kiczkok Opublikowano 19 Października 2010 Zgłoś Opublikowano 19 Października 2010 System: Windows professional XP sp3 Komputer: AMD Athlon 64 Processor 3000+ 1.79 GHz. 512 MB RAM Uruchamianie xp zatrzymuje sie na końcowym etapie, kiedy widać juz pulpit z częścią ikon bez paska zadań. W Procesach menadżera zadań Windows rzuca się w oczy proces o nazwie System, którego użycie pamięci wynosi ponad 100 000 K logi wygenerowane w trybie awaryjnym LOG OTL.txt: OTL logfile created on: 2010-10-19 14:24:47 - Run 2 OTL by OldTimer - Version 3.2.15.2 Folder = C:\Documents and Settings\Kasia\Moje dokumenty\Downloads Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,00 Mb Total Physical Memory | 237,00 Mb Available Physical Memory | 46,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 37,11 Gb Total Space | 11,22 Gb Free Space | 30,23% Space Free | Partition Type: NTFS Drive D: | 97,65 Gb Total Space | 55,28 Gb Free Space | 56,61% Space Free | Partition Type: NTFS Drive E: | 98,11 Gb Total Space | 94,42 Gb Free Space | 96,24% Space Free | Partition Type: NTFS Computer Name: SPECIAL-XP | User Name: Kasia | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2010-10-19 14:23:47 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kasia\Moje dokumenty\Downloads\OTL.exe PRC - [2010-09-21 07:40:50 | 000,977,976 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe PRC - [2010-08-15 19:32:53 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe PRC - [2008-04-14 22:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (SafeList) ========== MOD - [2010-10-19 14:23:47 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kasia\Moje dokumenty\Downloads\OTL.exe MOD - [2010-08-23 18:12:53 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll MOD - [2008-04-14 22:46:34 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - File not found [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus® SRV - [2010-09-21 09:56:39 | 002,331,544 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\avgfws9.exe -- (avgfws9) SRV - [2010-08-15 19:33:08 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2010-08-15 19:33:00 | 005,897,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2010-02-19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2007-08-09 09:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2007-06-15 17:55:00 | 000,300,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) ========== Driver Services (SafeList) ========== DRV - [2010-08-15 19:33:18 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX) DRV - [2010-08-15 19:33:15 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2010-08-15 19:33:02 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys -- (AVGIDSFilterxpx) DRV - [2010-08-15 19:33:02 | 000,026,192 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys -- (AVGIDSShimxpx) DRV - [2010-08-15 19:33:02 | 000,025,168 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\AVGIDSxx.sys -- (AVGIDSErHrxpx) DRV - [2010-08-15 19:33:01 | 000,122,448 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys -- (AVGIDSDriverxpx) DRV - [2010-08-15 19:32:54 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86) DRV - [2010-08-15 19:32:51 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\System32\Drivers\avgrkx86.sys -- (AvgRkx86) DRV - [2010-08-06 12:43:07 | 000,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwfd) DRV - [2010-08-06 12:43:07 | 000,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgfwdx.sys -- (Avgfwdx) DRV - [2009-02-09 07:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2009-02-09 07:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2009-02-09 07:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2009-02-09 07:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2008-07-10 16:29:52 | 000,101,376 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2008-05-20 18:53:00 | 004,800,000 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-05-02 08:48:55 | 000,062,208 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\si3112.sys -- (Si3112) DRV - [2008-04-13 22:06:06 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2006-10-22 13:22:00 | 003,994,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2006-05-08 11:24:24 | 000,391,688 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbVM305.sys -- (ZSMC0305) DRV - [2004-08-13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2002-09-16 17:14:32 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2475029 IE - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\..\URLSearchHook: *{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - Reg Error: Key error. File not found IE - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found IE - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search" FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.gazeta.pl/0,0.html" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1 FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.855 FF - prefs.js..extensions.enabledItems: avg@igeared:4.906.030.003 FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.9.134 FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0 FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.6.3 FF - prefs.js..extensions.enabledItems: info@djzig.com:1.1.7 FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20100719 FF - prefs.js..extensions.enabledItems: {c8f71e5b-88f8-42a7-98bb-e4c506161de9}:0.4 FF - prefs.js..network.proxy.type: 4 FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010-09-21 09:57:28 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010-10-02 14:10:41 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-07-23 12:19:28 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-07-23 09:35:41 | 000,000,000 | ---D | M] [2008-12-17 23:44:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Extensions [2010-09-25 15:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions [2010-02-25 13:08:30 | 000,000,000 | ---D | M] (Aero Fox) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66} [2010-02-05 18:49:20 | 000,000,000 | ---D | M] (MyAshampoo Toolbar) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2010-07-23 09:49:48 | 000,000,000 | ---D | M] (AmbientFox) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{c8f71e5b-88f8-42a7-98bb-e4c506161de9} [2010-08-04 11:11:13 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010-06-22 22:45:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\info@djzig.com [2010-07-23 09:47:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\nasanightlaunch@example.com [2010-09-20 10:00:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\toolbar@ask.com [2010-09-25 15:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\vshare@toolbar [2010-02-25 13:08:39 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\browser\extensions [2010-02-25 13:08:39 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions [2010-02-25 13:08:39 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\browser\extensions [2010-02-25 13:08:39 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions [2010-01-20 13:19:10 | 000,000,923 | ---- | M] () -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\searchplugins\conduit.xml [2010-09-15 15:09:21 | 000,001,274 | ---- | M] () -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\searchplugins\pwn-sjp.xml [2010-09-15 15:08:37 | 000,004,928 | ---- | M] () -- C:\Documents and Settings\Kasia\Dane aplikacji\Mozilla\Firefox\Profiles\op3kpdz5.default\searchplugins\wikislownik-pl.xml [2010-09-25 15:22:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2008-11-11 09:38:54 | 000,663,552 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll [2010-07-14 00:00:03 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-07-14 00:00:03 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-07-14 00:00:03 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-07-14 00:00:03 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-07-14 00:00:03 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-07-14 00:00:03 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 17:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.) O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found. O3 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.) O3 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\..\Toolbar\WebBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files\MyAshampoo\tbMyA1.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O3 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [bigDog305] C:\WINDOWS\VM305_STI.EXE (VM305SNAP) O4 - HKLM..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe (Corel Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia) O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKU\.DEFAULT..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.) O4 - HKU\S-1-5-18..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.) O4 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003..\Run: [ALLUpdate] C:\Program Files\ALLPlayer\ALLUpdate.exe () O4 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003..\Run: [EPSON SX100 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36 O7 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data] O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: Pobierz za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 88.156.96.61 82.139.8.7 88.156.63.9 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Kasia\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kasia\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-11-05 22:17:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-09-09 20:26:03 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009-09-09 20:26:03 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009-09-09 20:26:03 | 000,000,000 | RHSD | M] - E:\autorun.inf -- [ NTFS ] O33 - MountPoints2\{95b48602-ba32-11dd-9238-00064f441d0a}\Shell - "" = AutoRun O33 - MountPoints2\{95b48602-ba32-11dd-9238-00064f441d0a}\Shell\AutoRun\command - "" = L:\AutoRun.exe -- File not found O33 - MountPoints2\{cd7b1a61-4a45-11df-95cb-001a922a90c1}\Shell - "" = AutoRun O33 - MountPoints2\{cd7b1a61-4a45-11df-95cb-001a922a90c1}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010-10-19 13:25:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Pulpit\logi [2010-10-19 13:16:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC [2010-10-16 12:24:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\boost_interprocess [2010-10-16 12:23:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Dane aplikacji\CometPlayer [2010-10-16 12:23:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Dane aplikacji\tigerplayer [2010-10-16 12:23:21 | 000,000,000 | ---D | C] -- C:\Program Files\MpcStar [2010-10-14 19:49:47 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll [2010-10-14 19:49:47 | 000,954,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40.dll [2010-10-14 19:49:47 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll [2010-10-14 19:49:34 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll [2010-10-06 13:07:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Ustawienia lokalne\Dane aplikacji\Yahoo! [2010-10-05 11:22:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Pulpit\tato izrael [2010-10-01 21:11:53 | 099,770,040 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\Kasia\Pulpit\avg_free_stf_eu_90_851a3009.exe [2010-10-01 17:52:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Dane aplikacji\AskToolbar [2010-10-01 17:52:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Ustawienia lokalne\Dane aplikacji\AskToolbar [2010-09-29 19:09:22 | 000,000,000 | ---D | C] -- C:\Program Files\PowerQuest [2010-09-29 17:39:35 | 000,000,000 | ---D | C] -- C:\Program Files\R-Studio [2010-09-29 17:03:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Moje dokumenty\R-TT [2010-09-29 15:39:39 | 000,000,000 | ---D | C] -- C:\Program Files\Convar [2010-09-29 14:03:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Dane aplikacji\Malwarebytes [2010-09-29 14:02:50 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010-09-29 14:02:49 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010-09-29 14:02:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2010-09-29 14:02:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010-09-28 15:00:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Pulpit\AVG Internet Security (Full) + Serial [2010-09-21 12:02:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Dane aplikacji\Corel [2010-09-21 11:58:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Corel [2010-09-21 11:58:10 | 000,000,000 | ---D | C] -- C:\Program Files\Corel [2010-09-21 10:49:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Dane aplikacji\Adobe Mini Bridge CS5 [2010-09-21 10:49:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Dane aplikacji\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010-09-21 10:38:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\regid.1986-12.com.adobe [2010-09-21 10:25:41 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Media Player [2010-09-21 10:23:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR [2010-09-21 10:23:56 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2010-09-21 10:20:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Adobe [2010-09-21 10:19:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kasia\Ustawienia lokalne\Dane aplikacji\Adobe [2010-09-19 19:09:51 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010-10-19 13:16:32 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-10-19 13:16:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-10-19 13:12:35 | 000,001,030 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010-10-19 12:01:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2010-10-19 11:45:00 | 000,001,034 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010-10-19 07:19:02 | 000,088,566 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2010-10-19 07:05:48 | 066,545,451 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2010-10-17 17:01:51 | 000,000,038 | ---- | M] () -- C:\Documents and Settings\Kasia\intlname.ols [2010-10-16 12:23:58 | 000,000,794 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Comet Player.lnk [2010-10-16 12:23:55 | 000,000,666 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\MpcStar.lnk [2010-10-16 12:09:25 | 000,624,891 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\iavifw.avm [2010-10-15 18:20:37 | 016,692,427 | ---- | M] () -- C:\Documents and Settings\Kasia\Pulpit\m8515412.mp3 [2010-10-15 12:02:37 | 003,503,152 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-10-14 23:07:34 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010-10-11 12:02:07 | 000,033,792 | ---- | M] () -- C:\Documents and Settings\Kasia\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-10-07 21:23:06 | 000,044,544 | ---- | M] () -- C:\Documents and Settings\Kasia\Pulpit\zabawy.doc [2010-10-01 21:07:30 | 099,770,040 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Kasia\Pulpit\avg_free_stf_eu_90_851a3009.exe [2010-09-30 21:11:42 | 000,002,539 | ---- | M] () -- C:\Documents and Settings\Kasia\Pulpit\Microsoft Office Word 2003.lnk [2010-09-29 14:02:53 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-09-25 14:50:17 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk [2010-09-24 20:42:09 | 000,000,342 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-SPECIAL-XP-Kasia.job [2010-09-21 14:39:48 | 000,051,140 | ---- | M] () -- C:\Documents and Settings\Kasia\Pulpit\palma.cdr [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010-10-16 12:23:58 | 000,000,794 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Comet Player.lnk [2010-10-16 12:23:55 | 000,000,666 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\MpcStar.lnk [2010-10-15 18:17:45 | 016,692,427 | ---- | C] () -- C:\Documents and Settings\Kasia\Pulpit\m8515412.mp3 [2010-10-07 20:35:41 | 000,044,544 | ---- | C] () -- C:\Documents and Settings\Kasia\Pulpit\zabawy.doc [2010-09-29 14:02:53 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-09-25 14:50:17 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk [2010-09-24 20:42:09 | 000,000,342 | ---- | C] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-SPECIAL-XP-Kasia.job [2010-09-21 14:39:47 | 000,051,140 | ---- | C] () -- C:\Documents and Settings\Kasia\Pulpit\palma.cdr [2010-09-19 19:10:03 | 000,000,234 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2009-02-04 17:09:30 | 000,404,081 | ---- | C] () -- C:\Documents and Settings\Kasia\Dane aplikacji\NMM-MetaData.db [2009-01-18 16:15:26 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini [2009-01-18 16:01:02 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CDESX100EXPORT.ini [2008-12-14 22:28:34 | 000,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-11-14 17:54:09 | 000,033,792 | ---- | C] () -- C:\Documents and Settings\Kasia\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008-11-09 17:50:05 | 000,006,575 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\hpzinstall.log [2008-11-09 17:49:56 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll [2008-11-05 23:11:17 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008-11-05 22:58:18 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-11-05 22:28:28 | 000,016,174 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008-11-05 22:28:27 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2008-11-05 22:28:23 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008-05-03 09:24:01 | 000,000,082 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2007-03-30 00:00:40 | 000,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll [2006-10-22 13:22:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006-10-22 13:22:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006-10-22 13:22:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006-10-22 13:22:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006-10-22 13:22:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006-10-22 13:22:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006-10-22 13:22:00 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2003-04-08 12:40:22 | 000,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2001-07-07 04:00:02 | 000,003,234 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI ========== LOP Check ========== [2008-11-05 22:54:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo [2010-08-17 13:37:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AVG Security Toolbar [2010-08-06 12:43:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\avg9 [2010-10-17 15:10:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\boost_interprocess [2009-01-18 16:09:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\EPSON [2009-06-22 17:12:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2009-06-22 17:15:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Nokia [2009-02-04 16:31:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite [2010-09-28 21:36:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\regid.1986-12.com.adobe [2010-07-07 09:36:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Temp [2008-11-05 22:54:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Ashampoo [2010-10-01 17:52:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\AskToolbar [2010-10-16 12:24:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\CometPlayer [2010-04-19 19:09:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\CoSoSys [2009-03-13 09:31:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\COWON [2010-07-01 13:34:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Desktopicon [2010-10-15 18:21:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\foobar2000 [2008-11-09 16:00:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Gadu-Gadu [2010-04-24 10:49:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Image Zone Express [2008-11-24 16:22:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\iPlus [2009-06-22 17:25:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Nokia [2009-06-22 16:51:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\Nokia Multimedia Player [2009-03-31 20:08:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\PC Suite [2010-09-21 10:49:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010-10-16 12:25:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\tigerplayer [2010-09-28 21:27:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasia\Dane aplikacji\uTorrent [2010-10-19 12:01:00 | 000,000,234 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job ========== Purity Check ========== < End of report > EXTRAS OTL: OTL Extras logfile created on: 2010-10-19 14:24:47 - Run 2 OTL by OldTimer - Version 3.2.15.2 Folder = C:\Documents and Settings\Kasia\Moje dokumenty\Downloads Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,00 Mb Total Physical Memory | 237,00 Mb Available Physical Memory | 46,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 37,11 Gb Total Space | 11,22 Gb Free Space | 30,23% Space Free | Partition Type: NTFS Drive D: | 97,65 Gb Total Space | 55,28 Gb Free Space | 56,61% Space Free | Partition Type: NTFS Drive E: | 98,11 Gb Total Space | 94,42 Gb Free Space | 96,24% Space Free | Partition Type: NTFS Computer Name: SPECIAL-XP | User Name: Kasia | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "27544:TCP" = 27544:TCP:*:Enabled:BitComet 27544 TCP "27544:UDP" = 27544:UDP:*:Enabled:BitComet 27544 UDP ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard) "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process -- (Nokia Corporation) "C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater -- (Nokia Corporation) "C:\Program Files\AVG\AVG8\avgam.exe" = C:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe -- File not found "C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- File not found "C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe -- File not found "C:\Program Files\AVG\AVG9\avgam.exe" = C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe -- (AVG Technologies CZ, s.r.o.) "C:\Program Files\AVG\AVG9\avgdiagex.exe" = C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe -- (AVG Technologies CZ, s.r.o.) "C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.) "C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86 "{05C56753-F144-44BC-BA67-83CC5DBF395C}" = F300 "{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86 "{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help "{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86 "{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5 "{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth "{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm "{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones "{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant "{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12 "{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5 "{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8 "{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86 "{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder "{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI "{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential "{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic "{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme "{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update "{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI "{82427977-8776-4087-90CA-9F65174D3C4D}" = Nokia Connectivity Cable Driver "{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8AD824A5-1CCC-4BB7-82C9-E6FB25CC0479}" = A4 TECH PC Camera V "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86 "{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy "{99A40651-0BC2-4095-8F9A-A40FAB224FEF}" = PC Connectivity Solution "{9F59C3AE-81B0-4EF6-9762-D674BB079705}" = Nokia Software Updater "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser "{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}" = Nokia PC Suite "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A "{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter "{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA "{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86 "{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86 "{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp "{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player "{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Basic "{E1B80DEE-A795-4258-8445-074C06AE3AB8}" = MarketResearch "{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager "{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt "{E5966E4C-0A93-4F59-A981-BD3173D4799F}" = F300_Help "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC "{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan "{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA "{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations "{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA "{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl "0C5EDC3653FED5B121F464339EAC12534D253B25" = Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1) "4077F884D1BB007055BDB83B621D87220A73F30F" = Pakiet sterowników systemu Windows - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0) "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ALLPlayer V3.6.6.5_is1" = ALLPlayer V3.X "AVG9Uninstall" = AVG 9.0 "B726756F5B5A5AA9D798B399386FC6205A45F19E" = Pakiet sterowników systemu Windows - Nokia Modem (02/15/2007 3.1) "BitComet" = BitComet 1.07 "CD8424B9400BFF7D34AA18F816C71322AC4BDAA7" = Pakiet sterowników systemu Windows - Nokia Modem (05/24/2007 6.84.0.1) "chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help "com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player "EPSON SX100 Series" = EPSON SX100 Series Printer Uninstall "ffdshow_is1" = ffdshow [rev 1817] [2008-01-26] "foobar2000" = foobar2000 v1.1 "Foxit Reader" = Foxit Reader "Gadu-Gadu" = Gadu-Gadu 7.7 "Google Chrome" = Google Chrome "Happyland Adventures - Xmas Edition_is1" = Happyland Adventures - Xmas Edition v1.3 "HP Imaging Device Functions" = HP Imaging Device Functions 7.0 "HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0 "HPExtendedCapabilities" = HP Customer Participation Program 7.0 "InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager "InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0 Demo "IrfanView" = IrfanView (remove only) "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Mozilla Firefox (3.6.7)" = Mozilla Firefox (3.6.7) "MpcStar" = MpcStar 4.9 "MyAshampoo Toolbar" = MyAshampoo Toolbar "Nokia PC Suite" = Nokia PC Suite "NVIDIA Drivers" = NVIDIA Drivers "PITy 2009_is1" = PITy 2009 dla Windows kompilacja:1.1.2.4 "RealAlt_is1" = Real Alternative 1.60 "Rozliczenie Roczne Rzeczpospolitej 2008" = Rozliczenie Roczne Rzeczpospolitej 2008 "R-Studio 5.0NSIS" = R-Studio 5.0 "SopCast" = SopCast 3.2.9 "SubEdit-Player_is1" = SubEdit-Player "ToSearch" = ToSearch "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "WinRAR archiver" = Archiwizator WinRAR "Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5 ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-789336058-1993962763-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent" = µTorrent "Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8 ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 2010-08-16 06:06:41 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 490 Description = svchost (1380) Próba otwarcia pliku "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" w trybie odczytu lub zapisu zakończyła się niepomyślnie z błędem systemowym 32 (0x00000020): "Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ". Operacja otwierania pliku zostanie zakończona z błędem -1032 (0xfffffbf8). Error - 2010-08-16 06:06:41 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 439 Description = Catalog Database (1380) Nie można dokonać zapisu lustrzanego nagłówka pliku C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb. Błąd -1032. Error - 2010-08-16 06:06:42 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 473 Description = Catalog Database (1380) Baza danych C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb została częściowo odłączona. Wystąpił błąd -1032 podczas aktualizacji nagłówków bazy danych. Error - 2010-08-18 03:55:57 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 490 Description = svchost (1376) Próba otwarcia pliku "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" w trybie odczytu lub zapisu zakończyła się niepomyślnie z błędem systemowym 32 (0x00000020): "Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ". Operacja otwierania pliku zostanie zakończona z błędem -1032 (0xfffffbf8). Error - 2010-08-24 15:52:51 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 490 Description = svchost (1384) Próba otwarcia pliku "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" w trybie odczytu lub zapisu zakończyła się niepomyślnie z błędem systemowym 32 (0x00000020): "Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ". Operacja otwierania pliku zostanie zakończona z błędem -1032 (0xfffffbf8). Error - 2010-08-24 15:53:44 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 490 Description = svchost (1384) Próba otwarcia pliku "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" w trybie odczytu lub zapisu zakończyła się niepomyślnie z błędem systemowym 32 (0x00000020): "Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ". Operacja otwierania pliku zostanie zakończona z błędem -1032 (0xfffffbf8). Error - 2010-08-24 15:53:44 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 470 Description = Catalog Database (1384) Baza danych C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb jest częściowo dołączona. Etap dołączania: 3. Błąd: -1032. Error - 2010-09-22 09:43:26 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 490 Description = svchost (1400) Próba otwarcia pliku "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" w trybie odczytu lub zapisu zakończyła się niepomyślnie z błędem systemowym 32 (0x00000020): "Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ". Operacja otwierania pliku zostanie zakończona z błędem -1032 (0xfffffbf8). Error - 2010-09-22 09:43:26 | Computer Name = SPECIAL-XP | Source = ESENT | ID = 470 Description = Catalog Database (1400) Baza danych C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb jest częściowo dołączona. Etap dołączania: 3. Błąd: -1032. Error - 2010-09-29 13:08:56 | Computer Name = SPECIAL-XP | Source = MsiInstaller | ID = 1013 Description = Product: PartitionMagic -- 1: This installation can not be run by directly launching the MSI package; you must run setup.exe. [ System Events ] Error - 2010-09-29 11:55:39 | Computer Name = SPECIAL-XP | Source = Disk | ID = 262151 Description = W urządzeniu \Device\Harddisk1\D wystąpił zły blok. Error - 2010-10-05 04:35:26 | Computer Name = SPECIAL-XP | Source = Dhcp | ID = 1002 Description = Adres IP połączenia 95.160.7.111 dla karty sieciowej o adresie 001A922A90C1 został zabroniony przez serwer DHCP 0.0.0.0 (Serwer DHCP wysłał komunikat DHCPNACK). Error - 2010-10-05 05:19:14 | Computer Name = SPECIAL-XP | Source = Dhcp | ID = 1000 Description = Komputer utracił połączenie dla swojego adresu IP 192.168.100.10 na karcie sieciowej o adresie sieciowym 001A922A90C1. Error - 2010-10-11 16:41:48 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7034 Description = Usługa NVIDIA Display Driver Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-10-14 06:21:34 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7034 Description = Usługa NVIDIA Display Driver Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-10-19 07:16:49 | Computer Name = SPECIAL-XP | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd "%1084" podczas próby uruchomienia usługi EventSystem z argumentami "" w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2010-10-19 07:18:03 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7026 Description = Nie można załadować następujących sterowników startu rozruchowego lub systemowego: AvgLdx86 AvgMfx86 Fips Processor Error - 2010-10-19 08:06:09 | Computer Name = SPECIAL-XP | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd "%1084" podczas próby uruchomienia usługi wuauserv z argumentami "" w celu uruchomienia serwera: {E60687F7-01A1-40AA-86AC-DB1CBF673334} Error - 2010-10-19 08:06:32 | Computer Name = SPECIAL-XP | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd "%1084" podczas próby uruchomienia usługi MSIServer z argumentami "" w celu uruchomienia serwera: {000C101C-0000-0000-C000-000000000046} Error - 2010-10-19 08:06:36 | Computer Name = SPECIAL-XP | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd "%1084" podczas próby uruchomienia usługi MSIServer z argumentami "" w celu uruchomienia serwera: {000C101C-0000-0000-C000-000000000046} < End of report > LOG GMER GMER 1.0.15.15472 - http://www.gmer.net Rootkit scan 2010-10-19 15:52:42 Windows 5.1.2600 Dodatek Service Pack 3 Running: xqe35dl9.exe; Driver: C:\DOCUME~1\Kasia\USTAWI~1\Temp\pwtiykog.sys ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D0B4 4 Bytes [28, 00, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D0B9 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D524 1 Byte [28] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D524 4 Bytes [28, 03, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D529 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D5A4 4 Bytes [68, 00, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D5A9 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D604 4 Bytes [A8, 01, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D609 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D614 4 Bytes CALL 7B90EC1A .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D619 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D624 4 Bytes [A8, 02, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D629 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D664 4 Bytes [68, 01, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D669 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D674 4 Bytes [68, 02, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D679 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D684 4 Bytes CALL 7B90EC8B .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D689 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D714 4 Bytes [A8, 00, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D719 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D7B4 4 Bytes CALL 7B90EDB9 .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90D7B9 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90DC64 4 Bytes [28, 01, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90DC69 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90DCB4 4 Bytes [28, 02, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90DCB9 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90DF14 1 Byte [68] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90DF14 4 Bytes [68, 03, 16, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1620] ntdl 7C90DF19 1 Byte [E2] ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\Google\Chrome\Application\chrome.exe[1620] @ C: 002C0010 ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, ---- EOF - GMER 1.0.15 ----
picasso Opublikowano 19 Października 2010 Zgłoś Opublikowano 19 Października 2010 (edytowane) Infekcji tu nie widzę, choć na dzień dzisiejszy nie da się tego potwierdzić za pomocą logów w sposób w 100% pewny. Może zacznijmy od podstaw: Uruchamianie xp zatrzymuje sie na końcowym etapie, kiedy widać juz pulpit z częścią ikon bez paska zadań. W Procesach menadżera zadań Windows rzuca się w oczy proces o nazwie System, którego użycie pamięci wynosi ponad 100 000 K Proces SYSTEM wskazuje na sterowniki, mogą to być przykładowo sterowniki od programów zabezpieczających. 1. W Dzienniku zdarzeń jest m.in. ten błąd: Error - 2010-10-19 07:18:03 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7026Description = Nie można załadować następujących sterowników startu rozruchowegolub systemowego: AvgLdx86 AvgMfx86 Fips Processor Są tu odnośniki do dwóch sterowników AVG. AVG i tak jest tu w starszej wersji 9, aktualna to 2011. Proponuję sprawdzić co się stanie, jeśli odinstalujesz całkowicie AVG. 2. Z ostatnich nabytków widzę też PowerQuest, czego skutek to osadzenie się w systemie strasznie starego sterownika (datowanie na rok 2002): DRV - [2002-09-16 17:14:32 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv) Proponuję wyrzucić całkowicie PowerQuest PartitionMagic 8.0 Demo. Masz darmowe nowoczesne programy do partycjonowania: EASEUS Partition Master Home Edition Partition Wizard Home Edition Paragon Partition Manager Free Edition 3. W AutoRuns w karcie Services skasuj tę resztkę po Adobe: SRV - File not found [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus® W karcie Logon odznacz z ładowania te zbędniki (a wpis "not found") możesz skasować: O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)O4 - HKLM..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe (Corel Corporation)O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)O4 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003..\Run: [ALLUpdate] C:\Program Files\ALLPlayer\ALLUpdate.exe ()O4 - HKU\S-1-5-21-789336058-1993962763-1801674531-1003..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) 4. Dodatkowo, ale to nie będzie mieć wpływu na problem, pozbądź się śmieci zainstalowanych w przeglądarkach. Przez Dodaj / Usuń odinstaluj MyAshampoo Toolbar i Ask Toolbar. Po przeprowadzeniu tych działań zresetuj system i sprawdź jak wygląda sytuacja. Podaj także nowy log z OTL, bo może po deinstalacjach nie wszystko się usunie i trzeba będzie ręcznie kosmetyzować. . Edytowane 21 Lutego 2011 przez picasso 21.02.2011 - Temat zostaje zamknięty z powodu braku odpowiedzi autora. //picasso
Rekomendowane odpowiedzi