kornelia-PC
Event Code: 5038
Message: Funkcja sprawdzania integralności kodu wykryła, że skrót obrazu pliku jest nieprawidłowy. Plik mógł zostać uszkodzony z powodu nieautoryzowanej modyfikacji. Nieprawidłowy skrót może wskazywać potencjalny problem z urządzeniem dyskowym.
Nazwa pliku: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21956
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090506123135.591577-000
Event Type: Niepowodzenie inspekcji
User:
Computer Name: Kornelia-PC
Event Code: 5038
Message: Funkcja sprawdzania integralności kodu wykryła, że skrót obrazu pliku jest nieprawidłowy. Plik mógł zostać uszkodzony z powodu nieautoryzowanej modyfikacji. Nieprawidłowy skrót może wskazywać potencjalny problem z urządzeniem dyskowym.
Nazwa pliku: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21957
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090506123135.622777-000
Event Type: Niepowodzenie inspekcji
User:
Computer Name: Kornelia-PC
Event Code: 5038
Message: Funkcja sprawdzania integralności kodu wykryła, że skrót obrazu pliku jest nieprawidłowy. Plik mógł zostać uszkodzony z powodu nieautoryzowanej modyfikacji. Nieprawidłowy skrót może wskazywać potencjalny problem z urządzeniem dyskowym.
Nazwa pliku: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21958
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090506123135.653977-000
Event Type: Niepowodzenie inspekcji
User:
Computer Name: Kornelia-PC
Event Code: 5038
Message: Funkcja sprawdzania integralności kodu wykryła, że skrót obrazu pliku jest nieprawidłowy. Plik mógł zostać uszkodzony z powodu nieautoryzowanej modyfikacji. Nieprawidłowy skrót może wskazywać potencjalny problem z urządzeniem dyskowym.
Nazwa pliku: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 21959
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090506123135.700777-000
Event Type: Niepowodzenie inspekcji
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"P_SCHEMA"=C:\Program Files\Solid Edge V16\etc\UGSchemas
-----------------EOF-----------------
[/code]
.