Objawami są m.in. spowolnienie działania komputera, rożne wyskakujące błędy, np. przy każdym uruchomieniu komputera:
"Wystąpił problem z aplikacją Explorer.EXE i została ona zamkniętra (...) " i przycisk "Nie wysyłaj" jeśli chodzi o raport o błędach
Program (do odpinstalowania pliku) SPTD także nie zadziałał
" C:\Documents...SPTDinst-v162-x86.exe nie jest prawidłową aplikacją systemu Win32 "
Program antywirusowy nie działa (Avast) i nie da się włączyć ochrony (?!) chciałem go odinstalować przez tryb awaryjny (bo jak wiadomo nie da się zakończyć procesu avasta pod normalnie działającym systemem).
Ale po F8 wybraniu trubu awaryjnego oraz systemu Windows... pojawia się czarny ekraz z migającym białym "_" i tak przez dłuższy czas dopóki nie zresetuje się komputera.
Mimo wszystko postarałem się zrobić logi które przedstawiam poniżej (GMER):
- Kod: Zaznacz wszystko
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-24 16:10:27
Windows 5.1.2600 Dodatek Service Pack 3
Running: do5gfrjr.exe; Driver: C:\DOCUME~1\SysOp\USTAWI~1\Temp\kxtdqpog.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAADFAC56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xAADFAB12]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xAADFB0C6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xAADFAFF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAADFA6E8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xAADFABEC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAADFA628]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAADFA68C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xAADFAD0C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xAADFB194]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAADFACCC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xAADFAE4C]
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!ZwYieldExecution + 186 804E49B0 4 Bytes CALL D1F9295B
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\windows\system32\services.exe[512] @ C:\windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002
IAT C:\windows\system32\services.exe[512] @ C:\windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\ole32.dll [USER32.dll!CreateWindowExA] [00418F64] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\ole32.dll [USER32.dll!CreateWindowExW] [00418FDC] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\ole32.dll [USER32.dll!DialogBoxParamW] [0041916E] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\ole32.dll [USER32.dll!MessageBoxW] [0041917A] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\ole32.dll [USER32.dll!ShowWindow] [00419054] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\WININET.dll [USER32.dll!CreateWindowExW] [00418FDC] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\WININET.dll [USER32.dll!MessageBoxW] [0041917A] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\WININET.dll [USER32.dll!SetWindowPos] [00419102] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\WININET.dll [USER32.dll!DialogBoxParamW] [0041916E] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamA] [0041916E] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamW] [0041916E] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!CreateWindowExA] [00418F64] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!CreateWindowExW] [00418FDC] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!MessageBoxA] [0041917A] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!MessageBoxW] [0041917A] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!MessageBoxIndirectA] [00419168] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!MessageBoxIndirectW] [00419168] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!SetWindowPos] [00419102] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!ShowWindow] [00419054] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\shell32.dll [USER32.dll!CreateWindowExW] [00418FDC] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\shell32.dll [USER32.dll!DialogBoxParamW] [0041916E] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\shell32.dll [USER32.dll!ShowWindow] [00419054] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\shell32.dll [USER32.dll!SetWindowPos] [00419102] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\shell32.dll [USER32.dll!MessageBoxW] [0041917A] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\shell32.dll [USER32.dll!MessageBoxA] [0041917A] C:\windows\Zkipia.exe
IAT C:\windows\Zkipia.exe[1976] @ C:\windows\system32\shell32.dll [USER32.dll!MessageBoxIndirectW] [00419168] C:\windows\Zkipia.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\shell32.dll [USER32.dll!CreateWindowExW] [00418721] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\shell32.dll [USER32.dll!ShowWindow] [0041879B] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\shell32.dll [USER32.dll!SetWindowPos] [0041884D] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!CreateWindowExA] [004186A7] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!CreateWindowExW] [00418721] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!SetWindowPos] [0041884D] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\SHLWAPI.dll [USER32.dll!ShowWindow] [0041879B] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\ole32.dll [USER32.dll!CreateWindowExA] [004186A7] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\ole32.dll [USER32.dll!CreateWindowExW] [00418721] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\ole32.dll [USER32.dll!ShowWindow] [0041879B] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\WININET.dll [USER32.dll!CreateWindowExW] [00418721] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\WININET.dll [USER32.dll!SetWindowPos] [0041884D] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\USERENV.dll [USER32.dll!SetWindowPos] [0041884D] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
IAT C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe[2028] @ C:\windows\system32\USERENV.dll [USER32.dll!ShowWindow] [0041879B] C:\DOCUME~1\SysOp\USTAWI~1\Temp\Zrh.exe
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
Device -> \Driver\atapi \Device\Harddisk0\DR0 82ED0EC5
---- Files - GMER 1.0.15 ----
File C:\windows\system32\drivers\atapi.sys suspicious modification
---- EOF - GMER 1.0.15 ----
LOGI z OTL:
- Kod: Zaznacz wszystko
OTL Extras logfile created on: 2010-07-24 16:29:55 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\SysOp\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
767,00 Mb Total Physical Memory | 494,00 Mb Available Physical Memory | 64,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,41 Gb Total Space | 20,00 Gb Free Space | 81,92% Space Free | Partition Type: FAT32
Drive D: | 12,83 Gb Total Space | 12,17 Gb Free Space | 94,80% Space Free | Partition Type: FAT32
Drive E: | 10,84 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: COA12
Current User Name: SysOp
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
[color=#E56717]========== File Associations ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_USERS\S-1-5-21-746137067-573735546-682003330-1001\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
[color=#E56717]========== Shell Spawning ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /k cd "%L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[color=#E56717]========== Security Center Settings ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[color=#E56717]========== Authorized Applications List ==========[/color]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Nowe Gadu-Gadu\gg.exe" = C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu -- File not found
"C:\Program Files\Gadu-Gadu 10\gg.exe" = C:\Program Files\Gadu-Gadu 10\gg.exe:*:Enabled:Gadu-Gadu 10 -- (GG Network S.A.)
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F1DCA42-2030-437C-A94E-736692A499C1}" = Nokia Connectivity Cable Driver
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{9C05FA75-0337-4523-AA57-9D3511018887}" = Nokia PC Suite
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F4F7F393-A8E8-42CC-8C2E-7A999B48B2AE}_is1" = DirectX10 LV (Last Version)
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Pakiet sterowników systemu Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = Narzędzie Software Uninstall Utility firmy ATI
"ALLPlayer_is1" = ALLPlayer V4.X
"ATI Display Driver" = ATI Display Driver
"avast5" = avast! Free Antivirus
"CBF192A85B624E32B8D19ADEEF2DCFC5BC3AA73A" = Pakiet sterowników systemu Windows - Nokia Modem (03/05/2008 3.7)
"E092B2EBF2FFE83E896F8F7F829A7B5D7D1B2F9D" = Pakiet sterowników systemu Windows - Nokia Modem (03/13/2008 6.86.0.1)
"ffdshow_is1" = ffdshow [rev 1376] [2007-07-28]
"Gadu-Gadu 10" = Gadu-Gadu 10
"Nokia PC Suite" = Nokia PC Suite
"Odkurzacz 12.3_is1" = Odkurzacz 12.3
"PLAY ONLINE" = PLAY ONLINE
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"WinRAR archiver" = Archiwizator WinRAR
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\S-1-5-21-746137067-573735546-682003330-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
[color=#E56717]========== Last 10 Event Log Errors ==========[/color]
[ Application Events ]
Error - 2010-07-23 08:23:07 | Computer Name = COA12 | Source = Google Update | ID = 20
Description =
Error - 2010-07-23 14:03:42 | Computer Name = COA12 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x71a56a55.
Error - 2010-07-23 14:24:00 | Computer Name = COA12 | Source = PerfNet | ID = 2004
Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie
zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0.
Error - 2010-07-23 14:24:47 | Computer Name = COA12 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x71a56a55.
Error - 2010-07-23 16:13:22 | Computer Name = COA12 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x71a56a55.
Error - 2010-07-24 05:09:09 | Computer Name = COA12 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x71a56a55.
Error - 2010-07-24 09:25:05 | Computer Name = COA12 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x71a56a55.
Error - 2010-07-24 10:07:14 | Computer Name = COA12 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł
powodujący błąd ws2_32.dll, wersja 5.1.2600.5512, adres błędu 0x00006a55.
Error - 2010-07-24 10:14:24 | Computer Name = COA12 | Source = PerfNet | ID = 2004
Description = Nie można otworzyć usługi Server. Dane wydajności usługi Server nie
zostaną zwrócone. Zwrócony kod stanu to dane DWORD 0.
Error - 2010-07-24 10:14:48 | Computer Name = COA12 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.5512, moduł
powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x71a56a55.
[ System Events ]
Error - 2010-07-20 13:33:58 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-21 01:13:37 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-21 05:12:14 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-21 05:17:20 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-21 13:33:18 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-21 15:04:21 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-21 15:14:18 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-22 04:38:54 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-24 09:25:33 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
Error - 2010-07-24 10:07:26 | Computer Name = COA12 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu
następującego błędu: %%2
< End of report >
- Kod: Zaznacz wszystko
OTL logfile created on: 2010-07-24 16:29:55 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\SysOp\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
767,00 Mb Total Physical Memory | 494,00 Mb Available Physical Memory | 64,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 24,41 Gb Total Space | 20,00 Gb Free Space | 81,92% Space Free | Partition Type: FAT32
Drive D: | 12,83 Gb Total Space | 12,17 Gb Free Space | 94,80% Space Free | Partition Type: FAT32
Drive E: | 10,84 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: COA12
Current User Name: SysOp
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
[color=#E56717]========== Processes (SafeList) ==========[/color]
PRC - [2010-07-24 16:28:42 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SysOp\Pulpit\OTL.exe
PRC - [2010-06-15 18:08:40 | 000,161,280 | ---- | M] () -- C:\Documents and Settings\SysOp\Ustawienia lokalne\Temp\Zrh.exe
PRC - [2010-06-15 18:08:36 | 000,179,200 | ---- | M] () -- C:\WINDOWS\Zkipia.exe
PRC - [2010-04-07 08:02:10 | 000,114,688 | ---- | M] () -- C:\Program Files\PLAY ONLINE\PLAY ONLINE.exe
PRC - [2010-03-09 12:24:10 | 002,769,336 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010-01-14 00:45:58 | 001,552,736 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winamp.exe
PRC - [2008-12-31 17:03:42 | 000,196,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msconfig.exe
PRC - [2008-12-31 17:03:18 | 001,553,408 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008-04-14 19:51:14 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dwwin.exe
PRC - [2002-09-20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
[color=#E56717]========== Modules (SafeList) ==========[/color]
MOD - [2010-07-24 16:28:42 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SysOp\Pulpit\OTL.exe
MOD - [2008-04-14 19:46:34 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
SRV - File not found [On_Demand | Stopped] -- C:\windows\System32\alg.exe -- (ALG)
SRV - [2010-06-15 18:08:30 | 000,216,576 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\sshnas21.dll -- (SSHNAS)
SRV - [2010-03-09 12:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010-03-09 12:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010-03-09 12:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Stopped] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008-04-07 09:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2002-09-20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
DRV - [2010-03-09 12:12:54 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010-03-09 12:12:34 | 000,162,640 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010-03-09 12:09:08 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Stopped] -- C:\windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010-03-09 12:08:42 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\windows\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010-03-09 12:08:30 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010-03-09 12:08:16 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008-12-31 16:40:38 | 000,062,208 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\windows\System32\drivers\si3112.sys -- (Si3112)
DRV - [2008-12-31 16:40:36 | 000,105,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\windows\System32\drivers\nvatabus.sys -- (nvatabus)
DRV - [2008-09-26 18:01:00 | 000,101,376 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2008-04-13 23:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008-04-13 19:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007-11-29 10:39:42 | 000,016,896 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2007-11-29 10:39:42 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2007-11-29 10:39:40 | 000,019,328 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2007-09-17 15:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2004-11-11 22:02:04 | 000,863,744 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2003-10-08 13:14:38 | 000,051,712 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RT2400.sys -- (RT2400)
DRV - [2001-08-17 19:19:34 | 000,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
[color=#E56717]========== Internet Explorer ==========[/color]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\S-1-5-21-746137067-573735546-682003330-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
IE - HKU\S-1-5-21-746137067-573735546-682003330-1001\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\S-1-5-21-746137067-573735546-682003330-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-746137067-573735546-682003330-1001\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKU\S-1-5-21-746137067-573735546-682003330-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
O1 HOSTS File: ([2001-10-26 16:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKU\S-1-5-21-746137067-573735546-682003330-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-746137067-573735546-682003330-1001\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [MSConfig] C:\windows\System32\msconfig.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-746137067-573735546-682003330-1001..\Run: [Cmobonutulivi] C:\windows\qusecf.DLL (MaresWEB)
O4 - HKU\S-1-5-21-746137067-573735546-682003330-1001..\Run: [M5T8QL3YW3] C:\Documents and Settings\SysOp\Ustawienia lokalne\Temp\Zrh.exe ()
O4 - HKU\.DEFAULT..\RunOnce: [_nltide_2] File not found
O4 - HKU\S-1-5-18..\RunOnce: [_nltide_2] File not found
O4 - HKU\S-1-5-19..\RunOnce: [_nltide_2] File not found
O4 - HKU\S-1-5-20..\RunOnce: [_nltide_2] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiscSpaceChecks = 00 00 00 00 00 00 F0 3F [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-21-746137067-573735546-682003330-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-746137067-573735546-682003330-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\S-1-5-21-746137067-573735546-682003330-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-21-746137067-573735546-682003330-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\windows\System32\sysdm.cpl (cr1t1cal)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\windows\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 () - http://img12.imageshack.us/img12/3319/1fc0beb0812414cb3d47ecf.jpg
O24 - Desktop Components:1 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\SysOp\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\SysOp\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010-04-05 08:03:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2008-04-24 15:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - E:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007-11-07 17:41:52 | 000,000,047 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{00da4143-420b-11df-87fc-b794443cad46}\Shell - "" = AutoRun
O33 - MountPoints2\{00da4143-420b-11df-87fc-b794443cad46}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008-04-24 15:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{b4591f86-4800-11df-8812-95d29d312912}\Shell - "" = AutoRun
O33 - MountPoints2\{c84489fc-574d-11df-882c-ff70ccb1b5d2}\Shell\AutoRun\command - "" = G:\p6xebrnt.exe -- File not found
O33 - MountPoints2\{c84489fc-574d-11df-882c-ff70ccb1b5d2}\Shell\open\Command - "" = G:\p6xebrnt.exe -- File not found
O33 - MountPoints2\{cbc9385e-9580-11df-8894-d21ca0a8c501}\Shell - "" = AutoRun
O33 - MountPoints2\{cbc9385e-9580-11df-8894-d21ca0a8c501}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008-04-24 15:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{da85efe2-75ee-11df-885b-b0b3d2a16c77}\Shell - "" = AutoRun
O33 - MountPoints2\{da85efe2-75ee-11df-885b-b0b3d2a16c77}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008-04-24 15:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
[2010-07-24 16:28:28 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\SysOp\Pulpit\OTL.exe
[2010-07-24 16:01:44 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\SysOp\Recent
[2010-07-24 15:14:31 | 000,157,232 | ---- | C] (Alwil Software) -- C:\Documents and Settings\SysOp\Pulpit\aswclear5.exe
[2010-07-23 19:33:37 | 000,000,000 | ---D | C] -- C:\windows\pss
[2010-07-23 14:39:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SysOp\Pulpit\fot
[2010-07-22 21:27:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SysOp\Pulpit\Kaspersky_Internet_Security_PL_Keys_and_crack
[2010-07-21 20:18:47 | 000,000,000 | ---D | C] -- C:\Program Files\Odkurzacz
[2010-07-21 20:17:01 | 006,868,767 | ---- | C] (Franmo Software ) -- C:\Documents and Settings\SysOp\Pulpit\odk12.3.0.46setup.exe
[2010-07-21 19:35:31 | 000,065,024 | ---- | C] (MaresWEB) -- C:\Documents and Settings\SysOp\4.exe
[2010-07-21 01:25:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SysOp\Pulpit\Kochaj.i.tancz.2009.PL.DVDRip.OutLawZ.RmvBusterS
[2010-07-18 12:30:37 | 000,000,000 | RHSD | C] -- C:\SYSTEM
[2010-07-16 20:29:42 | 000,000,000 | -HSD | C] -- C:\FOUND.000
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
[2010-07-24 16:28:42 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\SysOp\Pulpit\OTL.exe
[2010-07-24 16:14:50 | 000,000,246 | -H-- | M] () -- C:\windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010-07-24 16:14:48 | 000,001,030 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2010-07-24 16:14:48 | 000,000,282 | -H-- | M] () -- C:\windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010-07-24 16:14:20 | 000,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT
[2010-07-24 16:13:54 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat
[2010-07-24 15:42:34 | 000,027,673 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\bladexplorer.JPG
[2010-07-24 15:41:56 | 000,027,260 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\bladsptd.JPG
[2010-07-24 15:41:06 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\SysOp\Moje dokumenty\Default.rdp
[2010-07-24 15:38:22 | 000,221,240 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\SPTDinst-v162-x86.exe
[2010-07-24 15:35:44 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\do5gfrjr.exe
[2010-07-24 15:20:46 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\SysOp\NTUSER.DAT
[2010-07-24 15:20:46 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\SysOp\ntuser.ini
[2010-07-24 15:14:36 | 000,157,232 | ---- | M] (Alwil Software) -- C:\Documents and Settings\SysOp\Pulpit\aswclear5.exe
[2010-07-24 15:02:02 | 000,001,034 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2010-07-24 15:01:02 | 000,000,234 | ---- | M] () -- C:\windows\tasks\Scheduled Update for Ask Toolbar.job
[2010-07-24 11:10:20 | 000,000,507 | ---- | M] () -- C:\windows\win.ini
[2010-07-24 11:10:20 | 000,000,239 | ---- | M] () -- C:\windows\system.ini
[2010-07-23 02:24:02 | 000,001,080 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-746137067-573735546-682003330-1001Core1cb29fcbacc8d7a.job
[2010-07-22 21:26:34 | 065,385,995 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\Kaspersky_Internet_Security_PL_Keys_and_crack.rar
[2010-07-22 21:24:54 | 000,596,480 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\SpeedXPbyvitek.exe
[2010-07-21 21:00:10 | 000,109,056 | RHS- | M] () -- C:\Documents and Settings\SysOp\jieci.exe
[2010-07-21 21:00:00 | 000,341,498 | ---- | M] () -- C:\Documents and Settings\SysOp\qeavos.exe
[2010-07-21 20:53:06 | 000,002,212 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\Google Chrome.lnk
[2010-07-21 20:19:12 | 000,000,766 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\Szybkie Czyszczenie Dysku.lnk
[2010-07-21 20:19:12 | 000,000,670 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\Odkurzacz.lnk
[2010-07-21 20:17:02 | 006,868,767 | ---- | M] (Franmo Software ) -- C:\Documents and Settings\SysOp\Pulpit\odk12.3.0.46setup.exe
[2010-07-21 19:34:12 | 000,000,148 | ---- | M] () -- C:\Documents and Settings\SysOp\Video.lnk
[2010-07-21 19:34:12 | 000,000,148 | ---- | M] () -- C:\Documents and Settings\SysOp\Pictures.lnk
[2010-07-21 19:34:12 | 000,000,148 | ---- | M] () -- C:\Documents and Settings\SysOp\Passwords.lnk
[2010-07-21 19:34:12 | 000,000,148 | ---- | M] () -- C:\Documents and Settings\SysOp\New Folder.lnk
[2010-07-21 19:34:12 | 000,000,148 | ---- | M] () -- C:\Documents and Settings\SysOp\Music.lnk
[2010-07-21 19:34:12 | 000,000,148 | ---- | M] () -- C:\Documents and Settings\SysOp\Documents.lnk
[2010-07-21 12:48:54 | 000,001,069 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\Sidoma 1.jad
[2010-07-21 12:48:52 | 000,525,783 | ---- | M] () -- C:\Documents and Settings\SysOp\Pulpit\Sidoma.jar
[2010-07-21 05:28:36 | 000,065,024 | ---- | M] (MaresWEB) -- C:\Documents and Settings\SysOp\4.exe
[2010-07-21 01:40:48 | 000,010,752 | ---- | M] () -- C:\Documents and Settings\SysOp\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-07-20 19:32:34 | 000,002,184 | ---- | M] () -- C:\windows\System32\wpa.dbl
[2010-07-02 14:47:54 | 000,051,502 | ---- | M] () -- C:\Documents and Settings\SysOp\Moje dokumenty\PWSH
[2010-07-01 12:46:46 | 000,080,896 | ---- | M] () -- C:\Documents and Settings\SysOp\msnmsgr.exe
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[color=#E56717]========== Files Created - No Company Name ==========[/color]
[2010-07-24 15:42:32 | 000,027,673 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\bladexplorer.JPG
[2010-07-24 15:41:55 | 000,027,260 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\bladsptd.JPG
[2010-07-24 15:41:04 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\SysOp\Moje dokumenty\Default.rdp
[2010-07-24 15:38:20 | 000,221,240 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\SPTDinst-v162-x86.exe
[2010-07-24 15:35:38 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\do5gfrjr.exe
[2010-07-23 02:19:35 | 000,001,080 | ---- | C] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-746137067-573735546-682003330-1001Core1cb29fcbacc8d7a.job
[2010-07-22 21:26:32 | 065,385,995 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\Kaspersky_Internet_Security_PL_Keys_and_crack.rar
[2010-07-22 21:24:44 | 000,596,480 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\SpeedXPbyvitek.exe
[2010-07-21 21:00:08 | 000,109,056 | RHS- | C] () -- C:\Documents and Settings\SysOp\jieci.exe
[2010-07-21 20:59:58 | 000,341,498 | ---- | C] () -- C:\Documents and Settings\SysOp\qeavos.exe
[2010-07-21 20:53:05 | 000,002,212 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\Google Chrome.lnk
[2010-07-21 20:19:11 | 000,000,766 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\Szybkie Czyszczenie Dysku.lnk
[2010-07-21 20:19:11 | 000,000,670 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\Odkurzacz.lnk
[2010-07-21 12:49:03 | 000,001,069 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\Sidoma 1.jad
[2010-07-21 12:48:43 | 000,525,783 | ---- | C] () -- C:\Documents and Settings\SysOp\Pulpit\Sidoma.jar
[2010-07-02 14:47:52 | 000,051,502 | ---- | C] () -- C:\Documents and Settings\SysOp\Moje dokumenty\PWSH
[2010-07-01 13:34:07 | 000,080,896 | ---- | C] () -- C:\Documents and Settings\SysOp\msnmsgr.exe
[2010-06-15 18:08:28 | 000,216,576 | ---- | C] () -- C:\windows\System32\sshnas21.dll
[2010-04-11 22:02:15 | 000,000,044 | ---- | C] () -- C:\windows\System32\msssc.dll
[2010-04-05 08:22:42 | 000,086,016 | ---- | C] () -- C:\windows\System32\install.dll
[2010-04-05 08:22:42 | 000,032,768 | ---- | C] () -- C:\windows\System32\SmartInstallCfg2.dll
[2010-04-05 08:18:54 | 000,182,275 | ---- | C] () -- C:\windows\System32\d3d10core.dll
[2010-04-05 08:18:54 | 000,124,931 | ---- | C] () -- C:\windows\System32\dxgi.dll
[2010-04-05 08:18:52 | 000,376,832 | ---- | C] () -- C:\windows\System32\M2000Twn.dll
[2010-04-05 08:18:51 | 000,073,728 | ---- | C] () -- C:\windows\System32\CompressATI2.dll
[2010-04-05 08:13:57 | 000,007,680 | ---- | C] () -- C:\windows\System32\ff_vfw.dll
[2010-04-05 08:13:57 | 000,000,547 | ---- | C] () -- C:\windows\System32\ff_vfw.dll.manifest
[2010-04-04 18:45:02 | 000,881,664 | ---- | C] () -- C:\windows\System32\xvidcore.dll
[2010-04-04 18:45:02 | 000,258,048 | ---- | C] () -- C:\windows\System32\libFLAC.dll
[2007-03-29 23:00:40 | 000,203,264 | R--- | C] () -- C:\windows\System32\CddbCdda.dll
[color=#E56717]========== LOP Check ==========[/color]
[2010-04-04 18:49:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Alwil Software
[2010-04-04 19:49:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM
[2010-04-07 10:08:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10
[2010-05-08 15:38:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations
[2010-05-08 15:45:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
[2010-04-04 18:40:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SysOp\Dane aplikacji\Nowe Gadu-Gadu
[2010-04-04 19:49:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SysOp\Dane aplikacji\OpenFM
[2010-04-07 10:08:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SysOp\Dane aplikacji\Gadu-Gadu 10
[2010-05-08 15:44:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SysOp\Dane aplikacji\Nokia
[2010-05-08 15:45:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SysOp\Dane aplikacji\PC Suite
[2010-07-24 15:01:02 | 000,000,234 | ---- | M] () -- C:\windows\Tasks\Scheduled Update for Ask Toolbar.job
[2010-07-24 16:14:48 | 000,000,282 | -H-- | M] () -- C:\windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010-07-24 16:14:50 | 000,000,246 | -H-- | M] () -- C:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[color=#E56717]========== Purity Check ==========[/color]
< End of report >
Z góry dzięki.
