lukaszsz3

Log z usuwania: ========== FILES ========== Unable to replace file: C:\WINDOWS\System32\services.exe with C:\services.exe without a reboot. File C:\WINDOWS\System32\dllcache\services.exe successfully replaced with C:\services.exe ========== COMMANDS ========== OTL by OldTimer - Version 3.2.53.1 log created on 07212012_131426 Files\Folders moved on Reboot... PendingFileRenameOperations files... [2009-02-09 13:25:57 | 000,111,104 | ---- | M] (Microsoft Corporation) C:\WINDOWS\System32\services.exe : MD5=02A467E27AF55F7064C5B251E587315F Registry entries deleted on Reboot... SystemLook: SystemLook 30.07.11 by jpshortstuff Log created at 13:18 on 21/07/2012 by komputer Administrator - Elevation successful ========== reg ========== [HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] (Unable to open key - key not found) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}] @="Microsoft WBEM New Event Subsystem" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32] @="C:\WINDOWS\system32\wbem\wbemess.dll" "ThreadingModel"="Both" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] @="MruPidlList" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] @="%SystemRoot%\system32\shdocvw.dll" "ThreadingModel"="Apartment" ========== filefind ========== Searching for "services.exe" C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe --a---- 111104 bytes [19:56 19/04/2011] [11:19 09/02/2009] 8816E60BF654353E8E0D35ED98875445 C:\WINDOWS\$NtServicePackUninstall$\services.exe -----c- 108544 bytes [18:53 19/04/2011] [12:00 02/03/2006] 3DA8D964D2CC12EF8E8C342471A37917 C:\WINDOWS\$NtUninstallKB956572$\services.exe -----c- 109056 bytes [20:04 19/04/2011] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA C:\WINDOWS\ServicePackFiles\i386\services.exe ------- 109056 bytes [18:56 19/04/2011] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA C:\WINDOWS\system32\services.exe --a---- 111104 bytes [12:00 02/03/2006] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F C:\WINDOWS\system32\dllcache\services.exe --a--c- 109056 bytes [19:56 19/04/2011] [11:13 21/07/2012] 3E3AE424E27C4CEFE4CAB368C7B570EA -= EOF =- Niestety komp nadal nie uruchamia się w trybie normalnym. Reset podczas uruchamiania. Mam wrażenie, że nie obędzie się bez formata.

System nadal uruchamia się tylko w trybie awaryjnym. Po wykonaniu skryptu pozwoliłem mu na próbe uruchomienia normalnego, ale podczas startowania zresetował się. SystemLook 30.07.11 by jpshortstuff Log created at 20:10 on 08/07/2012 by komputer Administrator - Elevation successful ========== reg ========== [HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] (Unable to open key - key not found) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}] @="Microsoft WBEM New Event Subsystem" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32] @="C:\WINDOWS\system32\wbem\wbemess.dll" "ThreadingModel"="Both" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] @="MruPidlList" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] @="%SystemRoot%\system32\shdocvw.dll" "ThreadingModel"="Apartment" ========== filefind ========== Searching for "services.exe" C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe --a---- 111104 bytes [19:56 19/04/2011] [11:19 09/02/2009] 8816E60BF654353E8E0D35ED98875445 C:\WINDOWS\$NtServicePackUninstall$\services.exe -----c- 108544 bytes [18:53 19/04/2011] [12:00 02/03/2006] 3DA8D964D2CC12EF8E8C342471A37917 C:\WINDOWS\$NtUninstallKB956572$\services.exe -----c- 109056 bytes [20:04 19/04/2011] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA C:\WINDOWS\ServicePackFiles\i386\services.exe ------- 109056 bytes [18:56 19/04/2011] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA C:\WINDOWS\system32\services.exe --a---- 111104 bytes [12:00 02/03/2006] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F C:\WINDOWS\system32\dllcache\services.exe -----c- 111104 bytes [19:56 19/04/2011] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F -= EOF =- OTL.Txt

SystemLook 30.07.11 by jpshortstuff Log created at 23:32 on 07/07/2012 by komputer Administrator - Elevation successful ========== reg ========== [HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] (No values found) [HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32] "ThreadingModel"="Both" @="C:\Documents and Settings\komputer\Ustawienia lokalne\Dane aplikacji\{f4279d6f-24d6-9c13-75ed-9ab2931b279d}\n." [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}] @="Microsoft WBEM New Event Subsystem" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32] @="\\.\globalroot\systemroot\Installer\{f4279d6f-24d6-9c13-75ed-9ab2931b279d}\n." "ThreadingModel"="Both" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] @="MruPidlList" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] @="%SystemRoot%\system32\shdocvw.dll" "ThreadingModel"="Apartment" ========== filefind ========== Searching for "services.exe" C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe --a---- 111104 bytes [19:56 19/04/2011] [11:19 09/02/2009] 8816E60BF654353E8E0D35ED98875445 C:\WINDOWS\$NtServicePackUninstall$\services.exe -----c- 108544 bytes [18:53 19/04/2011] [12:00 02/03/2006] 3DA8D964D2CC12EF8E8C342471A37917 C:\WINDOWS\$NtUninstallKB956572$\services.exe -----c- 109056 bytes [20:04 19/04/2011] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA C:\WINDOWS\ServicePackFiles\i386\services.exe ------- 109056 bytes [18:56 19/04/2011] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA C:\WINDOWS\system32\services.exe --a---- 111104 bytes [12:00 02/03/2006] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F C:\WINDOWS\system32\dllcache\services.exe -----c- 111104 bytes [19:56 19/04/2011] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F -= EOF =-

Avast wykrył win32:sirefef-AO oraz win64:sirefef-A w procesie svhost.exe W tej chwili możliwość uruchomienia komputera tylko w trybie awaryjnym. GMER.txt Extras.Txt OTL.Txt