Znikanie systemu (?) - "system not found"

**Posty:** 13 · przez **stajorek** 13 Gru 2009, 17:09

Podczas pobierania plików z internetu w nieoczekiwanym momencie wyskakuje blackscreen z dużą ilością dziwnych znaczków i napisem "System not found"

OTL Log:

Kod: Zaznacz wszystko: OTL logfile created on: 2009-12-13 16:03:44 - Run 1 OTL by OldTimer - Version 3.1.17.0 Folder = D:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1,99 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 79,92% Memory free 3,84 Gb Paging File | 3,60 Gb Available in Paging File | 93,66% Paging File free Paging file location(s): D:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Program Files Drive C: | 45,12 Gb Total Space | 26,11 Gb Free Space | 57,86% Space Free | Partition Type: NTFS Drive D: | 103,91 Gb Total Space | 90,25 Gb Free Space | 86,85% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LAPTOP Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-12-13 16:03:26 | 00,538,112 | ---- | M] (OldTimer Tools) -- D:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\OTL.exe PRC - [2009-11-07 22:04:35 | 00,908,248 | ---- | M] (Mozilla Corporation) -- D:\Program Files\Mozilla Firefox\firefox.exe PRC - [2008-04-14 22:51:52 | 00,013,824 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\system32\wscntfy.exe PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\explorer.exe PRC - [2008-02-19 14:34:46 | 16,858,112 | ---- | M] (Realtek Semiconductor Corp.) -- D:\WINDOWS\RTHDCPL.exe PRC - [2008-02-08 07:48:36 | 00,159,744 | ---- | M] (Intel Corporation) -- D:\WINDOWS\system32\hkcmd.exe PRC - [2008-02-08 07:48:36 | 00,135,168 | ---- | M] (Intel Corporation) -- D:\WINDOWS\system32\igfxtray.exe PRC - [2008-02-08 07:48:10 | 00,131,072 | ---- | M] (Intel Corporation) -- D:\WINDOWS\system32\igfxpers.exe PRC - [2008-02-08 07:47:56 | 00,249,856 | ---- | M] (Intel Corporation) -- D:\WINDOWS\system32\igfxsrvc.exe PRC - [2007-07-26 14:57:02 | 00,192,512 | ---- | M] (Wistron) -- D:\Program Files\Launch Manager\HotkeyApp.exe PRC - [2006-11-17 20:45:26 | 00,118,784 | ---- | M] (Wistron Corp.) -- D:\Program Files\Launch Manager\WisLMSvc.exe PRC - [2006-10-25 07:32:36 | 00,036,864 | RHS- | M] (Microsoft Corporation) -- D:\WINDOWS\system32\EXPLORER.EXE [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-12-13 16:03:26 | 00,538,112 | ---- | M] (OldTimer Tools) -- D:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\OTL.exe MOD - [2009-12-13 15:59:15 | 00,218,716 | RHS- | M] () -- D:\Documents and Settings\Administrator\Ustawienia lokalne\temp\cvasds0.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2006-11-17 20:45:26 | 00,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- D:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- D:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2008-04-13 22:06:06 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008-02-26 15:01:44 | 04,737,024 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-02-08 08:50:40 | 05,955,232 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm) DRV - [2007-02-06 23:43:26 | 00,090,880 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2006-11-15 07:00:58 | 00,528,096 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2003-04-28 11:27:06 | 00,009,867 | ---- | M] () [Kernel | System | Running] -- D:\WINDOWS\system32\drivers\HOTKEY.sys -- (Hotkey) DRV - [2001-08-17 22:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] [2009-12-08 20:35:31 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions [2009-12-08 20:35:31 | 00,000,000 | ---D | M] -- D:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\u07nfqz8.default\extensions [2009-12-08 18:17:13 | 00,000,000 | ---D | M] -- D:\Program Files\Mozilla Firefox\extensions [2009-08-31 13:11:24 | 00,927,232 | ---- | M] (Ganymede Technologies) -- D:\Program Files\Mozilla Firefox\plugins\NPBOARDS.dll [2009-08-31 13:11:18 | 00,873,976 | ---- | M] (Ganymede Technologies) -- D:\Program Files\Mozilla Firefox\plugins\NPCARDS.dll [2009-11-16 16:23:30 | 00,120,296 | ---- | M] ( ) -- D:\Program Files\Mozilla Firefox\plugins\npganymedenet.dll [2009-03-24 10:10:44 | 00,114,688 | ---- | M] (Zylom) -- D:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll [2009-07-30 23:44:16 | 00,002,767 | ---- | M] () -- D:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-30 23:44:16 | 00,001,406 | ---- | M] () -- D:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-30 23:44:16 | 00,000,917 | ---- | M] () -- D:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-07-30 23:44:16 | 00,000,858 | ---- | M] () -- D:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-07-30 23:44:16 | 00,001,183 | ---- | M] () -- D:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-07-30 23:44:16 | 00,001,683 | ---- | M] () -- D:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (361539 bytes) - D:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 12430 more lines... O4 - HKLM..\Run: [Alcmtr] D:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [CtrlVol] D:\Program Files\Launch Manager\CtrlVol.exe File not found O4 - HKLM..\Run: [HotkeyApp] D:\Program Files\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [LaunchAp] D:\Program Files\Launch Manager\LaunchAp.exe File not found O4 - HKLM..\Run: [Persistence] D:\WINDOWS\system32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [RTHDCPL] D:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [Wbutton] D:\Program Files\Launch Manager\WButton.exe File not found O4 - HKCU..\Run: [cdoosoft] D:\Documents and Settings\Administrator\Ustawienia lokalne\temp\herss.exe () O4 - HKCU..\Run: [EXPLORER.EXE] D:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) O4 - HKCU..\Run: [wsctf.exe] File not found O4 - Startup: D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - D:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.10 194.204.159.1 194.204.152.34 O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (EXPLORER.EXE) - D:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - D:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-08-24 15:39:17 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-12-13 16:03:52 | 00,000,055 | RHS- | M] () - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009-12-10 21:58:55 | 00,070,759 | ---- | M] () - D:\AutoMapaSetupLog.txt -- [ NTFS ] O32 - AutoRun File - [2009-12-13 16:03:52 | 00,000,055 | RHS- | M] () - D:\autorun.inf -- [ NTFS ] O33 - MountPoints2\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\Shell\AutoRun\command - "" = G:\xmor.exe -- File not found O33 - MountPoints2\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\Shell\open\Command - "" = G:\xmor.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-12-13 12:13:28 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Moje dokumenty\Wru Downloads [2009-12-13 12:13:28 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Wru [2009-12-10 22:15:58 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\WinRAR [2009-12-10 22:12:44 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie [2009-12-10 21:56:30 | 00,036,864 | RHS- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\EXPLORER.EXE [2009-12-08 23:01:59 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\InstallShield [2009-12-08 20:44:47 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\ipla [2009-12-08 20:43:31 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\gry [2009-12-08 20:41:49 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Adobe [2009-12-08 20:41:49 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Adobe [2009-12-08 20:39:51 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Moje dokumenty\Sports Interactive [2009-12-08 20:39:51 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Sports Interactive [2009-12-08 18:17:13 | 00,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Dane aplikacji\NOS [2009-12-08 18:07:48 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Macromedia [2009-12-08 18:07:46 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\cache [2009-12-08 18:06:33 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Nowe Gadu-Gadu [2009-12-07 22:56:18 | 00,000,000 | ---D | C] -- D:\WINDOWS\tmp [2009-12-07 21:35:02 | 00,000,000 | -HSD | C] -- D:\RECYCLER [2009-12-07 21:29:09 | 00,000,000 | ---D | C] -- D:\temp [2009-12-07 21:08:57 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla [2009-12-07 21:08:57 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Mozilla [2009-12-07 21:05:38 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Identities [2009-12-07 21:05:04 | 00,000,000 | R--D | C] -- D:\Documents and Settings\Administrator\Moje dokumenty\Moja muzyka [2009-12-07 21:05:03 | 00,000,000 | --SD | C] -- D:\Documents and Settings\Administrator\Cookies [2009-12-07 21:05:03 | 00,000,000 | R--D | C] -- D:\Documents and Settings\Administrator\Moje dokumenty\Moje obrazy [2009-12-07 21:04:56 | 00,000,000 | --SD | C] -- D:\Documents and Settings\Administrator\Dane aplikacji\Microsoft [2009-12-07 21:04:56 | 00,000,000 | RH-D | C] -- D:\Documents and Settings\Administrator\SendTo [2009-12-07 21:04:56 | 00,000,000 | RH-D | C] -- D:\Documents and Settings\Administrator\Recent [2009-12-07 21:04:56 | 00,000,000 | RH-D | C] -- D:\Documents and Settings\Administrator\Dane aplikacji [2009-12-07 21:04:56 | 00,000,000 | R--D | C] -- D:\Documents and Settings\Administrator\Ulubione [2009-12-07 21:04:56 | 00,000,000 | R--D | C] -- D:\Documents and Settings\Administrator\Moje dokumenty [2009-12-07 21:04:56 | 00,000,000 | R--D | C] -- D:\Documents and Settings\Administrator\Menu Start [2009-12-07 21:04:56 | 00,000,000 | -H-D | C] -- D:\Documents and Settings\Administrator\Ustawienia lokalne [2009-12-07 21:04:56 | 00,000,000 | -H-D | C] -- D:\Documents and Settings\Administrator\Szablony [2009-12-07 21:04:56 | 00,000,000 | -H-D | C] -- D:\Documents and Settings\Administrator\PrintHood [2009-12-07 21:04:56 | 00,000,000 | -H-D | C] -- D:\Documents and Settings\Administrator\NetHood [2009-12-07 21:04:56 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Pulpit [2009-12-07 21:04:56 | 00,000,000 | ---D | C] -- D:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-12-07 20:53:37 | 00,212,480 | ---- | C] (SteelWerX) -- D:\WINDOWS\SWXCACLS.exe [2009-12-07 20:53:37 | 00,161,792 | ---- | C] (SteelWerX) -- D:\WINDOWS\SWREG.exe [2009-12-07 20:53:37 | 00,136,704 | ---- | C] (SteelWerX) -- D:\WINDOWS\SWSC.exe [2009-12-07 20:53:37 | 00,031,232 | ---- | C] (NirSoft) -- D:\WINDOWS\NIRCMD.exe [2009-12-07 20:53:23 | 00,000,000 | ---D | C] -- D:\WINDOWS\ERDNT [2009-12-07 20:53:05 | 00,000,000 | ---D | C] -- D:\Qoobox [2009-12-04 19:45:39 | 00,000,000 | ---D | C] -- D:\Program Files\Rigs of Rods 0.35 [2009-12-04 19:45:27 | 00,515,416 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\XAudio2_5.dll [2009-12-04 19:45:27 | 00,238,936 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\xactengine3_5.dll [2009-12-04 19:45:26 | 05,501,792 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\d3dcsx_42.dll [2009-12-04 19:45:26 | 01,974,616 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\D3DCompiler_42.dll [2009-12-04 19:45:26 | 00,235,344 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\d3dx11_42.dll [2009-12-04 19:45:25 | 01,892,184 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\D3DX9_42.dll [2009-12-04 19:45:25 | 00,453,456 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\d3dx10_42.dll [2009-12-04 19:36:52 | 00,000,000 | -H-D | C] -- D:\WINDOWS\msdownld.tmp [2009-12-03 10:56:11 | 00,000,000 | ---D | C] -- D:\Program Files\Ganymede [2009-11-29 13:57:02 | 00,000,000 | ---D | C] -- D:\Program Files\New Star Soccer 3 [2009-11-24 19:26:19 | 00,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Dane aplikacji\DivoGames [2009-11-21 18:18:33 | 00,000,000 | ---D | C] -- D:\Documents and Settings\All Users\Dane aplikacji\ipla [2009-11-21 18:18:26 | 00,000,000 | ---D | C] -- D:\Program Files\ipla [2009-11-21 18:17:52 | 01,700,352 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\gdiplus.dll [2009-08-24 16:50:34 | 00,000,000 | ---D | M] -- D:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-08-24 15:42:44 | 00,000,000 | ---D | M] -- D:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-08-24 15:39:14 | 00,000,000 | --SD | M] -- D:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-08-24 15:39:14 | 00,000,000 | --SD | M] -- D:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [11 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ] [1 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-12-13 16:05:09 | 00,000,055 | RHS- | M] () -- D:\autorun.inf [2009-12-13 15:59:13 | 00,000,006 | -H-- | M] () -- D:\WINDOWS\tasks\SA.DAT [2009-12-13 15:59:12 | 00,002,048 | --S- | M] () -- D:\WINDOWS\bootstat.dat [2009-12-12 21:46:33 | 01,048,576 | ---- | M] () -- D:\Documents and Settings\Administrator\ntuser.dat [2009-12-12 21:46:33 | 00,000,188 | -HS- | M] () -- D:\Documents and Settings\Administrator\ntuser.ini [2009-12-09 21:33:41 | 00,017,080 | ---- | M] () -- D:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-12-08 23:01:06 | 00,112,584 | ---- | M] () -- D:\WINDOWS\System32\FNTCACHE.DAT [2009-12-08 21:42:25 | 04,837,520 | -H-- | M] () -- D:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-12-08 21:16:25 | 00,000,427 | ---- | M] () -- D:\WINDOWS\ODBC.INI [2009-12-08 21:16:14 | 00,000,608 | ---- | M] () -- D:\WINDOWS\win.ini [2009-12-08 21:16:01 | 00,001,750 | ---- | M] () -- D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk [2009-12-08 20:37:56 | 00,769,282 | ---- | M] () -- D:\WINDOWS\System32\PerfStringBackup.INI [2009-12-08 20:37:56 | 00,357,900 | ---- | M] () -- D:\WINDOWS\System32\perfh015.dat [2009-12-08 20:37:56 | 00,313,222 | ---- | M] () -- D:\WINDOWS\System32\perfh009.dat [2009-12-08 20:37:56 | 00,050,978 | ---- | M] () -- D:\WINDOWS\System32\perfc015.dat [2009-12-08 20:37:56 | 00,041,226 | ---- | M] () -- D:\WINDOWS\System32\perfc009.dat [2009-12-07 21:04:46 | 00,002,206 | ---- | M] () -- D:\WINDOWS\System32\wpa.dbl [2009-12-07 21:01:15 | 00,000,227 | ---- | M] () -- D:\WINDOWS\system.ini [2009-12-07 20:53:08 | 00,361,539 | R--- | M] () -- D:\WINDOWS\System32\drivers\etc\hosts [2009-12-07 17:47:26 | 00,118,048 | RHS- | M] () -- D:\xmor.exe [2009-11-25 18:57:24 | 00,001,393 | ---- | M] () -- D:\WINDOWS\imsins.BAK [2009-11-21 18:18:29 | 00,000,626 | ---- | M] () -- D:\Documents and Settings\All Users\Pulpit\ipla.lnk [2009-11-21 18:17:52 | 01,700,352 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\System32\gdiplus.dll [2009-11-14 01:47:57 | 00,260,608 | ---- | M] () -- D:\WINDOWS\PEV.exe [11 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ] [1 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-10 21:56:57 | 00,000,055 | RHS- | C] () -- D:\autorun.inf [2009-12-10 21:56:56 | 00,118,048 | RHS- | C] () -- D:\xmor.exe [2009-12-08 21:16:01 | 00,001,750 | ---- | C] () -- D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk [2009-12-07 21:05:55 | 01,048,576 | ---- | C] () -- D:\Documents and Settings\Administrator\ntuser.dat [2009-12-07 21:04:58 | 00,000,188 | -HS- | C] () -- D:\Documents and Settings\Administrator\ntuser.ini [2009-12-07 20:53:37 | 00,260,608 | ---- | C] () -- D:\WINDOWS\PEV.exe [2009-12-07 20:53:37 | 00,098,816 | ---- | C] () -- D:\WINDOWS\sed.exe [2009-12-07 20:53:37 | 00,080,412 | ---- | C] () -- D:\WINDOWS\grep.exe [2009-12-07 20:53:37 | 00,077,312 | ---- | C] () -- D:\WINDOWS\MBR.exe [2009-12-07 20:53:37 | 00,068,096 | ---- | C] () -- D:\WINDOWS\zip.exe [2009-11-21 18:18:29 | 00,000,626 | ---- | C] () -- D:\Documents and Settings\All Users\Pulpit\ipla.lnk [2009-08-29 18:17:19 | 00,000,427 | ---- | C] () -- D:\WINDOWS\ODBC.INI [2009-08-27 12:44:01 | 00,168,448 | ---- | C] () -- D:\WINDOWS\System32\unrar.dll [2009-08-27 12:41:36 | 00,795,648 | ---- | C] () -- D:\WINDOWS\System32\xvidcore.dll [2009-08-24 17:51:47 | 00,009,867 | ---- | C] () -- D:\WINDOWS\System32\drivers\HOTKEY.sys [2009-08-24 17:41:06 | 00,147,456 | ---- | C] () -- D:\WINDOWS\System32\igfxCoIn_v4924.dll < End of report >

**Posty:** 18165 · przez **wojtas** 13 Gru 2009, 17:19

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 13 · przez **stajorek** 13 Gru 2009, 17:49

Mógłbym prosić o jakiś prywatny link do ComboFix'a bo te podane w instrukcji nie działają a z tego co czytałem to tylko te dwa były nazwane bezpiecznymi.

**Posty:** 18165 · przez **wojtas** 13 Gru 2009, 23:02

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKCU..\Run: [EXPLORER.EXE] D:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [wsctf.exe] File not found
O4 - HKCU..\Run: [cdoosoft] D:\Documents and Settings\Administrator\Ustawienia lokalne\temp\herss.exe ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (EXPLORER.EXE) - D:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation)
O32 - AutoRun File - [2009-12-13 16:03:52 | 00,000,055 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-12-10 21:58:55 | 00,070,759 | ---- | M] () - D:\AutoMapaSetupLog.txt -- [ NTFS ]
O32 - AutoRun File - [2009-12-13 16:03:52 | 00,000,055 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\Shell\AutoRun\command - "" = G:\xmor.exe -- File not found
O33 - MountPoints2\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\Shell\open\Command - "" = G:\xmor.exe -- File not found

:Files
D:\WINDOWS\PEV.exe
D:\WINDOWS\sed.exe
D:\WINDOWS\grep.exe
D:\WINDOWS\MBR.exe
D:\WINDOWS\zip.exe
C:\xmor.exe
D:\xmor.exe
C:\autorun.inf
D:\autorun.inf
D:\Documents and Settings\Administrator\Moje dokumenty\Wru Downloads
D:\Documents and Settings\Administrator\Dane aplikacji\Wru
D:\WINDOWS\System32\EXPLORER.EXE
D:\Documents and Settings\Administrator\Ustawienia lokalne\temp\cvasds0.dll
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="explorer.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 13 · przez **stajorek** 14 Gru 2009, 16:37

Zrobiłem kazałeś i teraz nie wiedzieć dlaczego wogóle nie mogę zalogować się do systemu, wybieram użytkownika (w tym wypadku mam tylko jedno konto administratora), słychać dźwięk logowania, pokazuje się nawet tapeta a potem nagłe wylogowanie i znowu ekran powitalny. Mam zainstalowana konsole odzyskiwania także jeśli to coś da mogę jej użyć.

**Posty:** 18165 · przez **wojtas** 14 Gru 2009, 17:21

napraw system bez utraty danych klik albo w konsoli wpisz chkdsk c /p /r

**Posty:** 13 · przez **stajorek** 14 Gru 2009, 21:52

Prosze:

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EXPLORER.EXE deleted successfully. D:\WINDOWS\system32\EXPLORER.EXE moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wsctf.exe deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cdoosoft deleted successfully. D:\Documents and Settings\Administrator\Ustawienia lokalne\temp\herss.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:Explorer.exe deleted successfully. File D:\WINDOWS\System32\EXPLORER.EXE not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:EXPLORER.EXE deleted successfully. File D:\WINDOWS\System32\EXPLORER.EXE not found. C:\autorun.inf moved successfully. D:\AutoMapaSetupLog.txt moved successfully. D:\autorun.inf moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\ not found. File G:\xmor.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6b8ab16f-e5ce-11de-9b6d-0016d38b90b8}\ not found. File G:\xmor.exe not found. ========== FILES ========== D:\WINDOWS\PEV.exe moved successfully. D:\WINDOWS\sed.exe moved successfully. D:\WINDOWS\grep.exe moved successfully. D:\WINDOWS\MBR.exe moved successfully. D:\WINDOWS\zip.exe moved successfully. C:\xmor.exe moved successfully. D:\xmor.exe moved successfully. File\Folder C:\autorun.inf not found. File\Folder D:\autorun.inf not found. D:\Documents and Settings\Administrator\Moje dokumenty\Wru Downloads\Partial folder moved successfully. D:\Documents and Settings\Administrator\Moje dokumenty\Wru Downloads\Completed folder moved successfully. D:\Documents and Settings\Administrator\Moje dokumenty\Wru Downloads folder moved successfully. D:\Documents and Settings\Administrator\Dane aplikacji\Wru\Cache folder moved successfully. D:\Documents and Settings\Administrator\Dane aplikacji\Wru folder moved successfully. File\Folder D:\WINDOWS\System32\EXPLORER.EXE not found. D:\Documents and Settings\Administrator\Ustawienia lokalne\temp\cvasds0.dll moved successfully. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\"Shell"|"explorer.exe" /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\"Userinit"|"C:\WINDOWS\system32\userinit.exe," /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: Admin ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 38045 bytes ->Java cache emptied: 36196638 bytes ->FireFox cache emptied: 140585089 bytes User: Administrator ->Temp folder emptied: 61297681 bytes ->Temporary Internet Files folder emptied: 305362 bytes ->FireFox cache emptied: 83022222 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32835 bytes User: LocalService.ZARZĄDZANIE NT ->Temp folder emptied: 49600 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32835 bytes User: NetworkService.ZARZĄDZANIE NT ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2982806 bytes %systemroot%\System32 .tmp files removed: 2596 bytes Windows Temp folder emptied: 3718 bytes RecycleBin emptied: 62692034 bytes Total Files Cleaned = 369,33 mb OTL by OldTimer - Version 3.1.17.0 log created on 12142009_153122 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

**Posty:** 18165 · przez **wojtas** 14 Gru 2009, 22:28

pokaż nowy log z OTL

**Posty:** 13 · przez **stajorek** 14 Gru 2009, 23:19

Zapomnialem o nim.
http://www.wklej.eu/index.php?id=1e41ad73f8

**Posty:** 18165 · przez **wojtas** 15 Gru 2009, 00:21

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie ) i daj raport ze skanu

**Posty:** 13 · przez **stajorek** 15 Gru 2009, 11:42

To chyba ten log:

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.42 Wersja bazy definicji: 3363 Windows 5.1.2600 Dodatek Service Pack 2 Internet Explorer 6.0.2900.2180 09-12-15 10:37:44 mbam-log-2009-12-15 (10-37-41).txt Typ skanowania: Pełne skanowanie (C:\|D:\|) Przeskanowane obiekty: 218966 Upłynęło: 33 minute(s), 55 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 10 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0086929.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0086938.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0086946.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0087946.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0087954.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0086931.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0086940.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0087948.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0087956.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{2A96A3E4-C5E3-4E3A-92BB-C32381AFDA67}\RP36\A0086948.exe (Spyware.OnlineGames) -> No action taken.

**Posty:** 18165 · przez **wojtas** 15 Gru 2009, 22:24

skasuj te pliki co wskazał. zrób skan i daj dalete

potem bedzie ok

Autor postu otrzymał pochwałę

**Posty:** 13 · przez **stajorek** 15 Gru 2009, 23:03

Dobra. Dzięki za pomoc.

Kto jest na forum