Prosze o sprwdzenie loga,mam jakiegos WORMA

Bor4t · 30 Marzec 2007 05:49

Oto log z Hijackthis :

Logfile of HijackThis v1.99.1 Scan saved at 07:49:35, on 2007-03-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\AntiVir PersonalEdition Classic\sched.exe D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe D:\WINDOWS\System32\nvsvc32.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\System32\RUNDLL32.EXE D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe D:\Program Files\Logitech\MouseWare\system\em_exec.exe D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe D:\Program Files\QuickTime\qttask.exe D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe D:\WINDOWS\System32\ctfmon.exe D:\Program Files\Tlen.pl\tlen.exe D:\Program Files\Netia\Net\netianet.exe D:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe D:\Program Files\Common Files\Teleca Shared\Generic.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Documents and Settings\łuki\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - D:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM…\Run: [sigmatelSysTrayApp] sttray.exe O4 - HKLM…\Run: [avgnt] “D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min O4 - HKLM…\Run: [speedTouch USB Diagnostics] “D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [intelAudioStudio] “D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe” BOOT O4 - HKLM…\Run: [sony Ericsson PC Suite] “D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions O4 - HKLM…\Run: [QuickTime Task] “D:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [Adobe Photo Downloader] “D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” O4 - HKCU…\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Komunikator] D:\Program Files\Tlen.pl\tlen.exe O4 - HKCU…\Run: [NETIANET] D:\Program Files\Netia\Net\netianet.exe O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://*.mks.com.pl O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus … nicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O17 - HKLM\System\CCS\Services\Tcpip…{D854A014-E2E1-4902-9D76-445C1D237530}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

Joan · 30 Marzec 2007 06:49

log jest czysty

Bor4t · 30 Marzec 2007 06:53

Bo widzisz, co jakis czas wykrywa mi WORMA mój antivirguard. Po czym okienka stają się “twarde” i musze zrobić reset.

Joan · 30 Marzec 2007 06:59

dlatego usunęłam avirę

daj loga z Silenta

Bor4t · 30 Marzec 2007 07:03

Złączono Posta : 30.03.2007 (Pią) 9:05

Co do WORMA- jeden z nich jest w d://WINDOWS\system32.exe

a nazwa to WORM//Allaple.Gen

Joan · 30 Marzec 2007 07:07

O problemach z Silentem poczytaj tutaj -> KLIK

Bor4t · 30 Marzec 2007 07:24

Zrobiłem to co trzeba ,mianowicie :

Komunikat świadczy iż WMI definitywnie nie działa w sposób poprawny gdyż nawet nie potrafi rozpoznać systemu operacyjnego. Rozwiązanie nie będzie na dłoni. Należy ściągnąć WMI Diagnosis Utility, wypakować i uruchomić WMIDiag.vbs. Działanie narzędzie jest prawie niewidoczne lecz czekać cierpliwie. Ukończenie jego pracy będzie obwieszczone podsumowującym komunikatem i samootwarciem loga. Tego loga należy pokazać do analizy.

Ale program, który ściągnąłem nie generuje żadnego loga. Naciskam Yes i nic się nie dzieje.

Jest inne wyjście ?

Złączono Posta : 30.03.2007 (Pią) 9:25

Coś mam

“Silent Runners.vbs”, revision RED (R28) (Echo output), launched at: 09:25 Operating System: Windows XP Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “CTFMON.EXE” = “D:\WINDOWS\System32\ctfmon.exe” [(path error)] “Komunikator” = “D:\Program Files\Tlen.pl\tlen.exe” [(path error)] “NETIANET” = “D:\Program Files\Netia\Net\netianet.exe” [(path error)] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “NvCplDaemon” = “RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup” [(path error)] “nwiz” = “nwiz.exe /install” [(path error)] “NvMediaCenter” = “RunDLL32.exe NvMCTray.dll,NvTaskbarInit” [(path error)] “Logitech Utility” = “Logi_MwX.Exe” [(path error)] “SigmatelSysTrayApp” = “sttray.exe” [file not found] “avgnt” = ““D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min” [(path error)] “SpeedTouch USB Diagnostics” = ““D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [(path error)] “IntelAudioStudio” = ““D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe” BOOT” [(path error)] “Default” = “” [(file not found)] “Sony Ericsson PC Suite” = ““D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions” [(path error)] “QuickTime Task” = ““D:\Program Files\QuickTime\qttask.exe” -atboottime” [(path error)] “Adobe Photo Downloader” = ““D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”” [(path error)] HKLM\Software\Microsoft\Active Setup\Installed Components\ “>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}(Default)” = “Microsoft Windows Media Player” \StubPath = “D:\WINDOWS\inf\unregmp2.exe /ShowWMP” [(path error)] “{306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default)” = “” \StubPath = ““D:\WINDOWS\System32\rundll32.exe” “D:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [(path error)] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” -> resolves to: {CLSID}\InprocServer32(Default) = “C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx” [(path error)] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “PostBootReminder” = “{7849596a-48ea-486e-8937-a2a3009f31a9}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\system32\SHELL32.dll” [(path error)] “CDBurn” = “{fbeb8a05-beee-4442-804e-409d6c4515e9}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\system32\SHELL32.dll” [(path error)] “WebCheck” = “{E6FB5E20-DE35-11CF-9C87-00AA005127ED}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\System32\webcheck.dll” [(path error)] “SysTray” = “{35CEC8A3-2BE6-11D2-8773-92E220524153}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\System32\stobject.dll” [(path error)] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------

Joan · 30 Marzec 2007 07:36

urwany, poczekaj aż skończy pracę

Bor4t · 30 Marzec 2007 07:38

FULL

17013 09:27:01 (0) ** WMIDiag v2.0 started on 30 marca 2007 at 09:20. 17014 09:27:01 (0) ** 17015 09:27:01 (0) ** Copyright © Microsoft Corporation. All rights reserved - January 2007. 17016 09:27:01 (0) ** 17017 09:27:01 (0) ** This script is not supported under any Microsoft standard support program or service. 17018 09:27:01 (0) ** The script is provided AS IS without warranty of any kind. Microsoft further disclaims all 17019 09:27:01 (0) ** implied warranties including, without limitation, any implied warranties of merchantability 17020 09:27:01 (0) ** or of fitness for a particular purpose. The entire risk arising out of the use or performance 17021 09:27:01 (0) ** of the scripts and documentation remains with you. In no event shall Microsoft, its authors, 17022 09:27:01 (0) ** or anyone else involved in the creation, production, or delivery of the script be liable for 17023 09:27:01 (0) ** any damages whatsoever (including, without limitation, damages for loss of business profits, 17024 09:27:01 (0) ** business interruption, loss of business information, or other pecuniary loss) arising out of 17025 09:27:01 (0) ** the use of or inability to use the script or documentation, even if Microsoft has been advised 17026 09:27:01 (0) ** of the possibility of such damages. 17027 09:27:01 (0) ** 17028 09:27:01 (0) ** 17029 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17030 09:27:01 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ---------------------------------------------------------- 17031 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17032 09:27:01 (0) ** 17033 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17034 09:27:01 (0) ** Windows XP - No service pack - 32-bit (2600) - User ‘K1\ŁUKI’ on computer ‘K1’. 17035 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17036 09:27:01 (0) ** Environment: … OK… 17037 09:27:01 (0) ** There are no missing WMI system files: … OK. 17038 09:27:01 (0) ** There are no missing WMI repository files: … OK. 17039 09:27:01 (0) ** WMI repository state: … N/A. 17040 09:27:01 (0) ** BEFORE running WMIDiag: 17041 09:27:01 (0) ** The WMI repository has a size of: … 11 MB. 17042 09:27:01 (0) ** - Disk free space on ‘D:’: … 1167 MB. 17043 09:27:01 (0) ** - INDEX.BTR, 1540096 bytes, 2007-03-30 09:13:26 17044 09:27:01 (0) ** - INDEX.MAP, 776 bytes, 2007-03-30 09:13:40 17045 09:27:01 (0) ** - OBJECTS.DATA, 9469952 bytes, 2007-03-30 09:13:26 17046 09:27:01 (0) ** - OBJECTS.MAP, 4648 bytes, 2007-03-30 09:13:40 17047 09:27:01 (0) ** AFTER running WMIDiag: 17048 09:27:01 (0) ** The WMI repository has a size of: … 11 MB. 17049 09:27:01 (0) ** - Disk free space on ‘D:’: … 1196 MB. 17050 09:27:01 (0) ** - INDEX.BTR, 1540096 bytes, 2007-03-30 09:13:26 17051 09:27:01 (0) ** - INDEX.MAP, 776 bytes, 2007-03-30 09:13:40 17052 09:27:01 (0) ** - OBJECTS.DATA, 9469952 bytes, 2007-03-30 09:13:26 17053 09:27:01 (0) ** - OBJECTS.MAP, 4648 bytes, 2007-03-30 09:13:40 17054 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17055 09:27:01 (0) ** Windows Firewall: … NOT INSTALLED. 17056 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17057 09:27:01 (1) ERROR: DCOM Status: … ERROR! 17058 09:27:01 (1) ERROR: = The DCOM configuration on this computer is DISABLED. 17059 09:27:01 (0) ** This prevents WMI to work correctly. 17060 09:27:01 (0) ** You can fix the DCOM configuration by: 17061 09:27:01 (0) ** - Executing the ‘DCOMCNFG.EXE’ command. 17062 09:27:01 (0) ** - Expanding ‘Component Services’ and ‘Computers’ nodes. 17063 09:27:01 (0) ** - Editing properties of ‘My Computer’ node. 17064 09:27:01 (0) ** - Editing the ‘Default properties’ tab. 17065 09:27:01 (0) ** - Activate the ‘Enable Distributed COM on this computer’ checkbox. 17066 09:27:01 (0) ** From the command line, the DCOM configuration can be corrected with the following command: 17067 09:27:01 (0) ** i.e. ‘REG.EXE Add HKLM\SOFTWARE\Microsoft\Ole /v EnableDCOM /t REG_SZ /d Y /f’ 17068 09:27:01 (0) ** 17069 09:27:01 (0) ** WMI registry setup: … OK. 17070 09:27:01 (0) ** WMI Service has no dependents: … OK. 17071 09:27:01 (0) ** RPCSS service: … OK (Already started). 17072 09:27:01 (0) ** WINMGMT service: … OK (Already started). 17073 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17074 09:27:01 (0) ** WMI service DCOM setup: … OK. 17075 09:27:01 (0) ** WMI components DCOM registrations: … OK. 17076 09:27:01 (0) ** WMI ProgID registrations: … OK. 17077 09:27:01 (0) ** WMI provider DCOM registrations: … OK. 17078 09:27:01 (0) ** WMI provider CIM registrations: … OK. 17079 09:27:01 (0) ** WMI provider CLSIDs: … OK. 17080 09:27:01 (0) ** WMI providers EXE/DLL availability: … OK. 17081 09:27:01 (0) ** ---------------------------------------------------------------------------------------------------------------------------------- 17082 09:27:01 (0) ** DCOM security for ‘My Computer’ (Launch Activation Permissions/Edit Default): … MODIFIED. 17083 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17084 09:27:01 (0) ** - REMOVED ACE: 17085 09:27:01 (0) ** ACEType: h0 17086 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17087 09:27:01 (0) ** ACEFlags: h0 17088 09:27:01 (0) ** ACEMask: h1 17089 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17090 09:27:01 (0) ** 17091 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17092 09:27:01 (0) ** Removing default security will cause some operations to fail! 17093 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17094 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17095 09:27:01 (0) ** 17096 09:27:01 (0) ** DCOM security for ‘My Computer’ (Launch Activation Permissions/Edit Default): … MODIFIED. 17097 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\INTERACTIVE’ has been REMOVED! 17098 09:27:01 (0) ** - REMOVED ACE: 17099 09:27:01 (0) ** ACEType: h0 17100 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17101 09:27:01 (0) ** ACEFlags: h0 17102 09:27:01 (0) ** ACEMask: h1 17103 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17104 09:27:01 (0) ** 17105 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17106 09:27:01 (0) ** Removing default security will cause some operations to fail! 17107 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17108 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17109 09:27:01 (0) ** 17110 09:27:01 (0) ** DCOM security for ‘My Computer’ (Launch Activation Permissions/Edit Default): … MODIFIED. 17111 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\SYSTEM’ has been REMOVED! 17112 09:27:01 (0) ** - REMOVED ACE: 17113 09:27:01 (0) ** ACEType: h0 17114 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17115 09:27:01 (0) ** ACEFlags: h0 17116 09:27:01 (0) ** ACEMask: h1 17117 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17118 09:27:01 (0) ** 17119 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17120 09:27:01 (0) ** Removing default security will cause some operations to fail! 17121 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17122 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17123 09:27:01 (0) ** 17124 09:27:01 (0) ** DCOM security for ‘Windows Management Instrumentation’ (Launch Activation Permissions): … MODIFIED. 17125 09:27:01 (1) ERROR: Default trustee ‘EVERYONE’ has been REMOVED! 17126 09:27:01 (0) ** - REMOVED ACE: 17127 09:27:01 (0) ** ACEType: h0 17128 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17129 09:27:01 (0) ** ACEFlags: h0 17130 09:27:01 (0) ** ACEMask: h1 17131 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17132 09:27:01 (0) ** 17133 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17134 09:27:01 (0) ** Removing default security will cause some operations to fail! 17135 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17136 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17137 09:27:01 (0) ** 17138 09:27:01 (0) ** DCOM security for ‘Microsoft WMI Provider Subsystem Host’ (Launch Activation Permissions): … MODIFIED. 17139 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17140 09:27:01 (0) ** - REMOVED ACE: 17141 09:27:01 (0) ** ACEType: h0 17142 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17143 09:27:01 (0) ** ACEFlags: h0 17144 09:27:01 (0) ** ACEMask: h1 17145 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17146 09:27:01 (0) ** 17147 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17148 09:27:01 (0) ** Removing default security will cause some operations to fail! 17149 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17150 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17151 09:27:01 (0) ** 17152 09:27:01 (0) ** DCOM security for ‘Microsoft WMI Provider Subsystem Host’ (Launch Activation Permissions): … MODIFIED. 17153 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\INTERACTIVE’ has been REMOVED! 17154 09:27:01 (0) ** - REMOVED ACE: 17155 09:27:01 (0) ** ACEType: h0 17156 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17157 09:27:01 (0) ** ACEFlags: h0 17158 09:27:01 (0) ** ACEMask: h1 17159 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17160 09:27:01 (0) ** 17161 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17162 09:27:01 (0) ** Removing default security will cause some operations to fail! 17163 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17164 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17165 09:27:01 (0) ** 17166 09:27:01 (0) ** DCOM security for ‘Microsoft WMI Provider Subsystem Host’ (Launch Activation Permissions): … MODIFIED. 17167 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\SYSTEM’ has been REMOVED! 17168 09:27:01 (0) ** - REMOVED ACE: 17169 09:27:01 (0) ** ACEType: h0 17170 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17171 09:27:01 (0) ** ACEFlags: h0 17172 09:27:01 (0) ** ACEMask: h1 17173 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17174 09:27:01 (0) ** 17175 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17176 09:27:01 (0) ** Removing default security will cause some operations to fail! 17177 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17178 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17179 09:27:01 (0) ** 17180 09:27:01 (0) ** DCOM security for ‘Microsoft WMI Provider Subsystem Host’ (Launch Activation Permissions): … MODIFIED. 17181 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17182 09:27:01 (0) ** - REMOVED ACE: 17183 09:27:01 (0) ** ACEType: h0 17184 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17185 09:27:01 (0) ** ACEFlags: h0 17186 09:27:01 (0) ** ACEMask: h1 17187 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17188 09:27:01 (0) ** 17189 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17190 09:27:01 (0) ** Removing default security will cause some operations to fail! 17191 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17192 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17193 09:27:01 (0) ** 17194 09:27:01 (0) ** DCOM security for ‘Microsoft WMI Provider Subsystem Host’ (Launch Activation Permissions): … MODIFIED. 17195 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17196 09:27:01 (0) ** - REMOVED ACE: 17197 09:27:01 (0) ** ACEType: h0 17198 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17199 09:27:01 (0) ** ACEFlags: h0 17200 09:27:01 (0) ** ACEMask: h1 17201 09:27:01 (0) ** DCOM_RIGHT_EXECUTE 17202 09:27:01 (0) ** 17203 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17204 09:27:01 (0) ** Removing default security will cause some operations to fail! 17205 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17206 09:27:01 (0) ** For DCOM objects, this can be done with ‘DCOMCNFG.EXE’. 17207 09:27:01 (0) ** 17208 09:27:01 (0) ** WMI namespace security for ‘Root’: … MODIFIED. 17209 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17210 09:27:01 (0) ** - REMOVED ACE: 17211 09:27:01 (0) ** ACEType: h0 17212 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17213 09:27:01 (0) ** ACEFlags: h12 17214 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17215 09:27:01 (0) ** INHERITED_ACE 17216 09:27:01 (0) ** ACEMask: h6003F 17217 09:27:01 (0) ** WBEM_ENABLE 17218 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17219 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17220 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17221 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17222 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17223 09:27:01 (0) ** WBEM_WRITE_DAC 17224 09:27:01 (0) ** WBEM_READ_CONTROL 17225 09:27:01 (0) ** 17226 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17227 09:27:01 (0) ** Removing default security will cause some operations to fail! 17228 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17229 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17230 09:27:01 (0) ** 17231 09:27:01 (0) ** WMI namespace security for ‘Root’: … MODIFIED. 17232 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17233 09:27:01 (0) ** - REMOVED ACE: 17234 09:27:01 (0) ** ACEType: h0 17235 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17236 09:27:01 (0) ** ACEFlags: h12 17237 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17238 09:27:01 (0) ** INHERITED_ACE 17239 09:27:01 (0) ** ACEMask: h13 17240 09:27:01 (0) ** WBEM_ENABLE 17241 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17242 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17243 09:27:01 (0) ** 17244 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17245 09:27:01 (0) ** Removing default security will cause some operations to fail! 17246 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17247 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17248 09:27:01 (0) ** 17249 09:27:01 (0) ** WMI namespace security for ‘Root’: … MODIFIED. 17250 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17251 09:27:01 (0) ** - REMOVED ACE: 17252 09:27:01 (0) ** ACEType: h0 17253 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17254 09:27:01 (0) ** ACEFlags: h12 17255 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17256 09:27:01 (0) ** INHERITED_ACE 17257 09:27:01 (0) ** ACEMask: h13 17258 09:27:01 (0) ** WBEM_ENABLE 17259 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17260 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17261 09:27:01 (0) ** 17262 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17263 09:27:01 (0) ** Removing default security will cause some operations to fail! 17264 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17265 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17266 09:27:01 (0) ** 17267 09:27:01 (0) ** WMI namespace security for ‘Root’: … MODIFIED. 17268 09:27:01 (1) ERROR: Default trustee ‘EVERYONE’ has been REMOVED! 17269 09:27:01 (0) ** - REMOVED ACE: 17270 09:27:01 (0) ** ACEType: h0 17271 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17272 09:27:01 (0) ** ACEFlags: h12 17273 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17274 09:27:01 (0) ** INHERITED_ACE 17275 09:27:01 (0) ** ACEMask: h13 17276 09:27:01 (0) ** WBEM_ENABLE 17277 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17278 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17279 09:27:01 (0) ** 17280 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17281 09:27:01 (0) ** Removing default security will cause some operations to fail! 17282 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17283 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17284 09:27:01 (0) ** 17285 09:27:01 (0) ** WMI namespace security for ‘ROOT/SECURITY’: … MODIFIED. 17286 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17287 09:27:01 (0) ** - REMOVED ACE: 17288 09:27:01 (0) ** ACEType: h0 17289 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17290 09:27:01 (0) ** ACEFlags: h12 17291 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17292 09:27:01 (0) ** INHERITED_ACE 17293 09:27:01 (0) ** ACEMask: h6003F 17294 09:27:01 (0) ** WBEM_ENABLE 17295 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17296 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17297 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17298 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17299 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17300 09:27:01 (0) ** WBEM_WRITE_DAC 17301 09:27:01 (0) ** WBEM_READ_CONTROL 17302 09:27:01 (0) ** 17303 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17304 09:27:01 (0) ** Removing default security will cause some operations to fail! 17305 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17306 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17307 09:27:01 (0) ** 17308 09:27:01 (0) ** WMI namespace security for ‘ROOT/SECURITY’: … MODIFIED. 17309 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17310 09:27:01 (0) ** - REMOVED ACE: 17311 09:27:01 (0) ** ACEType: h0 17312 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17313 09:27:01 (0) ** ACEFlags: h12 17314 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17315 09:27:01 (0) ** INHERITED_ACE 17316 09:27:01 (0) ** ACEMask: h13 17317 09:27:01 (0) ** WBEM_ENABLE 17318 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17319 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17320 09:27:01 (0) ** 17321 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17322 09:27:01 (0) ** Removing default security will cause some operations to fail! 17323 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17324 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17325 09:27:01 (0) ** 17326 09:27:01 (0) ** WMI namespace security for ‘ROOT/SECURITY’: … MODIFIED. 17327 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17328 09:27:01 (0) ** - REMOVED ACE: 17329 09:27:01 (0) ** ACEType: h0 17330 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17331 09:27:01 (0) ** ACEFlags: h12 17332 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17333 09:27:01 (0) ** INHERITED_ACE 17334 09:27:01 (0) ** ACEMask: h13 17335 09:27:01 (0) ** WBEM_ENABLE 17336 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17337 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17338 09:27:01 (0) ** 17339 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17340 09:27:01 (0) ** Removing default security will cause some operations to fail! 17341 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17342 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17343 09:27:01 (0) ** 17344 09:27:01 (0) ** WMI namespace security for ‘ROOT/SECURITY’: … MODIFIED. 17345 09:27:01 (1) ERROR: Default trustee ‘EVERYONE’ has been REMOVED! 17346 09:27:01 (0) ** - REMOVED ACE: 17347 09:27:01 (0) ** ACEType: h0 17348 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17349 09:27:01 (0) ** ACEFlags: h12 17350 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17351 09:27:01 (0) ** INHERITED_ACE 17352 09:27:01 (0) ** ACEMask: h13 17353 09:27:01 (0) ** WBEM_ENABLE 17354 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17355 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17356 09:27:01 (0) ** 17357 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17358 09:27:01 (0) ** Removing default security will cause some operations to fail! 17359 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17360 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17361 09:27:01 (0) ** 17362 09:27:01 (0) ** WMI namespace security for ‘ROOT/MSAPPS’: … MODIFIED. 17363 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17364 09:27:01 (0) ** - REMOVED ACE: 17365 09:27:01 (0) ** ACEType: h0 17366 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17367 09:27:01 (0) ** ACEFlags: h12 17368 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17369 09:27:01 (0) ** INHERITED_ACE 17370 09:27:01 (0) ** ACEMask: h6003F 17371 09:27:01 (0) ** WBEM_ENABLE 17372 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17373 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17374 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17375 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17376 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17377 09:27:01 (0) ** WBEM_WRITE_DAC 17378 09:27:01 (0) ** WBEM_READ_CONTROL 17379 09:27:01 (0) ** 17380 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17381 09:27:01 (0) ** Removing default security will cause some operations to fail! 17382 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17383 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17384 09:27:01 (0) ** Note: WMIDiag has no specific knowledge of this WMI namespace. 17385 09:27:01 (0) ** The security diagnostic is based on the WMI namespace expected defaults. 17386 09:27:01 (0) ** A specific WMI application can always require a security setup different 17387 09:27:01 (0) ** than the WMI security defaults. 17388 09:27:01 (0) ** 17389 09:27:01 (0) ** WMI namespace security for ‘ROOT/MSAPPS’: … MODIFIED. 17390 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17391 09:27:01 (0) ** - REMOVED ACE: 17392 09:27:01 (0) ** ACEType: h0 17393 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17394 09:27:01 (0) ** ACEFlags: h12 17395 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17396 09:27:01 (0) ** INHERITED_ACE 17397 09:27:01 (0) ** ACEMask: h13 17398 09:27:01 (0) ** WBEM_ENABLE 17399 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17400 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17401 09:27:01 (0) ** 17402 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17403 09:27:01 (0) ** Removing default security will cause some operations to fail! 17404 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17405 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17406 09:27:01 (0) ** Note: WMIDiag has no specific knowledge of this WMI namespace. 17407 09:27:01 (0) ** The security diagnostic is based on the WMI namespace expected defaults. 17408 09:27:01 (0) ** A specific WMI application can always require a security setup different 17409 09:27:01 (0) ** than the WMI security defaults. 17410 09:27:01 (0) ** 17411 09:27:01 (0) ** WMI namespace security for ‘ROOT/MSAPPS’: … MODIFIED. 17412 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17413 09:27:01 (0) ** - REMOVED ACE: 17414 09:27:01 (0) ** ACEType: h0 17415 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17416 09:27:01 (0) ** ACEFlags: h12 17417 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17418 09:27:01 (0) ** INHERITED_ACE 17419 09:27:01 (0) ** ACEMask: h13 17420 09:27:01 (0) ** WBEM_ENABLE 17421 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17422 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17423 09:27:01 (0) ** 17424 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17425 09:27:01 (0) ** Removing default security will cause some operations to fail! 17426 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17427 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17428 09:27:01 (0) ** Note: WMIDiag has no specific knowledge of this WMI namespace. 17429 09:27:01 (0) ** The security diagnostic is based on the WMI namespace expected defaults. 17430 09:27:01 (0) ** A specific WMI application can always require a security setup different 17431 09:27:01 (0) ** than the WMI security defaults. 17432 09:27:01 (0) ** 17433 09:27:01 (0) ** WMI namespace security for ‘ROOT/MSAPPS’: … MODIFIED. 17434 09:27:01 (1) ERROR: Default trustee ‘EVERYONE’ has been REMOVED! 17435 09:27:01 (0) ** - REMOVED ACE: 17436 09:27:01 (0) ** ACEType: h0 17437 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17438 09:27:01 (0) ** ACEFlags: h12 17439 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17440 09:27:01 (0) ** INHERITED_ACE 17441 09:27:01 (0) ** ACEMask: h13 17442 09:27:01 (0) ** WBEM_ENABLE 17443 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17444 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17445 09:27:01 (0) ** 17446 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17447 09:27:01 (0) ** Removing default security will cause some operations to fail! 17448 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17449 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17450 09:27:01 (0) ** Note: WMIDiag has no specific knowledge of this WMI namespace. 17451 09:27:01 (0) ** The security diagnostic is based on the WMI namespace expected defaults. 17452 09:27:01 (0) ** A specific WMI application can always require a security setup different 17453 09:27:01 (0) ** than the WMI security defaults. 17454 09:27:01 (0) ** 17455 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP’: … MODIFIED. 17456 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17457 09:27:01 (0) ** - REMOVED ACE: 17458 09:27:01 (0) ** ACEType: h0 17459 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17460 09:27:01 (0) ** ACEFlags: h12 17461 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17462 09:27:01 (0) ** INHERITED_ACE 17463 09:27:01 (0) ** ACEMask: h6003F 17464 09:27:01 (0) ** WBEM_ENABLE 17465 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17466 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17467 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17468 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17469 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17470 09:27:01 (0) ** WBEM_WRITE_DAC 17471 09:27:01 (0) ** WBEM_READ_CONTROL 17472 09:27:01 (0) ** 17473 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17474 09:27:01 (0) ** Removing default security will cause some operations to fail! 17475 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17476 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17477 09:27:01 (0) ** 17478 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP’: … MODIFIED. 17479 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\SYSTEM’ has been REMOVED! 17480 09:27:01 (0) ** - REMOVED ACE: 17481 09:27:01 (0) ** ACEType: h0 17482 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17483 09:27:01 (0) ** ACEFlags: h12 17484 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17485 09:27:01 (0) ** INHERITED_ACE 17486 09:27:01 (0) ** ACEMask: h6003F 17487 09:27:01 (0) ** WBEM_ENABLE 17488 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17489 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17490 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17491 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17492 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17493 09:27:01 (0) ** WBEM_WRITE_DAC 17494 09:27:01 (0) ** WBEM_READ_CONTROL 17495 09:27:01 (0) ** 17496 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17497 09:27:01 (0) ** Removing default security will cause some operations to fail! 17498 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17499 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17500 09:27:01 (0) ** 17501 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP’: … MODIFIED. 17502 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\AUTHENTICATED USERS’ has been REMOVED! 17503 09:27:01 (0) ** - REMOVED ACE: 17504 09:27:01 (0) ** ACEType: h0 17505 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17506 09:27:01 (0) ** ACEFlags: h12 17507 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17508 09:27:01 (0) ** INHERITED_ACE 17509 09:27:01 (0) ** ACEMask: h20023 17510 09:27:01 (0) ** WBEM_ENABLE 17511 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17512 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17513 09:27:01 (0) ** WBEM_READ_CONTROL 17514 09:27:01 (0) ** 17515 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17516 09:27:01 (0) ** Removing default security will cause some operations to fail! 17517 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17518 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17519 09:27:01 (0) ** 17520 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP/USER’: … MODIFIED. 17521 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17522 09:27:01 (0) ** - REMOVED ACE: 17523 09:27:01 (0) ** ACEType: h0 17524 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17525 09:27:01 (0) ** ACEFlags: h12 17526 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17527 09:27:01 (0) ** INHERITED_ACE 17528 09:27:01 (0) ** ACEMask: h6003F 17529 09:27:01 (0) ** WBEM_ENABLE 17530 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17531 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17532 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17533 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17534 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17535 09:27:01 (0) ** WBEM_WRITE_DAC 17536 09:27:01 (0) ** WBEM_READ_CONTROL 17537 09:27:01 (0) ** 17538 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17539 09:27:01 (0) ** Removing default security will cause some operations to fail! 17540 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17541 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17542 09:27:01 (0) ** 17543 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP/USER’: … MODIFIED. 17544 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\SYSTEM’ has been REMOVED! 17545 09:27:01 (0) ** - REMOVED ACE: 17546 09:27:01 (0) ** ACEType: h0 17547 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17548 09:27:01 (0) ** ACEFlags: h12 17549 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17550 09:27:01 (0) ** INHERITED_ACE 17551 09:27:01 (0) ** ACEMask: h6003F 17552 09:27:01 (0) ** WBEM_ENABLE 17553 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17554 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17555 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17556 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17557 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17558 09:27:01 (0) ** WBEM_WRITE_DAC 17559 09:27:01 (0) ** WBEM_READ_CONTROL 17560 09:27:01 (0) ** 17561 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17562 09:27:01 (0) ** Removing default security will cause some operations to fail! 17563 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17564 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17565 09:27:01 (0) ** 17566 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP/USER’: … MODIFIED. 17567 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\AUTHENTICATED USERS’ has been REMOVED! 17568 09:27:01 (0) ** - REMOVED ACE: 17569 09:27:01 (0) ** ACEType: h0 17570 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17571 09:27:01 (0) ** ACEFlags: h12 17572 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17573 09:27:01 (0) ** INHERITED_ACE 17574 09:27:01 (0) ** ACEMask: h20023 17575 09:27:01 (0) ** WBEM_ENABLE 17576 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17577 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17578 09:27:01 (0) ** WBEM_READ_CONTROL 17579 09:27:01 (0) ** 17580 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17581 09:27:01 (0) ** Removing default security will cause some operations to fail! 17582 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17583 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17584 09:27:01 (0) ** 17585 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP/COMPUTER’: … MODIFIED. 17586 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17587 09:27:01 (0) ** - REMOVED ACE: 17588 09:27:01 (0) ** ACEType: h0 17589 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17590 09:27:01 (0) ** ACEFlags: h12 17591 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17592 09:27:01 (0) ** INHERITED_ACE 17593 09:27:01 (0) ** ACEMask: h6003F 17594 09:27:01 (0) ** WBEM_ENABLE 17595 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17596 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17597 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17598 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17599 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17600 09:27:01 (0) ** WBEM_WRITE_DAC 17601 09:27:01 (0) ** WBEM_READ_CONTROL 17602 09:27:01 (0) ** 17603 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17604 09:27:01 (0) ** Removing default security will cause some operations to fail! 17605 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17606 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17607 09:27:01 (0) ** 17608 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP/COMPUTER’: … MODIFIED. 17609 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\SYSTEM’ has been REMOVED! 17610 09:27:01 (0) ** - REMOVED ACE: 17611 09:27:01 (0) ** ACEType: h0 17612 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17613 09:27:01 (0) ** ACEFlags: h12 17614 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17615 09:27:01 (0) ** INHERITED_ACE 17616 09:27:01 (0) ** ACEMask: h6003F 17617 09:27:01 (0) ** WBEM_ENABLE 17618 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17619 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17620 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17621 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17622 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17623 09:27:01 (0) ** WBEM_WRITE_DAC 17624 09:27:01 (0) ** WBEM_READ_CONTROL 17625 09:27:01 (0) ** 17626 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17627 09:27:01 (0) ** Removing default security will cause some operations to fail! 17628 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17629 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17630 09:27:01 (0) ** 17631 09:27:01 (0) ** WMI namespace security for ‘ROOT/RSOP/COMPUTER’: … MODIFIED. 17632 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\AUTHENTICATED USERS’ has been REMOVED! 17633 09:27:01 (0) ** - REMOVED ACE: 17634 09:27:01 (0) ** ACEType: h0 17635 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17636 09:27:01 (0) ** ACEFlags: h12 17637 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17638 09:27:01 (0) ** INHERITED_ACE 17639 09:27:01 (0) ** ACEMask: h20023 17640 09:27:01 (0) ** WBEM_ENABLE 17641 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17642 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17643 09:27:01 (0) ** WBEM_READ_CONTROL 17644 09:27:01 (0) ** 17645 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17646 09:27:01 (0) ** Removing default security will cause some operations to fail! 17647 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17648 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17649 09:27:01 (0) ** 17650 09:27:01 (0) ** WMI namespace security for ‘ROOT/CLI’: … MODIFIED. 17651 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17652 09:27:01 (0) ** - REMOVED ACE: 17653 09:27:01 (0) ** ACEType: h0 17654 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17655 09:27:01 (0) ** ACEFlags: h12 17656 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17657 09:27:01 (0) ** INHERITED_ACE 17658 09:27:01 (0) ** ACEMask: h6003F 17659 09:27:01 (0) ** WBEM_ENABLE 17660 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17661 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17662 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17663 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17664 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17665 09:27:01 (0) ** WBEM_WRITE_DAC 17666 09:27:01 (0) ** WBEM_READ_CONTROL 17667 09:27:01 (0) ** 17668 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17669 09:27:01 (0) ** Removing default security will cause some operations to fail! 17670 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17671 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17672 09:27:01 (0) ** 17673 09:27:01 (0) ** WMI namespace security for ‘ROOT/CLI’: … MODIFIED. 17674 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17675 09:27:01 (0) ** - REMOVED ACE: 17676 09:27:01 (0) ** ACEType: h0 17677 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17678 09:27:01 (0) ** ACEFlags: h12 17679 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17680 09:27:01 (0) ** INHERITED_ACE 17681 09:27:01 (0) ** ACEMask: h13 17682 09:27:01 (0) ** WBEM_ENABLE 17683 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17684 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17685 09:27:01 (0) ** 17686 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17687 09:27:01 (0) ** Removing default security will cause some operations to fail! 17688 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17689 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17690 09:27:01 (0) ** 17691 09:27:01 (0) ** WMI namespace security for ‘ROOT/CLI’: … MODIFIED. 17692 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17693 09:27:01 (0) ** - REMOVED ACE: 17694 09:27:01 (0) ** ACEType: h0 17695 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17696 09:27:01 (0) ** ACEFlags: h12 17697 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17698 09:27:01 (0) ** INHERITED_ACE 17699 09:27:01 (0) ** ACEMask: h13 17700 09:27:01 (0) ** WBEM_ENABLE 17701 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17702 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17703 09:27:01 (0) ** 17704 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17705 09:27:01 (0) ** Removing default security will cause some operations to fail! 17706 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17707 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17708 09:27:01 (0) ** 17709 09:27:01 (0) ** WMI namespace security for ‘ROOT/CLI’: … MODIFIED. 17710 09:27:01 (1) ERROR: Default trustee ‘EVERYONE’ has been REMOVED! 17711 09:27:01 (0) ** - REMOVED ACE: 17712 09:27:01 (0) ** ACEType: h0 17713 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17714 09:27:01 (0) ** ACEFlags: h12 17715 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17716 09:27:01 (0) ** INHERITED_ACE 17717 09:27:01 (0) ** ACEMask: h13 17718 09:27:01 (0) ** WBEM_ENABLE 17719 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17720 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17721 09:27:01 (0) ** 17722 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17723 09:27:01 (0) ** Removing default security will cause some operations to fail! 17724 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17725 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17726 09:27:01 (0) ** 17727 09:27:01 (0) ** WMI namespace security for ‘ROOT/WMI’: … MODIFIED. 17728 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17729 09:27:01 (0) ** - REMOVED ACE: 17730 09:27:01 (0) ** ACEType: h0 17731 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17732 09:27:01 (0) ** ACEFlags: h12 17733 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17734 09:27:01 (0) ** INHERITED_ACE 17735 09:27:01 (0) ** ACEMask: h6003F 17736 09:27:01 (0) ** WBEM_ENABLE 17737 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17738 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17739 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17740 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17741 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17742 09:27:01 (0) ** WBEM_WRITE_DAC 17743 09:27:01 (0) ** WBEM_READ_CONTROL 17744 09:27:01 (0) ** 17745 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17746 09:27:01 (0) ** Removing default security will cause some operations to fail! 17747 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17748 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17749 09:27:01 (0) ** 17750 09:27:01 (0) ** WMI namespace security for ‘ROOT/WMI’: … MODIFIED. 17751 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17752 09:27:01 (0) ** - REMOVED ACE: 17753 09:27:01 (0) ** ACEType: h0 17754 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17755 09:27:01 (0) ** ACEFlags: h12 17756 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17757 09:27:01 (0) ** INHERITED_ACE 17758 09:27:01 (0) ** ACEMask: h13 17759 09:27:01 (0) ** WBEM_ENABLE 17760 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17761 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17762 09:27:01 (0) ** 17763 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17764 09:27:01 (0) ** Removing default security will cause some operations to fail! 17765 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17766 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17767 09:27:01 (0) ** 17768 09:27:01 (0) ** WMI namespace security for ‘ROOT/WMI’: … MODIFIED. 17769 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17770 09:27:01 (0) ** - REMOVED ACE: 17771 09:27:01 (0) ** ACEType: h0 17772 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17773 09:27:01 (0) ** ACEFlags: h12 17774 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17775 09:27:01 (0) ** INHERITED_ACE 17776 09:27:01 (0) ** ACEMask: h13 17777 09:27:01 (0) ** WBEM_ENABLE 17778 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17779 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17780 09:27:01 (0) ** 17781 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17782 09:27:01 (0) ** Removing default security will cause some operations to fail! 17783 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17784 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17785 09:27:01 (0) ** 17786 09:27:01 (0) ** WMI namespace security for ‘ROOT/WMI’: … MODIFIED. 17787 09:27:01 (1) ERROR: Default trustee ‘EVERYONE’ has been REMOVED! 17788 09:27:01 (0) ** - REMOVED ACE: 17789 09:27:01 (0) ** ACEType: h0 17790 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17791 09:27:01 (0) ** ACEFlags: h12 17792 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17793 09:27:01 (0) ** INHERITED_ACE 17794 09:27:01 (0) ** ACEMask: h13 17795 09:27:01 (0) ** WBEM_ENABLE 17796 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17797 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17798 09:27:01 (0) ** 17799 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17800 09:27:01 (0) ** Removing default security will cause some operations to fail! 17801 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17802 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17803 09:27:01 (0) ** 17804 09:27:01 (0) ** WMI namespace security for ‘ROOT/CIMV2’: … MODIFIED. 17805 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17806 09:27:01 (0) ** - REMOVED ACE: 17807 09:27:01 (0) ** ACEType: h0 17808 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17809 09:27:01 (0) ** ACEFlags: h12 17810 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17811 09:27:01 (0) ** INHERITED_ACE 17812 09:27:01 (0) ** ACEMask: h6003F 17813 09:27:01 (0) ** WBEM_ENABLE 17814 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17815 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17816 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17817 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17818 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17819 09:27:01 (0) ** WBEM_WRITE_DAC 17820 09:27:01 (0) ** WBEM_READ_CONTROL 17821 09:27:01 (0) ** 17822 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17823 09:27:01 (0) ** Removing default security will cause some operations to fail! 17824 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17825 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17826 09:27:01 (0) ** 17827 09:27:01 (0) ** WMI namespace security for ‘ROOT/CIMV2’: … MODIFIED. 17828 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17829 09:27:01 (0) ** - REMOVED ACE: 17830 09:27:01 (0) ** ACEType: h0 17831 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17832 09:27:01 (0) ** ACEFlags: h12 17833 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17834 09:27:01 (0) ** INHERITED_ACE 17835 09:27:01 (0) ** ACEMask: h13 17836 09:27:01 (0) ** WBEM_ENABLE 17837 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17838 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17839 09:27:01 (0) ** 17840 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17841 09:27:01 (0) ** Removing default security will cause some operations to fail! 17842 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17843 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17844 09:27:01 (0) ** 17845 09:27:01 (0) ** WMI namespace security for ‘ROOT/CIMV2’: … MODIFIED. 17846 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17847 09:27:01 (0) ** - REMOVED ACE: 17848 09:27:01 (0) ** ACEType: h0 17849 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17850 09:27:01 (0) ** ACEFlags: h12 17851 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17852 09:27:01 (0) ** INHERITED_ACE 17853 09:27:01 (0) ** ACEMask: h13 17854 09:27:01 (0) ** WBEM_ENABLE 17855 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17856 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17857 09:27:01 (0) ** 17858 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17859 09:27:01 (0) ** Removing default security will cause some operations to fail! 17860 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17861 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17862 09:27:01 (0) ** 17863 09:27:01 (0) ** WMI namespace security for ‘ROOT/CIMV2’: … MODIFIED. 17864 09:27:01 (1) ERROR: Default trustee ‘EVERYONE’ has been REMOVED! 17865 09:27:01 (0) ** - REMOVED ACE: 17866 09:27:01 (0) ** ACEType: h0 17867 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17868 09:27:01 (0) ** ACEFlags: h12 17869 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17870 09:27:01 (0) ** INHERITED_ACE 17871 09:27:01 (0) ** ACEMask: h13 17872 09:27:01 (0) ** WBEM_ENABLE 17873 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17874 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17875 09:27:01 (0) ** 17876 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17877 09:27:01 (0) ** Removing default security will cause some operations to fail! 17878 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17879 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17880 09:27:01 (0) ** 17881 09:27:01 (0) ** WMI namespace security for ‘ROOT/CIMV2/APPLICATIONS’: … MODIFIED. 17882 09:27:01 (1) ERROR: Default trustee ‘BUILTIN\ADMINISTRATORS’ has been REMOVED! 17883 09:27:01 (0) ** - REMOVED ACE: 17884 09:27:01 (0) ** ACEType: h0 17885 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17886 09:27:01 (0) ** ACEFlags: h12 17887 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17888 09:27:01 (0) ** INHERITED_ACE 17889 09:27:01 (0) ** ACEMask: h6003F 17890 09:27:01 (0) ** WBEM_ENABLE 17891 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17892 09:27:01 (0) ** WBEM_FULL_WRITE_REP 17893 09:27:01 (0) ** WBEM_PARTIAL_WRITE_REP 17894 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17895 09:27:01 (0) ** WBEM_REMOTE_ACCESS 17896 09:27:01 (0) ** WBEM_WRITE_DAC 17897 09:27:01 (0) ** WBEM_READ_CONTROL 17898 09:27:01 (0) ** 17899 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17900 09:27:01 (0) ** Removing default security will cause some operations to fail! 17901 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17902 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17903 09:27:01 (0) ** 17904 09:27:01 (0) ** WMI namespace security for ‘ROOT/CIMV2/APPLICATIONS’: … MODIFIED. 17905 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\NETWORK SERVICE’ has been REMOVED! 17906 09:27:01 (0) ** - REMOVED ACE: 17907 09:27:01 (0) ** ACEType: h0 17908 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE 17909 09:27:01 (0) ** ACEFlags: h12 17910 09:27:01 (0) ** CONTAINER_INHERIT_ACE 17911 09:27:01 (0) ** INHERITED_ACE 17912 09:27:01 (0) ** ACEMask: h13 17913 09:27:01 (0) ** WBEM_ENABLE 17914 09:27:01 (0) ** WBEM_METHOD_EXECUTE 17915 09:27:01 (0) ** WBEM_WRITE_PROVIDER 17916 09:27:01 (0) ** 17917 09:27:01 (0) ** = The REMOVED ACE was part of the DEFAULT setup for the trustee. 17918 09:27:01 (0) ** Removing default security will cause some operations to fail! 17919 09:27:01 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE. 17920 09:27:01 (0) ** For WMI namespaces, this can be done with ‘WMIMGMT.MSC’. 17921 09:27:01 (0) ** 17922 09:27:01 (0) ** WMI namespace security for ‘ROOT/CIMV2/APPLICATIONS’: … MODIFIED. 17923 09:27:01 (1) ERROR: Default trustee ‘NT AUTHORITY\LOCAL SERVICE’ has been REMOVED! 17924 09:27:01 (0) ** - REMOVED ACE: 17925 09:27:01 (0) ** ACEType: h0 17926 09:27:01 (0) ** ACCESS_ALLOWED_ACE_TYPE

Joan · 30 Marzec 2007 07:40

to jest raport z WMI, a nie log z Silenta :roll:

ten początek który wcześniej wkleiłeś jest ok,l daj całość

Bor4t · 30 Marzec 2007 07:40

To chyba nie to -_- za długie jak na mój gust.

Złączono Posta : 30.03.2007 (Pią) 9:42

Ale widzisz ,to jest całość dokumentu :

“Silent Runners.vbs”, revision RED (R28) (Echo output), launched at: 09:25 Operating System: Windows XP Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “CTFMON.EXE” = “D:\WINDOWS\System32\ctfmon.exe” [(path error)] “Komunikator” = “D:\Program Files\Tlen.pl\tlen.exe” [(path error)] “NETIANET” = “D:\Program Files\Netia\Net\netianet.exe” [(path error)] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ “NvCplDaemon” = “RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup” [(path error)] “nwiz” = “nwiz.exe /install” [(path error)] “NvMediaCenter” = “RunDLL32.exe NvMCTray.dll,NvTaskbarInit” [(path error)] “Logitech Utility” = “Logi_MwX.Exe” [(path error)] “SigmatelSysTrayApp” = “sttray.exe” [file not found] “avgnt” = ““D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min” [(path error)] “SpeedTouch USB Diagnostics” = ““D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [(path error)] “IntelAudioStudio” = ““D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe” BOOT” [(path error)] “Default” = “” [(file not found)] “Sony Ericsson PC Suite” = ““D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions” [(path error)] “QuickTime Task” = ““D:\Program Files\QuickTime\qttask.exe” -atboottime” [(path error)] “Adobe Photo Downloader” = ““D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”” [(path error)] HKLM\Software\Microsoft\Active Setup\Installed Components\ “>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}(Default)” = “Microsoft Windows Media Player” \StubPath = “D:\WINDOWS\inf\unregmp2.exe /ShowWMP” [(path error)] “{306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default)” = “” \StubPath = ““D:\WINDOWS\System32\rundll32.exe” “D:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [(path error)] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” -> resolves to: {CLSID}\InprocServer32(Default) = “C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx” [(path error)] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “PostBootReminder” = “{7849596a-48ea-486e-8937-a2a3009f31a9}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\system32\SHELL32.dll” [(path error)] “CDBurn” = “{fbeb8a05-beee-4442-804e-409d6c4515e9}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\system32\SHELL32.dll” [(path error)] “WebCheck” = “{E6FB5E20-DE35-11CF-9C87-00AA005127ED}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\System32\webcheck.dll” [(path error)] “SysTray” = “{35CEC8A3-2BE6-11D2-8773-92E220524153}” -> resolves to: {CLSID}\InprocServer32(Default) = “D:\WINDOWS\System32\stobject.dll” [(path error)] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Złączono Posta: 30.03.2007 (Pią) 9:53 Mam problemy z tym silentem…A kiedyś działał -_- Złączono Posta: 30.03.2007 (Pią) 10:01 ERROR WMIDiag detected issues that coul prevent WMI to work properly ! -_-

Joan · 30 Marzec 2007 08:05

ok, to daj log z ComboScan

Bor4t · 30 Marzec 2007 08:10

Scan z ComboFix - ComboScan pokazuje mi error ;D

“ˆuki” - 07-03-30 10:09:31 Dodatek Service Pack. 1 ComboFix 07-03-27.4.2 - Running from: “D:\Documents and Settings\ˆuki\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-30 )))))))))))))))))))))))))))))))))) 2007-03-30 09:14 1,341,056 --a------ D:\WINDOWS\system32\nod64.exe 2007-03-30 08:02 2007-03-30 07:59 2007-03-29 17:14 2007-03-29 17:01 2007-03-28 20:44 2007-03-25 09:19 2,297,552 --a------ D:\WINDOWS\system32\d3dx9_26.dll 2007-03-15 12:00 466,432 --a------ D:\WINDOWS\system32\SkanerOnline.dll 2007-03-13 15:32 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-03-25 09:38 98304 --a------ D:\WINDOWS\system32\cmdlineext.dll 2007-02-16 14:58 -------- d-------- D:\Program Files\project64 v1.5 2007-02-16 14:58 -------- d-------- D:\Program Files\project64 v1.5 2007-02-16 14:52 4096 --a------ D:\WINDOWS\d3dx.dat 2007-02-16 14:25 -------- d-------- D:\Program Files\project64 1.6 2007-02-16 14:25 -------- d-------- D:\Program Files\project64 1.6 2007-02-12 20:06 -------- d-------- D:\Program Files\quicktime 2007-02-12 20:06 -------- d-------- D:\Program Files\quicktime 2007-02-10 11:52 -------- d-------- D:\Program Files\disc2phone 2007-02-10 11:52 -------- d-------- D:\Program Files\disc2phone 2007-02-10 11:51 67298 --a------ D:\WINDOWS\system32\perfc015.dat 2007-02-10 11:51 436322 --a------ D:\WINDOWS\system32\perfh015.dat 2007-02-10 11:48 -------- d-------- D:\Program Files\sony ericsson 2007-02-10 11:48 -------- d-------- D:\Program Files\sony ericsson 2007-02-10 11:46 94064 --a------ D:\WINDOWS\system32\drivers\k510mdm.sys 2007-02-10 11:46 85408 --a------ D:\WINDOWS\system32\drivers\k510mgmt.sys 2007-02-10 11:46 8336 --a------ D:\WINDOWS\system32\drivers\k510mdfl.sys 2007-02-10 11:46 83344 --a------ D:\WINDOWS\system32\drivers\k510obex.sys 2007-02-10 11:46 6176 --a------ D:\WINDOWS\system32\drivers\k510cmnt.sys 2007-02-10 11:46 6176 --a------ D:\WINDOWS\system32\drivers\k510cm.sys 2007-02-10 11:46 58288 --a------ D:\WINDOWS\system32\drivers\k510bus.sys 2007-02-10 11:46 5808 --a------ D:\WINDOWS\system32\drivers\k510whnt.sys 2007-02-10 11:46 5808 --a------ D:\WINDOWS\system32\drivers\k510wh.sys 2007-01-19 09:40 89088 --a------ D:\WINDOWS\system32\skaneronlineuninstall.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“D:\WINDOWS\System32\ctfmon.exe” “Komunikator”=“D:\Program Files\Tlen.pl\tlen.exe” “NETIANET”=“D:\Program Files\Netia\Net\netianet.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “NvCplDaemon”=“RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup” “nwiz”=“nwiz.exe /install” “NvMediaCenter”=“RunDLL32.exe NvMCTray.dll,NvTaskbarInit” “Logitech Utility”=“Logi_MwX.Exe” “SigmatelSysTrayApp”=“sttray.exe” “avgnt”="“D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min" “SpeedTouch USB Diagnostics”="“D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon" “IntelAudioStudio”="“D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe” BOOT" @="" “Sony Ericsson PC Suite”="“D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions" “QuickTime Task”="“D:\Program Files\QuickTime\qttask.exe” -atboottime" “Adobe Photo Downloader”="“D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] “NoChange”=“1” “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] “backup”=“D:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup” “location”=“Common Startup” “command”=“D:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe " “item”=“HP Digital Imaging Monitor” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone - szybkie uruchamianie.lnk] “backup”=“D:\WINDOWS\pss\HP Image Zone - szybkie uruchamianie.lnkCommon Startup” “location”=“Common Startup” “command”=“D:\PROGRA~1\HP\DIGITA~1\bin\hpqthb08.exe -s” “item”=“HP Image Zone - szybkie uruchamianie” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] “path”=“D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk” “backup”=“D:\WINDOWS\pss\Microsoft Office.lnkCommon Startup” “location”=“Common Startup” “command”=“D:\PROGRA~1\MICROS~2\Office\OSA9.EXE -b -l” “item”=“Microsoft Office” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“hpcmpmgr” “hkey”=“HKLM” “command”=”“D:\Program Files\HP\hpcoretech\hpcmpmgr.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“HPWuSchd2” “hkey”=“HKLM” “command”="“D:\Program Files\HP\HP Software Update\HPWuSchd2.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelAudioStudio] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“IntelAudioStudio” “hkey”=“HKLM” “command”="“D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe” BOOT" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“NeroCheck” “hkey”=“HKLM” “command”=“D:\WINDOWS\system32\NeroCheck.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“PDVDServ” “hkey”=“HKLM” “command”="“D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“winampa” “hkey”=“HKLM” “command”=“D:\Program Files\Winamp\winampa.exe” “inimapping”=“0” [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “NETIANET”=“D:\Program Files\Netia\Net\netianet.exe” [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AAVMKER4 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_ASWMON2 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_ASWRDR *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_ASWTDI *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVAST!_ANTIVIRUS ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-03-30 10:10:13 Złączono Posta: 30.03.2007 (Pią) 10:30 UDAłO się ;D Oto log z ComboScan :

adam9870 · 30 Marzec 2007 13:51

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jeżeli któryś z nich będzie na żółto to go zostaw). Po użyciu narzędzia wymagany jest restart.

Ściągasz program KillBox, zaznaczasz Delete on reboot , w polu full path of file wklej ścieżki:

D:\WINDOWS\System32.exe

D:\WINDOWS\System32\nod64.exe

Po wklejeniu każdej ścieżki z osobna klikasz na czerwonego iksa, ale dopiero po wklejeniu ostatniej zgadzasz się na restart.

Po wykonaniu wklej nowy log z ComboFix.

Bor4t · 30 Marzec 2007 14:05

Oto nowy log otrzymany po restarcie systemu.

“ˆuki” - 07-03-30 16:04:44 Dodatek Service Pack. 1 ComboFix 07-03-27.4.2 - Running from: “D:\Documents and Settings\ˆuki\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-30 )))))))))))))))))))))))))))))))))) 2007-03-30 08:02 2007-03-30 07:59 2007-03-29 17:14 2007-03-29 17:01 2007-03-28 20:44 2007-03-25 09:19 2,297,552 --a------ D:\WINDOWS\system32\d3dx9_26.dll 2007-03-15 12:00 466,432 --a------ D:\WINDOWS\system32\SkanerOnline.dll 2007-03-13 15:32 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-03-25 09:38 98304 --a------ D:\WINDOWS\system32\cmdlineext.dll 2007-02-16 14:58 -------- d-------- D:\Program Files\project64 v1.5 2007-02-16 14:58 -------- d-------- D:\Program Files\project64 v1.5 2007-02-16 14:52 4096 --a------ D:\WINDOWS\d3dx.dat 2007-02-16 14:25 -------- d-------- D:\Program Files\project64 1.6 2007-02-16 14:25 -------- d-------- D:\Program Files\project64 1.6 2007-02-12 20:06 -------- d-------- D:\Program Files\quicktime 2007-02-12 20:06 -------- d-------- D:\Program Files\quicktime 2007-02-10 11:52 -------- d-------- D:\Program Files\disc2phone 2007-02-10 11:52 -------- d-------- D:\Program Files\disc2phone 2007-02-10 11:51 67298 --a------ D:\WINDOWS\system32\perfc015.dat 2007-02-10 11:51 436322 --a------ D:\WINDOWS\system32\perfh015.dat 2007-02-10 11:48 -------- d-------- D:\Program Files\sony ericsson 2007-02-10 11:48 -------- d-------- D:\Program Files\sony ericsson 2007-02-10 11:46 94064 --a------ D:\WINDOWS\system32\drivers\k510mdm.sys 2007-02-10 11:46 85408 --a------ D:\WINDOWS\system32\drivers\k510mgmt.sys 2007-02-10 11:46 8336 --a------ D:\WINDOWS\system32\drivers\k510mdfl.sys 2007-02-10 11:46 83344 --a------ D:\WINDOWS\system32\drivers\k510obex.sys 2007-02-10 11:46 6176 --a------ D:\WINDOWS\system32\drivers\k510cmnt.sys 2007-02-10 11:46 6176 --a------ D:\WINDOWS\system32\drivers\k510cm.sys 2007-02-10 11:46 58288 --a------ D:\WINDOWS\system32\drivers\k510bus.sys 2007-02-10 11:46 5808 --a------ D:\WINDOWS\system32\drivers\k510whnt.sys 2007-02-10 11:46 5808 --a------ D:\WINDOWS\system32\drivers\k510wh.sys 2007-01-19 09:40 89088 --a------ D:\WINDOWS\system32\skaneronlineuninstall.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“D:\WINDOWS\System32\ctfmon.exe” “Komunikator”=“D:\Program Files\Tlen.pl\tlen.exe” “NETIANET”=“D:\Program Files\Netia\Net\netianet.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “NvCplDaemon”=“RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup” “nwiz”=“nwiz.exe /install” “NvMediaCenter”=“RunDLL32.exe NvMCTray.dll,NvTaskbarInit” “Logitech Utility”=“Logi_MwX.Exe” “SigmatelSysTrayApp”=“sttray.exe” “avgnt”="“D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe” /min" “SpeedTouch USB Diagnostics”="“D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon" “IntelAudioStudio”="“D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe” BOOT" @="" “Sony Ericsson PC Suite”="“D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions" “QuickTime Task”="“D:\Program Files\QuickTime\qttask.exe” -atboottime" “Adobe Photo Downloader”="“D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] “NoChange”=“1” “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] “backup”=“D:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup” “location”=“Common Startup” “command”=“D:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe " “item”=“HP Digital Imaging Monitor” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Image Zone - szybkie uruchamianie.lnk] “backup”=“D:\WINDOWS\pss\HP Image Zone - szybkie uruchamianie.lnkCommon Startup” “location”=“Common Startup” “command”=“D:\PROGRA~1\HP\DIGITA~1\bin\hpqthb08.exe -s” “item”=“HP Image Zone - szybkie uruchamianie” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] “path”=“D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk” “backup”=“D:\WINDOWS\pss\Microsoft Office.lnkCommon Startup” “location”=“Common Startup” “command”=“D:\PROGRA~1\MICROS~2\Office\OSA9.EXE -b -l” “item”=“Microsoft Office” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“hpcmpmgr” “hkey”=“HKLM” “command”=”“D:\Program Files\HP\hpcoretech\hpcmpmgr.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“HPWuSchd2” “hkey”=“HKLM” “command”="“D:\Program Files\HP\HP Software Update\HPWuSchd2.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelAudioStudio] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“IntelAudioStudio” “hkey”=“HKLM” “command”="“D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe” BOOT" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“NeroCheck” “hkey”=“HKLM” “command”=“D:\WINDOWS\system32\NeroCheck.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“PDVDServ” “hkey”=“HKLM” “command”="“D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“winampa” “hkey”=“HKLM” “command”=“D:\Program Files\Winamp\winampa.exe” “inimapping”=“0” [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “NETIANET”=“D:\Program Files\Netia\Net\netianet.exe” [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-03-30 16:04:56 D:\ComboFix3.txt … 07-03-30 15:22 D:\ComboFix2.txt … 07-03-30 16:04 Złączono Posta: 30.03.2007 (Pią) 16:08 Chciałem dodać iż w kwarantannie Antivira przechowuję parę robaków - co z nimi zrobić ? Worm\Sdbot.101888.20 Worm\Rbot.1356800 Worm\Allaple.Gen

adam9870 · 30 Marzec 2007 14:47

Log czysty.

Ale gdzie są wykrywane te robaki, o których wspomniałeś? Podaj dokładnie lokalizacje do znajdowanych zainfekowanych plików.

Przeskanuj http://www.ewido.net/en/ oraz http://www.kaspersky.pl/virusscanner.html i wklej raporty.

Bor4t · 30 Marzec 2007 14:49

Od czasu wklejenia ostatniego loga - wciąż restartuje komputer ( kasuje wirusy ręcznie killbox-em ). Ale po każdym restarcie pojawia się kolejny robak z tą samą sygnaturą : WORM/Sdbot.101888.20 .

Co robić ?

adam9870 · 30 Marzec 2007 14:49

Pokaż dwa logi z Gmer’a wykonane przy takich ustawieniach:

Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

Jeśli wszystkie logi nie zmieszczą się bezpośrednio do posta, to umieść je w jakimś serwisie hostingowym jako pliki *.txt, a tu tylko zlinkuj.

Bor4t · 30 Marzec 2007 14:50

Lokalizacja robaka ,którego teraz mam na komputerze :

D:\WINDOWS\system32\wmupdat62288.exe

Wiem,że mogę użyć killboxa do jego skasowania ale co z tego skoro znowu się pojawi pod innym adresem .

Złączono Posta : 30.03.2007 (Pią) 16:57

1.Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko :

GMER 1.0.12.12086 - http://www.gmer.net

Rootkit scan 2007-03-30 16:56:47

Windows 5.1.2600 Dodatek Service Pack. 1

---- Kernel code sections - GMER 1.0.12 ----

? D:\WINDOWS\System32\Drivers\PROCEXP90.SYS Nie można odnaleźć określonego pliku.

.text ntdll.dll!NtClose 77F758AA 5 Bytes JMP 720342BA

.text ntdll.dll!NtCreateProcess 77F759F4 5 Bytes JMP 72034445

.text ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes JMP 72034329

.text ntdll.dll!NtCreateSection 77F75A21 5 Bytes JMP 720342D8

---- EOF - GMER 1.0.12 ----

2.Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko

GMER 1.0.12.12086 - http://www.gmer.net

Rootkit scan 2007-03-30 16:57:40

Windows 5.1.2600 Dodatek Service Pack. 1

---- Services - GMER 1.0.12 ----

Service .NET CLR Data

Service .NET CLR Networking

Service .NETFramework

Service [DISABLED] Abiosdsk

Service [DISABLED] abp480n5

Service D:\WINDOWS\System32\DRIVERS\ACPI.sys [bOOT] ACPI

Service [DISABLED] ACPIEC

Service [DISABLED] adpu160m

Service D:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec

Service D:\WINDOWS\System32\drivers\afd.sys [AUTO] AFD

Service [DISABLED] Aha154x

Service [DISABLED] aic78u2

Service [DISABLED] aic78xx

Service D:\WINDOWS\System32\DRIVERS\alcan5wn.sys [MANUAL] alcan5wn

Service D:\WINDOWS\System32\DRIVERS\alcaudsl.sys [MANUAL] alcaudsl

Service D:\WINDOWS\System32\svchost.exe [MANUAL] Alerter

Service D:\WINDOWS\System32\alg.exe [MANUAL] ALG

Service [DISABLED] AliIde

Service [DISABLED] amsint

Service D:\Program Files\AntiVir PersonalEdition Classic\sched.exe [AUTO] AntiVirScheduler

Service D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe [AUTO] AntiVirService

Service D:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt

Service D:\WINDOWS\System32\DRIVERS\arp1394.sys [MANUAL] Arp1394

Service [DISABLED] asc

Service [DISABLED] asc3350p

Service [DISABLED] asc3550

Service ASP.NET

Service ASP.NET_1.1.4322

Service D:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [MANUAL] aspnet_state

Service D:\WINDOWS\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac

Service D:\WINDOWS\System32\DRIVERS\atapi.sys [bOOT] atapi

Service [DISABLED] Atdisk

Service D:\WINDOWS\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc

Service D:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv

Service D:\WINDOWS\System32\DRIVERS\audstub.sys [MANUAL] audstub

Service D:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys [sYSTEM] avgntdd

Service D:\WINDOWS\SYSTEM32\drivers\avgntmgr.sys [bOOT] avgntmgr

Service BattC

Service [sYSTEM] Beep

Service D:\WINDOWS\System32\svchost.exe [MANUAL] BITS

Service D:\WINDOWS\System32\svchost.exe [AUTO] Browser

Service [DISABLED] cbidf2k

Service [DISABLED] cd20xrnt

Service [sYSTEM] Cdaudio

Service [DISABLED] Cdfs

Service D:\WINDOWS\System32\DRIVERS\cdrom.sys [sYSTEM] Cdrom

Service [sYSTEM] Changer

Service D:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc

Service D:\WINDOWS\system32\clipsrv.exe [MANUAL] ClipSrv

Service [DISABLED] CmdIde

Service D:\WINDOWS\System32\dllhost.exe [MANUAL] COMSysApp

Service ContentFilter

Service ContentIndex

Service [DISABLED] Cpqarray

Service D:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc

Service [DISABLED] dac2w2k

Service [DISABLED] dac960nt

Service D:\WINDOWS\System32\svchost.exe [AUTO] Dhcp

Service D:\WINDOWS\System32\DRIVERS\disk.sys [bOOT] Disk

Service D:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin

Service D:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot

Service D:\WINDOWS\System32\drivers\dmio.sys [bOOT] dmio

Service D:\WINDOWS\System32\drivers\dmload.sys [bOOT] dmload

Service D:\WINDOWS\System32\svchost.exe [AUTO] dmserver

Service D:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic

Service D:\WINDOWS\System32\svchost.exe [AUTO] Dnscache

Service [DISABLED] dpti2o

Service D:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud

Service D:\WINDOWS\System32\DRIVERS\e1e5132.sys [MANUAL] e1express

Service D:\WINDOWS\System32\svchost.exe [AUTO] ERSvc

Service D:\WINDOWS\system32\services.exe [AUTO] Eventlog

Service D:\WINDOWS\System32\svchost.exe [MANUAL] EventSystem

Service [DISABLED] Fastfat

Service D:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility

Service D:\WINDOWS\System32\DRIVERS\fdc.sys [MANUAL] Fdc

Service [sYSTEM] Fips

Service D:\WINDOWS\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk

Service [sYSTEM] Fs_Rec

Service D:\WINDOWS\System32\DRIVERS\ftdisk.sys [bOOT] Ftdisk

Service D:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer

Service D:\WINDOWS\System32\DRIVERS\msgpc.sys [MANUAL] Gpc

Service [MANUAL] GVCplDrv

Service D:\WINDOWS\System32\DRIVERS\HDAudBus.sys [MANUAL] HDAudBus

Service D:\WINDOWS\System32\DRIVERS\HECI.sys [MANUAL] HECI

Service D:\WINDOWS\System32\svchost.exe [AUTO] helpsvc

Service D:\WINDOWS\System32\svchost.exe [DISABLED] HidServ

Service D:\WINDOWS\System32\DRIVERS\hidusb.sys [MANUAL] hidusb

Service [DISABLED] hpn

Service D:\WINDOWS\System32\DRIVERS\HPZid412.sys [MANUAL] HPZid412

Service D:\WINDOWS\System32\DRIVERS\HPZipr12.sys [MANUAL] HPZipr12

Service D:\WINDOWS\System32\DRIVERS\HPZius12.sys [MANUAL] HPZius12

Service [sYSTEM] i2omgmt

Service [DISABLED] i2omp

Service D:\WINDOWS\System32\DRIVERS\i8042prt.sys [sYSTEM] i8042prt

Service D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [MANUAL] IDriverT

Service D:\WINDOWS\System32\DRIVERS\imapi.sys [sYSTEM] Imapi

Service D:\WINDOWS\System32\imapi.exe [MANUAL] ImapiService

Service inetaccs

Service [DISABLED] ini910u

Service Inport

Service [DISABLED] IntelIde

Service D:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver

Service D:\WINDOWS\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp

Service D:\WINDOWS\System32\DRIVERS\ipnat.sys [MANUAL] IpNat

Service D:\WINDOWS\System32\DRIVERS\ipsec.sys [sYSTEM] IPSec

Service D:\WINDOWS\System32\DRIVERS\irenum.sys [MANUAL] IRENUM

Service ISAPISearch

Service D:\WINDOWS\System32\DRIVERS\isapnp.sys [bOOT] isapnp

Service D:\WINDOWS\System32\DRIVERS\k510bus.sys [MANUAL] k510bus

Service D:\WINDOWS\System32\DRIVERS\k510mdfl.sys [MANUAL] k510mdfl

Service D:\WINDOWS\System32\DRIVERS\k510mdm.sys [MANUAL] k510mdm

Service D:\WINDOWS\System32\DRIVERS\k510mgmt.sys [MANUAL] k510mgmt

Service D:\WINDOWS\System32\DRIVERS\k510obex.sys [MANUAL] k510obex

Service D:\WINDOWS\System32\DRIVERS\kbdclass.sys [sYSTEM] Kbdclass

Service D:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer

Service [bOOT] KSecDD

Service D:\WINDOWS\System32\svchost.exe [AUTO] lanmanserver

Service D:\WINDOWS\System32\svchost.exe [AUTO] lanmanworkstation

Service [sYSTEM] lbrtfdc

Service ldap

Service D:\WINDOWS\System32\DRIVERS\LHidFlt2.Sys [MANUAL] LHidFlt2

Service LicenseService

Service D:\WINDOWS\System32\svchost.exe [AUTO] LmHosts

Service D:\WINDOWS\System32\DRIVERS\LMouFlt2.Sys [MANUAL] LMouFlt2

Service D:\WINDOWS\System32\svchost.exe [DISABLED] Messenger

Service [sYSTEM] mnmdd

Service D:\WINDOWS\System32\mnmsrvc.exe [MANUAL] mnmsrvc

Service [MANUAL] Modem

Service D:\WINDOWS\System32\DRIVERS\mouclass.sys [sYSTEM] Mouclass

Service D:\WINDOWS\System32\DRIVERS\mouhid.sys [MANUAL] mouhid

Service [bOOT] MountMgr

Service [DISABLED] mraid35x

Service D:\WINDOWS\System32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV

Service D:\WINDOWS\System32\DRIVERS\mrxsmb.sys [sYSTEM] MRxSmb

Service D:\WINDOWS\System32\msdtc.exe [MANUAL] MSDTC

Service [sYSTEM] Msfs

Service D:\WINDOWS\System32\msiexec.exe [MANUAL] MSIServer

Service D:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV

Service D:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK

Service D:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM

Service [bOOT] Mup

Service D:\WINDOWS\System32\Drivers\iqvw32.sys [MANUAL] NAL

Service [bOOT] NDIS

Service D:\WINDOWS\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi

Service D:\WINDOWS\System32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio

Service D:\WINDOWS\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan

Service [MANUAL] NDProxy

Service D:\WINDOWS\System32\DRIVERS\netbios.sys [sYSTEM] NetBIOS

Service D:\WINDOWS\System32\DRIVERS\netbt.sys [MANUAL] NetBT

Service D:\WINDOWS\system32\netdde.exe [MANUAL] NetDDE

Service D:\WINDOWS\system32\netdde.exe [MANUAL] NetDDEdsdm

Service D:\WINDOWS\System32\lsass.exe [MANUAL] Netlogon

Service D:\WINDOWS\System32\svchost.exe [MANUAL] Netman

Service D:\WINDOWS\System32\DRIVERS\nic1394.sys [MANUAL] NIC1394

Service D:\WINDOWS\System32\svchost.exe [MANUAL] Nla

Service [sYSTEM] Npfs

Service [DISABLED] Ntfs

Service D:\WINDOWS\System32\lsass.exe [MANUAL] NtLmSsp

Service D:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc

Service [sYSTEM] Null

Service D:\WINDOWS\System32\DRIVERS\nv4_mini.sys [MANUAL] nv

Service D:\WINDOWS\System32\nvsvc32.exe [AUTO] NVSvc

Service D:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt

Service D:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd

Service D:\WINDOWS\System32\DRIVERS\ohci1394.sys [bOOT] ohci1394

Service D:\WINDOWS\System32\DRIVERS\parport.sys [MANUAL] Parport

Service [bOOT] PartMgr

Service [AUTO] ParVdm

Service D:\WINDOWS\System32\DRIVERS\pci.sys [bOOT] PCI

Service [sYSTEM] PCIDump

Service D:\WINDOWS\System32\DRIVERS\pciide.sys [bOOT] PCIIde

Service [DISABLED] Pcmcia

Service [MANUAL] PDCOMP

Service [MANUAL] PDFRAME

Service [MANUAL] PDRELI

Service [MANUAL] PDRFRAME

Service [DISABLED] perc2

Service [DISABLED] perc2hib

Service PerfDisk

Service PerfNet

Service PerfOS

Service PerfProc

Service D:\WINDOWS\system32\services.exe [AUTO] PlugPlay

Service D:\WINDOWS\System32\lsass.exe [AUTO] PolicyAgent

Service D:\WINDOWS\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport

Service D:\WINDOWS\System32\DRIVERS\processr.sys [sYSTEM] Processor

Service D:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage

Service D:\WINDOWS\System32\DRIVERS\psched.sys [MANUAL] PSched

Service D:\WINDOWS\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink

Service D:\WINDOWS\System32\Drivers\PxHelp20.sys [bOOT] PxHelp20

Service [DISABLED] ql1080

Service [DISABLED] Ql10wnt

Service [DISABLED] ql12160

Service [DISABLED] ql1240

Service [DISABLED] ql1280

Service D:\WINDOWS\System32\DRIVERS\rasacd.sys [sYSTEM] RasAcd

Service D:\WINDOWS\System32\svchost.exe [MANUAL] RasAuto

Service D:\WINDOWS\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp

Service D:\WINDOWS\System32\svchost.exe [MANUAL] RasMan

Service D:\WINDOWS\System32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe

Service D:\WINDOWS\System32\DRIVERS\raspti.sys [MANUAL] Raspti

Service D:\WINDOWS\System32\DRIVERS\rdbss.sys [sYSTEM] Rdbss

Service D:\WINDOWS\System32\DRIVERS\RDPCDD.sys [sYSTEM] RDPCDD

Service RDPDD

Service D:\WINDOWS\System32\DRIVERS\rdpdr.sys [MANUAL] rdpdr

Service RDPNP

Service [MANUAL] RDPWD

Service D:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr

Service D:\WINDOWS\System32\DRIVERS\redbook.sys [sYSTEM] redbook

Service D:\WINDOWS\System32\svchost.exe [DISABLED] RemoteAccess

Service D:\WINDOWS\system32\svchost.exe [AUTO] RemoteRegistry

Service D:\WINDOWS\System32\locator.exe [MANUAL] RpcLocator

Service D:\WINDOWS\system32\svchost.exe [AUTO] RpcSs

Service D:\WINDOWS\System32\rsvp.exe [MANUAL] RSVP

Service D:\WINDOWS\system32\lsass.exe [AUTO] SamSs

Service D:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardDrv

Service D:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr

Service D:\WINDOWS\System32\svchost.exe [AUTO] Schedule

Service D:\WINDOWS\System32\DRIVERS\secdrv.sys [MANUAL] Secdrv

Service D:\WINDOWS\System32\svchost.exe [AUTO] seclogon

Service D:\WINDOWS\system32\svchost.exe [AUTO] SENS

Service D:\WINDOWS\System32\DRIVERS\serenum.sys [MANUAL] serenum

Service D:\WINDOWS\System32\DRIVERS\serial.sys [sYSTEM] Serial

Service [sYSTEM] Sfloppy

Service D:\WINDOWS\system32\drivers\sfng32.sys [MANUAL] sfng32

Service D:\WINDOWS\system32\svchost.exe [AUTO] SharedAccess

Service D:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection

Service [DISABLED] Simbad

Service [DISABLED] Sparrow

Service D:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter

Service D:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler

Service D:\WINDOWS\System32\DRIVERS\sr.sys [bOOT] sr

Service D:\WINDOWS\System32\svchost.exe [AUTO] srservice

Service D:\WINDOWS\System32\DRIVERS\srv.sys [MANUAL] Srv

Service D:\WINDOWS\System32\svchost.exe [DISABLED] SSDPSRV

Service D:\WINDOWS\system32\drivers\sthda.sys [MANUAL] STHDA

Service D:\WINDOWS\System32\svchost.exe [AUTO] stisvc

Service D:\WINDOWS\System32\DRIVERS\swenum.sys [MANUAL] swenum

Service D:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi

Service D:\WINDOWS\System32\dllhost.exe [MANUAL] SwPrv

Service [DISABLED] symc810

Service [DISABLED] symc8xx

Service [DISABLED] sym_hi

Service [DISABLED] sym_u3

Service D:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio

Service D:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog

Service D:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv

Service D:\WINDOWS\System32\DRIVERS\tcpip.sys [sYSTEM] Tcpip

Service [MANUAL] TDPIPE

Service [MANUAL] TDTCP

Service D:\WINDOWS\System32\DRIVERS\termdd.sys [sYSTEM] TermDD

Service D:\WINDOWS\System32\svchost.exe [MANUAL] TermService

Service D:\WINDOWS\System32\svchost.exe [AUTO] Themes

Service D:\WINDOWS\System32\tlntsvr.exe [DISABLED] TlntSvr

Service [DISABLED] TosIde

Service D:\WINDOWS\system32\svchost.exe [AUTO] TrkWks

Service TSDDD

Service [DISABLED] Udfs

Service [DISABLED] ultra

Service D:\WINDOWS\System32\DRIVERS\update.sys [MANUAL] Update

Service D:\WINDOWS\System32\svchost.exe [AUTO] uploadmgr

Service D:\WINDOWS\System32\svchost.exe [DISABLED] upnphost

Service D:\WINDOWS\System32\ups.exe [MANUAL] UPS

Service D:\WINDOWS\System32\DRIVERS\usbccgp.sys [MANUAL] usbccgp

Service D:\WINDOWS\System32\DRIVERS\usbehci.sys [MANUAL] usbehci

Service D:\WINDOWS\System32\DRIVERS\usbhub.sys [MANUAL] usbhub

Service D:\WINDOWS\System32\DRIVERS\usbprint.sys [MANUAL] usbprint

Service D:\WINDOWS\System32\DRIVERS\usbscan.sys [MANUAL] usbscan

Service D:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR

Service D:\WINDOWS\System32\DRIVERS\usbuhci.sys [MANUAL] usbuhci

Service D:\WINDOWS\System32\drivers\vga.sys [sYSTEM] VgaSave

Service [DISABLED] ViaIde

Service [bOOT] VolSnap

Service D:\WINDOWS\System32\vssvc.exe [MANUAL] VSS

Service D:\WINDOWS\System32\svchost.exe [AUTO] W32Time

Service W3SVC

Service D:\WINDOWS\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp

Service [MANUAL] WDICA

Service D:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud

Service D:\WINDOWS\System32\svchost.exe [AUTO] WebClient

Service D:\WINDOWS\system32\svchost.exe [AUTO] winmgmt

Service [MANUAL] Winsock

Service WinSock2

Service WinTrust

Service D:\WINDOWS\System32\svchost.exe [AUTO] WmdmPmSp

Service D:\WINDOWS\System32\svchost.exe [MANUAL] Wmi

Service WmiApRpl

Service D:\WINDOWS\System32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv

Service D:\WINDOWS\system32\svchost.exe [AUTO] wuauserv

Service D:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC

Service [MANUAL] XTrapD12

Service {138A256D-102C-411F-99D4-D1180D659538}

Service {567FB52A-5A3B-486C-B028-7A9EFDA0B443}

---- EOF - GMER 1.0.12 ----

adam9870 · 30 Marzec 2007 15:11

Logi z Gmer’a są w porządku.

Pokaż nowy log z ComboFix.

Poszukaj plików minidump, a jeśli będą to wklej najlepiej zawartość kilku:

http://forum.dobreprogramy.pl/viewtopic … 977#797977