Komp i net zamula, nod32 szaleje

[Chaber*]

Od jakiegoś czasu zauważyłem gdy włączę neta co parę minut wyskakuje alert z NODa:

Kod: Zaznacz wszystko

Obiekt:
http://hugehighest.cn/load.exe
Zagrożenie:
prawdopodobnie nieznany wirus NewHeur_PE wirus

Odkąd pierwszy raz się to pojawiło komp i net strasznie muli. Po za tym zauważyłem wzmożoną aktywność procesu ekrn.exe
Nie mam pojęcia co to może być i jak się tego pozbyć.
Wklejam loga z RSIT:

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Chabra at 2009-05-15 16:20:03
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 8 GB (42%) free of 18 GB
Total RAM: 1023 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:20:07, on 2009-05-15
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chabra\Pulpit\RSIT.exe
C:\Program Files\trend micro\Chabra.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java ?? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D0DB935-C383-4033-9921-5EDBF6F37A9D}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D0DB935-C383-4033-9921-5EDBF6F37A9D}: NameServer = 194.204.159.1 217.98.63.164
O20 - Winlogon Notify: crypt - C:\WINDOWS\
O23 - Service: Usługa inteligentnego transferu w tle (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: MS Software Shadow Copy Provider SwPrvRemoteAccess (SwPrvRemoteAccess) - Unknown owner - C:\WINDOWS\system32\admparsew.exe
O23 - Service: Aktualizacje automatyczne (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 5224 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2008-03-13 1443072]
"SpeedTouch USB Diagnostics"=C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [2004-01-26 866816]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-03 86016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
C:\Program Files\Ares\Ares.exe -h []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
C:\Program Files\BearShare\BearShare.exe [2006-08-01 3313664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe [2002-03-28 188416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2008-04-13 208952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2008-04-13 59392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\\NeroCheck.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [2006-06-15 229376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [2006-06-27 1449984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-13 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-13 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prec]
C:\Program Files\Prec\PrecStarter.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [2002-04-11 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe [2008-08-04 36352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Chabra^Menu Start^Programy^Autostart^HotKey.lnk]
C:\Documents and Settings\Chabra\Dane aplikacji\Microsoft\Installer\{ABE5B51A-5B5C-4FE9-B1D7-62DF3842231A}\_4BE6278911E4_4DD2_AFD0_BBF0F77C7FA9.exe  []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-08 133632]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Ares\Ares.exe"="C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows"
"D:\Gry\CS\Valve\hl.exe"="D:\Gry\CS\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Gry\CS\Valve\hlds.exe"="D:\Gry\CS\Valve\hlds.exe:*:Enabled:HLDS Launcher"
"C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\Program Files\BearShare\BearShare.exe"="C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare"
"D:\Gry\iSRO\SilkErrSender.exe"="D:\Gry\iSRO\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"
"E:\CSS\hl2.exe"="E:\CSS\hl2.exe:*:Enabled:hl2"
"D:\Gry\MHTC\SilkErrSender.exe"="D:\Gry\MHTC\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"D:\Gry\Counter Strike\hl.exe"="D:\Gry\Counter Strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Counter-Strike 1.6 V35\hl.exe"="C:\Program Files\Counter-Strike 1.6 V35\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Gry\CS\hl.exe"="D:\Gry\CS\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Soldat\Soldat.exe"="C:\Soldat\Soldat.exe:*:Enabled:Soldat"
"C:\Program Files\Nowe Gadu-Gadu\gg.exe"="C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu"
"D:\Gry\NetDevilSREmu-SilkroadMax.com\NetDevil - Sro-Pro SRO Server v1.185.exe"="D:\Gry\NetDevilSREmu-SilkroadMax.com\NetDevil - Sro-Pro SRO Server v1.185.exe:*:Enabled:Server"
"D:\NetDevilSREmu-SilkroadMax.com\NetDevil - Sro-Pro SRO Server v1.185.exe"="D:\NetDevilSREmu-SilkroadMax.com\NetDevil - Sro-Pro SRO Server v1.185.exe:*:Enabled:Server"
"D:\Silkroad\SilkErrSender.exe"="D:\Silkroad\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"C:\Documents and Settings\Chabra\Pulpit\D-SREMU v2.exe"="C:\Documents and Settings\Chabra\Pulpit\D-SREMU v2.exe:*:Enabled:D-SREMU v2"
"D:\Silkroad\D-SREMU v2.exe"="D:\Silkroad\D-SREMU v2.exe:*:Enabled:D-SREMU v2"
"C:\Documents and Settings\Chabra\Pulpit\Venice Emulator v. 2.0\EMULATOR\World\[V]World.exe"="C:\Documents and Settings\Chabra\Pulpit\Venice Emulator v. 2.0\EMULATOR\World\[V]World.exe:*:Enabled:[V]World"
"C:\Documents and Settings\Chabra\Pulpit\x\D-SREMU v2.exe"="C:\Documents and Settings\Chabra\Pulpit\x\D-SREMU v2.exe:*:Enabled:D-SREMU v2"
"D:\Gry\Soldat\Soldat.exe"="D:\Gry\Soldat\Soldat.exe:*:Enabled:Soldat"
"C:\Program Files\Java\jre1.6.0_07\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre1.6.0_07\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"D:\Gry\CS\hlds.exe"="D:\Gry\CS\hlds.exe:*:Enabled:HLDS Launcher"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Uruchamia plik DLL jako aplikację"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 3 months======

2009-05-15 16:18:41 ----D---- C:\Program Files\trend micro
2009-05-15 16:18:39 ----D---- C:\rsit
2009-05-05 16:36:34 ----D---- C:\WINDOWS\LastGood.Tmp
2009-04-23 11:20:26 ----D---- C:\Documents and Settings\Chabra\Dane aplikacji\OpenFM
2009-04-22 18:36:15 ----D---- C:\Documents and Settings\Chabra\Dane aplikacji\Hamachi
2009-04-22 18:34:35 ----D---- C:\Program Files\Hamachi
2009-04-17 14:18:21 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-04-17 14:18:10 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-04-17 14:15:01 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-04-17 14:14:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-04-17 14:14:33 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-04-17 14:14:17 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-04-15 00:09:23 ----D---- C:\WINDOWS\system32\KB905474
2009-04-13 13:48:47 ----RSH---- C:\WINDOWS\system32\admparsew.exe
2009-04-09 17:29:18 ----A---- C:\WINDOWS\WORDPAD.INI
2009-04-01 21:34:51 ----D---- C:\Program Files\Opera
2009-03-31 19:45:24 ----D---- C:\Documents and Settings\Chabra\Dane aplikacji\id Software
2009-03-31 19:12:35 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2009-03-31 19:12:31 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2009-03-31 19:12:28 ----D---- C:\WINDOWS\system32\LogFiles
2009-03-31 19:12:28 ----A---- C:\WINDOWS\system32\pbsvc.exe
2009-03-31 19:12:24 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\id Software
2009-03-11 22:19:46 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-03-11 22:19:36 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-03-11 22:19:27 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-03-11 22:19:13 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-03-10 21:39:39 ----D---- C:\Program Files\SopCast
2009-03-07 14:54:14 ----D---- C:\Documents and Settings\Chabra\Dane aplikacji\WinRAR
2009-03-03 15:26:08 ----D---- C:\Program Files\Common Files\Borland Shared
2009-03-03 15:26:06 ----D---- C:\Program Files\Borland
2009-03-01 22:22:42 ----D---- C:\WINDOWS\SxsCaPendDel
2009-02-25 16:34:49 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-02-24 19:33:01 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-02-24 19:32:33 ----D---- C:\WINDOWS\system32\ko-KR
2009-02-24 19:26:43 ----D---- C:\Program Files\MSBuild
2009-02-24 19:26:36 ----D---- C:\WINDOWS\system32\XPSViewer
2009-02-24 19:26:28 ----D---- C:\WINDOWS\system32\en-us
2009-02-24 19:26:27 ----D---- C:\Program Files\Reference Assemblies
2009-02-24 19:25:36 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-02-22 18:20:43 ----D---- C:\Program Files\Nowe Gadu-Gadu
2009-02-18 17:50:58 ----D---- C:\Documents and Settings\Chabra\Dane aplikacji\Soldat

======List of files/folders modified in the last 3 months======

2009-05-15 16:19:23 ----D---- C:\WINDOWS\Temp
2009-05-15 16:19:08 ----D---- C:\WINDOWS\Prefetch
2009-05-15 16:18:41 ----RD---- C:\Program Files
2009-05-15 16:04:15 ----D---- C:\Program Files\Mozilla Firefox
2009-05-15 15:11:05 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-05-15 12:39:20 ----A---- C:\WINDOWS\NeroDigital.ini
2009-05-14 12:44:28 ----D---- C:\WINDOWS\system32\CatRoot2
2009-05-11 20:23:36 ----D---- C:\Documents and Settings\Chabra\Dane aplikacji\GanymedeNet
2009-05-06 17:39:48 ----D---- C:\WINDOWS\system32\drivers
2009-05-05 16:40:06 ----D---- C:\WINDOWS
2009-05-05 16:36:39 ----RSD---- C:\WINDOWS\Fonts
2009-05-05 16:36:39 ----A---- C:\WINDOWS\system.ini
2009-05-03 12:03:54 ----D---- C:\WINDOWS\system32
2009-04-28 22:14:23 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-04-28 21:48:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-04-26 16:41:30 ----A---- C:\WINDOWS\win.ini
2009-04-22 18:34:56 ----HD---- C:\WINDOWS\inf
2009-04-20 12:50:25 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2009-04-17 14:25:54 ----D---- C:\WINDOWS\system32\wbem
2009-04-17 14:25:54 ----D---- C:\WINDOWS\AppPatch
2009-04-17 14:18:16 ----A---- C:\WINDOWS\imsins.BAK
2009-04-17 14:17:48 ----D---- C:\WINDOWS\system32\pl-pl
2009-04-17 14:17:48 ----D---- C:\Program Files\Internet Explorer
2009-04-17 14:14:58 ----HD---- C:\WINDOWS\$hf_mig$
2009-04-15 00:09:23 ----SD---- C:\WINDOWS\Tasks
2009-04-06 16:57:24 ----A---- C:\WINDOWS\system32\MRT.exe
2009-04-06 14:59:18 ----SHD---- C:\WINDOWS\Installer
2009-04-03 17:13:22 ----D---- C:\Program Files\Ganymede
2009-03-21 16:08:59 ----A---- C:\WINDOWS\system32\kernel32.dll
2009-03-17 00:06:33 ----D---- C:\My Downloads
2009-03-11 16:01:12 ----SH---- C:\boot.ini
2009-03-08 22:25:39 ----D---- C:\Documents and Settings\Chabra\Dane aplikacji\Datalayer
2009-03-08 22:20:10 ----A---- C:\WINDOWS\ModemLog_Motorola USB Modem.txt
2009-03-06 16:22:12 ----A---- C:\WINDOWS\system32\pdh.dll
2009-03-03 16:27:59 ----SD---- C:\Documents and Settings\Chabra\Dane aplikacji\Microsoft
2009-03-03 15:26:08 ----D---- C:\Program Files\Common Files
2009-03-03 02:10:10 ----A---- C:\WINDOWS\system32\wininet.dll
2009-03-02 15:54:02 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-03-02 15:54:01 ----D---- C:\WINDOWS\WinSxS
2009-03-01 22:10:29 ----D---- C:\WINDOWS\system32\Restore
2009-03-01 21:35:10 ----D---- C:\Program Files\Windows Media Connect 2
2009-02-28 23:06:31 ----D---- C:\WINDOWS\Microsoft.NET
2009-02-28 19:56:24 ----D---- C:\WINDOWS\system32\CatRoot
2009-02-28 19:54:01 ----RSD---- C:\WINDOWS\assembly
2009-02-24 19:33:59 ----D---- C:\WINDOWS\system32\mui
2009-02-24 19:25:48 ----D---- C:\WINDOWS\system32\spool
2009-02-20 19:13:29 ----A---- C:\WINDOWS\system32\webcheck.dll
2009-02-20 19:13:29 ----A---- C:\WINDOWS\system32\urlmon.dll
2009-02-20 19:13:29 ----A---- C:\WINDOWS\system32\ieencode.dll
2009-02-20 19:13:28 ----A---- C:\WINDOWS\system32\url.dll
2009-02-20 19:13:28 ----A---- C:\WINDOWS\system32\pngfilt.dll
2009-02-20 19:13:28 ----A---- C:\WINDOWS\system32\occache.dll
2009-02-20 19:13:28 ----A---- C:\WINDOWS\system32\mstime.dll
2009-02-20 19:13:28 ----A---- C:\WINDOWS\system32\msrating.dll
2009-02-20 19:13:27 ----A---- C:\WINDOWS\system32\mshtmled.dll
2009-02-20 19:13:27 ----A---- C:\WINDOWS\system32\mshtml.dll
2009-02-20 19:13:25 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
2009-02-20 19:13:25 ----A---- C:\WINDOWS\system32\msfeeds.dll
2009-02-20 19:13:25 ----A---- C:\WINDOWS\system32\jsproxy.dll
2009-02-20 19:13:24 ----A---- C:\WINDOWS\system32\iertutil.dll
2009-02-20 19:13:24 ----A---- C:\WINDOWS\system32\iernonce.dll
2009-02-20 19:13:23 ----A---- C:\WINDOWS\system32\ieframe.dll
2009-02-20 19:13:21 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2009-02-20 19:13:21 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2009-02-20 19:13:21 ----A---- C:\WINDOWS\system32\ieaksie.dll
2009-02-20 19:13:21 ----A---- C:\WINDOWS\system32\ieakeng.dll
2009-02-20 19:13:20 ----A---- C:\WINDOWS\system32\icardie.dll
2009-02-20 19:13:20 ----A---- C:\WINDOWS\system32\extmgr.dll
2009-02-20 19:13:20 ----A---- C:\WINDOWS\system32\dxtrans.dll
2009-02-20 19:13:20 ----A---- C:\WINDOWS\system32\dxtmsft.dll
2009-02-20 19:13:20 ----A---- C:\WINDOWS\system32\advpack.dll
2009-02-20 12:20:49 ----A---- C:\WINDOWS\system32\ieudinit.exe
2009-02-20 12:20:49 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2009-02-20 07:14:12 ----A---- C:\WINDOWS\system32\ieakui.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2008-10-04 82380]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-03-13 29704]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 33800]
R1 FsVga;FsVga; C:\WINDOWS\system32\DRIVERS\fsvga.sys [2001-10-26 12288]
R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-03-13 40456]
R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\WINDOWS\system32\DRIVERS\alcan5wn.sys [2003-12-08 53600]
R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport; C:\WINDOWS\system32\DRIVERS\alcaudsl.sys [2003-12-08 70688]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-01-25 4027456]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-04-22 25280]
R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-03 6554496]
R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 a8404m44;a8404m44; C:\WINDOWS\system32\drivers\a8404m44.sys []
S3 motmodem;Motorola USB CDC ACM Driver; C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 23680]
S3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
S3 nm;Sterownik monitora sieci; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-14 40320]
S3 nocashio;nocashio; C:\WINDOWS\system32\drivers\nocashio.sys [2009-05-06 4096]
S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-05-29 8704]
S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-05-29 13312]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-05-29 127488]
S3 Nokia USB Port;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2006-05-29 13312]
S3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-05-08 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-05-08 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-03-13 472320]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-03 159812]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-04-01 75064]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\WINDOWS\system32\regedt32.exe [2001-10-26 3584]
S2 SwPrvRemoteAccess;MS Software Shadow Copy Provider SwPrvRemoteAccess; C:\WINDOWS\system32\admparsew.exe [2009-04-13 54272]
S3 aspnet_state;Usuga stanu ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2008-03-13 19200]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe [2006-06-05 174080]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------


[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z OTListIt2

[Chaber*]

Poblokowałem te porty nie wiem czy dobrze. Wygląda to tak:
http://img51.imageshack.us/my.php?image=58634991.jpg

Report.txt

Kod: Zaznacz wszystko

[b]SDFix: Version 1.240 [/b]
Run by Chabra on 2009-05-15 at 20:00

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\Temp\loader.exe - Deleted





Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-15 20:07:35
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:bf,46,2c,0a,2b,ac,e8,1c,a1,8e,f6,ab,5f,27,cc,8a,70,46,40,b9,e9,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,3e,93,f7,40,36,9d,cb,cb,e2,bb,0b,78,be,02,8f,a3,b0,..
"khjeh"=hex:60,31,7e,b7,cd,5e,a7,e0,1d,cf,ef,be,34,e8,0e,c4,b2,c1,c2,12,81,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:3e,d9,e8,fc,38,87,b0,c3,bb,1f,35,f8,08,cc,80,0e,53,b5,91,f5,a8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:bf,46,2c,0a,2b,ac,e8,1c,a1,8e,f6,ab,5f,27,cc,8a,70,46,40,b9,e9,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,3e,93,f7,40,36,9d,cb,cb,e2,bb,0b,78,be,02,8f,a3,b0,..
"khjeh"=hex:60,31,7e,b7,cd,5e,a7,e0,1d,cf,ef,be,34,e8,0e,c4,b2,c1,c2,12,81,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:3e,d9,e8,fc,38,87,b0,c3,bb,1f,35,f8,08,cc,80,0e,53,b5,91,f5,a8,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"D:\\Gry\\CS\\Valve\\hl.exe"="D:\\Gry\\CS\\Valve\\hl.exe:*:Enabled:Half-Life Launcher"
"D:\\Gry\\CS\\Valve\\hlds.exe"="D:\\Gry\\CS\\Valve\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"D:\\Gry\\iSRO\\SilkErrSender.exe"="D:\\Gry\\iSRO\\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java(TM) Platform SE binary"
"E:\\CSS\\hl2.exe"="E:\\CSS\\hl2.exe:*:Enabled:hl2"
"D:\\Gry\\MHTC\\SilkErrSender.exe"="D:\\Gry\\MHTC\\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"D:\\Gry\\Counter Strike\\hl.exe"="D:\\Gry\\Counter Strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Counter-Strike 1.6 V35\\hl.exe"="C:\\Program Files\\Counter-Strike 1.6 V35\\hl.exe:*:Enabled:Half-Life Launcher"
"D:\\Gry\\CS\\hl.exe"="D:\\Gry\\CS\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Soldat\\Soldat.exe"="C:\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"="C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe:*:Enabled:Nowe Gadu-Gadu"
"D:\\Gry\\NetDevilSREmu-SilkroadMax.com\\NetDevil - Sro-Pro SRO Server v1.185.exe"="D:\\Gry\\NetDevilSREmu-SilkroadMax.com\\NetDevil - Sro-Pro SRO Server v1.185.exe:*:Enabled:Server"
"D:\\NetDevilSREmu-SilkroadMax.com\\NetDevil - Sro-Pro SRO Server v1.185.exe"="D:\\NetDevilSREmu-SilkroadMax.com\\NetDevil - Sro-Pro SRO Server v1.185.exe:*:Enabled:Server"
"D:\\Silkroad\\SilkErrSender.exe"="D:\\Silkroad\\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"C:\\Documents and Settings\\Chabra\\Pulpit\\D-SREMU v2.exe"="C:\\Documents and Settings\\Chabra\\Pulpit\\D-SREMU v2.exe:*:Enabled:D-SREMU v2"
"D:\\Silkroad\\D-SREMU v2.exe"="D:\\Silkroad\\D-SREMU v2.exe:*:Enabled:D-SREMU v2"
"C:\\Documents and Settings\\Chabra\\Pulpit\\Venice Emulator v. 2.0\\EMULATOR\\World\\[V]World.exe"="C:\\Documents and Settings\\Chabra\\Pulpit\\Venice Emulator v. 2.0\\EMULATOR\\World\\[V]World.exe:*:Enabled:[V]World"
"C:\\Documents and Settings\\Chabra\\Pulpit\\x\\D-SREMU v2.exe"="C:\\Documents and Settings\\Chabra\\Pulpit\\x\\D-SREMU v2.exe:*:Enabled:D-SREMU v2"
"D:\\Gry\\Soldat\\Soldat.exe"="D:\\Gry\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"="C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
"D:\\Gry\\CS\\hlds.exe"="D:\\Gry\\CS\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Uruchamia plik DLL jako aplikacj©"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon  3 Mar 2008           568 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg"
Mon  3 Mar 2008         5,702 A..H. --- "C:\WINDOWS\nod32restoretemdono.reg"
Mon 13 Apr 2009        54,272 ..SHR --- "C:\WINDOWS\system32\admparsew.exe"
Mon 13 Nov 2006       319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"

[b]Finished![/b]

Logi:

Kod: Zaznacz wszystko

OTListIt Extras logfile created on: 2009-05-15 20:19:10 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = C:\Documents and Settings\Chabra\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1023,48 Mb Total Physical Memory | 665,32 Mb Available Physical Memory | 65,01% Memory free
2,40 Gb Paging File | 2,18 Gb Available in Paging File | 90,52% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 17,74 Gb Total Space | 7,93 Gb Free Space | 44,67% Space Free | Partition Type: NTFS
Drive D: | 29,30 Gb Total Space | 4,25 Gb Free Space | 14,51% Space Free | Partition Type: NTFS
Drive E: | 29,27 Gb Total Space | 9,56 Gb Free Space | 32,67% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARCIN-FA7529C6
Current User Name: Chabra
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 90 Days
Company Name Whitelist: On

[color=orange]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[color=orange]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"DisableNotifications" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

[color=orange]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2008-04-14 00:23:34 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2008-04-14 00:23:34 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
File not found -- C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows
File not found -- D:\Gry\CS\Valve\hl.exe:*:Enabled:Half-Life Launcher
File not found -- D:\Gry\CS\Valve\hlds.exe:*:Enabled:HLDS Launcher
[2008-08-18 16:51:01 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny
[2006-08-01 17:04:46 | 03,313,664 | ---- | M] (Free Peers, Inc.) -- C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare
File not found -- D:\Gry\iSRO\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????
[2008-06-10 01:21:01 | 00,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary
[2006-08-26 13:01:22 | 00,106,496 | ---- | M] () -- E:\CSS\hl2.exe:*:Enabled:hl2
[2007-08-29 15:38:52 | 00,139,264 | ---- | M] () -- D:\Gry\MHTC\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????
File not found -- D:\Gry\Counter Strike\hl.exe:*:Enabled:Half-Life Launcher
File not found -- C:\Program Files\Counter-Strike 1.6 V35\hl.exe:*:Enabled:Half-Life Launcher
[2005-09-30 03:42:57 | 00,081,920 | ---- | M] (Valve) -- D:\Gry\CS\hl.exe:*:Enabled:Half-Life Launcher
File not found -- C:\Soldat\Soldat.exe:*:Enabled:Soldat
[2009-04-20 16:56:20 | 09,818,728 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu
File not found -- D:\Gry\NetDevilSREmu-SilkroadMax.com\NetDevil - Sro-Pro SRO Server v1.185.exe:*:Enabled:Server
File not found -- D:\NetDevilSREmu-SilkroadMax.com\NetDevil - Sro-Pro SRO Server v1.185.exe:*:Enabled:Server
File not found -- D:\Silkroad\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????
File not found -- C:\Documents and Settings\Chabra\Pulpit\D-SREMU v2.exe:*:Enabled:D-SREMU v2
File not found -- D:\Silkroad\D-SREMU v2.exe:*:Enabled:D-SREMU v2
File not found -- C:\Documents and Settings\Chabra\Pulpit\Venice Emulator v. 2.0\EMULATOR\World\[V]World.exe:*:Enabled:[V]World
File not found -- C:\Documents and Settings\Chabra\Pulpit\x\D-SREMU v2.exe:*:Enabled:D-SREMU v2
[2007-08-10 22:32:50 | 00,678,400 | ---- | M] (Michal Marcinkowski) -- D:\Gry\Soldat\Soldat.exe:*:Enabled:Soldat
[2008-06-10 01:21:04 | 00,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_07\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary
[2007-03-07 12:27:12 | 00,567,384 | ---- | M] (www.sopcast.com) -- C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver
[2008-04-30 10:32:48 | 01,892,352 | ---- | M] (www.sopcast.com) -- C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application
[2005-09-30 03:47:25 | 00,397,312 | ---- | M] (Valve) -- D:\Gry\CS\hlds.exe:*:Enabled:HLDS Launcher
[2009-04-01 12:00:34 | 00,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA
[2009-04-04 19:08:15 | 00,189,784 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB
[2009-04-28 14:01:23 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox
[2008-04-14 22:51:14 | 00,083,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test

[color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01DEC6F3-1BD8-312B-A4A8-230F40D5B776}" = Microsoft .NET Framework 3.5 Language Pack - kor
"{036FD544-AED6-3F33-856D-A2292D0CF471}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - PLK
"{0D80391C-0A72-43BB-9BC2-143F63CC111D}" = Nokia PC Connectivity Solution
"{25EF59B1-5E7B-4510-AF69-44F6575506BB}" = Texas Hold'em Poker 3D - Deluxe Edition
"{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1
"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45BF5088-655E-4BDB-9F63-CDEF3BA74D40}" = ESET NOD32 Antivirus
"{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones
"{531317A5-586A-4E36-87C1-CA823447B375}" = Nokia PC Suite
"{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5
"{590D4F8F-98FE-47FA-AC2B-3F22FDCF7C09}" = ShareIns
"{6882DD11-33B8-4DEA-8305-7E765BF74BD3}" = Nokia Connectivity Cable Driver
"{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7C77393F-8237-3825-A88A-AFAF3C69C072}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - PLK
"{8CADD3F6-E808-4D48-893D-797B4849DE72}" = Quake Live Mozilla Plugin
"{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (Polish) 12
"{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007
"{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007
"{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007
"{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007
"{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007
"{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007
"{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007
"{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007
"{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007
"{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007
"{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}" = Counter-Strike 1.6
"{A6F11BA2-8754-3608-8EA1-7F56542F9CE2}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - KOR
"{AC76BA86-7AD7-1038-7B44-CEA000000001}" = Adobe Reader 6.0.2 CE
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B8E952E3-A823-443A-8493-39A0CCE0E3EB}" = HP Photo and Imaging 1.0 - Scanjet 3500c Series
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}" = SpeedTouch USB Software
"{D6A1E429-CCE1-4140-A615-710B806D12BA}" = Motorola Driver Installation 3.2.0
"{D9C18AD1-786A-302D-8E3C-5CBB34AD9BBE}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - KOR
"{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt
"{F31E509D-3597-324E-83CF-0C160B2320F0}" = Microsoft .NET Framework 3.5 Language Pack - plk
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl
"3271E907F27C989F2C244ACB3D32020E3DD3CA6F" = Windows Driver Package - Nokia Modem  (06/12/2006 6.81.0.21)
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"BearShare" = BearShare
"Counter-Strike: Source v17" = Counter-Strike: Source v17
"CWK" = CWK (Czasowy Wył?cznik Komputera)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Eset NOD32 v3.0.642 FiX1.2 by TemDono_is1" = NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up
"Gadu-Gadu" = Gadu-Gadu 7.7
"GameDesire-Poker" = GameDesire-Poker
"GameDesire-Pool & Snooker" = GameDesire-Pool & Snooker
"Hamachi" = Hamachi 1.0.3.0
"hijackthis" = HijackThis 2.0.2
"hp deskjet 3820 series" = hp deskjet 3820 series (Tylko usuń)
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.1.7 (Full)
"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5
"Microsoft .NET Framework 3.5 Language Pack - kor" = Microsoft .NET Framework 3.5 언어 팩 - 한국어
"Microsoft .NET Framework 3.5 Language Pack - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 — PLK
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"Mp3 Knife_is1" = Mp3 Knife 3.2
"Nero8Lite_is1" = Nero 8 Micro 8.1.1.4
"Nowe Gadu-Gadu" = Nowe Gadu-Gadu
"NVIDIA Drivers" = NVIDIA Drivers
"PunkBusterSvc" = PunkBuster Services
"RealAlt_is1" = Real Alternative 1.8.2
"Soldat_is1" = Soldat 1.4.2
"SopCast" = SopCast 3.0.3
"SubEdit-Player_is1" = SubEdit-Player
"Tasker_is1" = Tasker version 3.13
"Totalcmd" = Total Commander (Remove or Repair)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Winamp" = Winamp
"WinRAR archiver" = Archiwizator WinRAR
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

[color=orange]========== Last 10 Event Log Errors ==========[/color]

[ Application Events ]
Error - 2009-03-22 14:50:26 | Computer Name = MARCIN-FA7529C6 | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca Project1.exe, wersja 0.0.0.0, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Error - 2009-03-30 10:11:06 | Computer Name = MARCIN-FA7529C6 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd sro_client.exe, wersja 0.0.0.0, moduł powodujący
błąd kernel32.dll, wersja 5.1.2600.5512, adres błędu 0x00012aeb.

Error - 2009-04-02 04:03:05 | Computer Name = MARCIN-FA7529C6 | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca opera.exe, wersja 9.64.10487.0, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Error - 2009-04-07 09:54:20 | Computer Name = MARCIN-FA7529C6 | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca hpqthb08.exe, wersja 1.1.0.0, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Error - 2009-04-07 10:01:06 | Computer Name = MARCIN-FA7529C6 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd hpqthb08.exe, wersja 1.1.0.0, moduł powodujący
błąd hpqthb08.exe, wersja 1.1.0.0, adres błędu 0x00028ce3.

Error - 2009-04-07 10:41:39 | Computer Name = MARCIN-FA7529C6 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd hl.exe, wersja 1.1.1.1, moduł powodujący
błąd ntdll.dll, wersja 5.1.2600.5512, adres błędu 0x000100c8.

Error - 2009-04-07 10:41:41 | Computer Name = MARCIN-FA7529C6 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd hl.exe, wersja 1.1.1.1, moduł powodujący
błąd ntdll.dll, wersja 5.1.2600.5512, adres błędu 0x0001b1fa.

Error - 2009-04-07 15:52:51 | Computer Name = MARCIN-FA7529C6 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd sopcast.exe, wersja 3.0.3.501, moduł powodujący
błąd ntdll.dll, wersja 5.1.2600.5512, adres błędu 0x000109f9.

Error - 2009-04-13 08:02:16 | Computer Name = MARCIN-FA7529C6 | Source = Userenv | ID = 1068
Description = System Windows zakończył przetwarzanie obiektu GPO, ponieważ komputer
został zamknięty lub użytkownik wylogował się.

Error - 2009-04-15 08:15:01 | Computer Name = MARCIN-FA7529C6 | Source = Application Error | ID = 1000
Description = Aplikacja powodująca błąd hl2.exe, wersja 0.0.0.0, moduł powodujący
błąd datacache.dll, wersja 0.0.0.0, adres błędu 0x0000b413.

[ System Events ]
Error - 2009-05-15 14:07:20 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7001
Description = Usługa Usługi IPSEC zależy od usługi Sterownik IPSEC, której nie można
uruchomić z powodu następującego błędu:   %%31

Error - 2009-05-15 14:07:20 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7026
Description = Nie można załadować następujących sterowników startu rozruchowego
lub systemowego:   AFD  easdrv  epfwtdir  Fips  IPSec  MRxSmb  NetBIOS  NetBT  Processor  RasAcd  Rdbss
Tcpip

Error - 2009-05-15 14:11:03 | Computer Name = MARCIN-FA7529C6 | Source = DCOM | ID = 10005
Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi
netman z argumentami „”  w celu uruchomienia serwera:  {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 2009-05-15 14:11:42 | Computer Name = MARCIN-FA7529C6 | Source = DCOM | ID = 10005
Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi
EventSystem z argumentami „”  w celu uruchomienia serwera:  {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2009-05-15 14:13:17 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą Eset Nod32 Boot.

Error - 2009-05-15 14:13:17 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Eset Nod32 Boot z powodu następującego
błędu:   %%1053

Error - 2009-05-15 14:13:17 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego
błędu:   %%2

Error - 2009-05-15 14:16:30 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą Eset Nod32 Boot.

Error - 2009-05-15 14:16:30 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Eset Nod32 Boot z powodu następującego
błędu:   %%1053

Error - 2009-05-15 14:16:30 | Computer Name = MARCIN-FA7529C6 | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Aktualizacje automatyczne z powodu następującego
błędu:   %%2


< End of report >

http://www.wklej.org/id/91126/

Problem jak był tak jest...

[wojtas]

Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - Reg Error: Key error. File not found
O29 - HKLM SecurityProviders - (digiwet.dll) - File not found

:Files
C:\WINDOWS\System32\admparsew.exe
C:\WINDOWS\System32\3423876866.dat

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTListIt2 z opcją Run Scan. Pokazujesz nowy log OTListIt.txt (czyszczenie i skan )