Windows XP bardzo niestabilny

[figurel]

System - Windows XP SP3 - jest bardzo niestabilny, brak wpisów w Menu Start, czyste pole, brak wpisów o nowo zainstalowanyck programach (w menu Wszystkie Programy), wielokrotnie informuje, że rundll32.exe zostanie zamknięty, nie można np. otworzyć Menadżera Urzadzeń bo rundll32.exe nie odpowiada. Nie moge pobrac aktualizacji, OTL mogę uruchomić jedynie w trybie awaryjnym, nie zapamiętuje ustawień np. paska szybkiego uruchamiania, po restarcie już go nie ma. I wiele innych.

Moze to wirus? Prosiłbym o pomoc, chciałbym uniknąć formatowania dysku, jest trzech użytkowników, każdy ma swoje konto, hasła, masakra z odtwarzaniem wszystkiego. Załączam logi.

OTL.Txt

Extras.Txt

[picasso]

W systemie widać owszem adware (WebSearch i kilka innych śmieci) oraz odpadki po antywirusach (CA Internet Security Suite / Symantec), ale na razie nie ma sensu tego czyścić, gdyż środowisko konta nie jest wiarygodne:

 

Jeśli rzecz o niepamiętaniu ustawień oraz pustym Menu Start, to problemem zapewne jest uszkodzenie odnośników folderów powłoki i problem z dostępnością profilu. Świadczą o tym te wpisy w raporcie OTL (Startup widać w taki sposób, gdy są złe ścieżki folderów):

 

 

 

O4 - Startup: C:\Documents and Settings\Administrator\Cookies [2008-07-12 11:26:27 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\Administrator\Dane aplikacji [2011-05-19 12:40:37 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Administrator\IETldCache [2011-05-19 12:40:34 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\Administrator\Menu Start [2008-07-12 13:11:02 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Administrator\Moje dokumenty [2011-05-19 12:40:42 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Administrator\NetHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Administrator\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Administrator\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Administrator\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Administrator\PrintHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Administrator\Pulpit [2008-07-12 13:11:02 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Administrator\Recent [2011-05-19 12:40:42 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Administrator\SendTo [2011-05-19 12:40:51 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Administrator\Szablony [2008-07-12 11:21:46 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Administrator\Ulubione [2011-05-19 12:40:43 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Administrator\Ustawienia lokalne [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\All Users\Dane aplikacji [2013-06-14 20:48:19 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\All Users\Dokumenty [2013-04-22 20:44:43 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\All Users\DRM [2011-03-11 21:13:51 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\All Users\Menu Start [2013-04-22 22:33:37 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\All Users\Pulpit [2013-06-14 20:37:23 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\All Users\Szablony [2013-05-04 12:34:13 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\All Users\Ulubione [2008-07-12 13:11:02 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Beata\Cookies [2011-06-18 20:18:13 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\Beata\Dane aplikacji [2012-02-21 21:41:44 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Beata\Gadu-Gadu [2013-05-24 00:16:37 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Beata\IETldCache [2011-01-07 22:45:38 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\Beata\Menu Start [2008-07-12 13:11:02 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Beata\Moje dokumenty [2013-05-19 18:12:07 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Beata\NetHood [2009-11-28 11:07:24 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Beata\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\Beata\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Beata\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Beata\PrintHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Beata\PrivacIE [2011-01-07 22:46:45 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\Beata\Pulpit [2013-05-19 18:10:25 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Beata\Recent [2011-01-25 21:20:59 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Beata\SendTo [2008-07-22 21:19:10 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Beata\Szablony [2008-07-12 11:21:46 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Beata\Ulubione [2011-01-07 22:45:41 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Beata\UserData [2009-10-05 18:47:40 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Beata\Ustawienia lokalne [2011-06-18 20:18:11 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Cookies [2008-07-12 11:26:27 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Default User\Dane aplikacji [2013-05-02 20:07:06 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Menu Start [2008-07-12 13:11:02 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Default User\Moje dokumenty [2008-07-12 13:11:02 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Default User\NetHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Default User\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Default User\PrintHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Pulpit [2008-07-12 13:11:02 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Default User\Recent [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\SendTo [2008-07-12 11:23:54 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Szablony [2008-07-12 11:21:46 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Ulubione [2008-07-12 13:11:02 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Default User\Ustawienia lokalne [2008-07-12 13:11:02 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Dominika\.gstreamer-0.10 [2012-07-03 22:35:10 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika\AppData [2012-08-27 18:36:10 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika\Cookies [2013-05-12 21:25:14 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Dominika\Dane aplikacji [2013-05-05 21:25:52 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Dominika\Gadu-Gadu [2013-05-24 00:15:46 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika\IETldCache [2011-01-05 17:26:24 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\Dominika\Menu Start [2012-08-27 19:01:21 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Dominika\Moje dokumenty [2013-06-14 22:30:31 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Dominika\NetHood [2012-06-14 22:41:39 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\Dominika\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Dominika\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Dominika\PrintHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika\PrivacIE [2011-01-05 23:32:09 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\Dominika\Pulpit [2013-06-14 22:33:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika\Recent [2013-05-16 21:51:08 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Dominika\SendTo [2010-12-20 22:34:47 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Dominika\Szablony [2012-08-28 00:14:41 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika\Ulubione [2010-02-25 23:12:08 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Dominika\UserData [2012-09-01 15:16:11 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Dominika\Ustawienia lokalne [2013-03-09 23:53:28 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Cookies [2013-06-14 19:41:36 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Dane aplikacji [2013-06-14 20:02:10 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Menu Start [2013-05-19 17:29:34 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Moje dokumenty [2013-06-14 19:59:32 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\NetHood [2013-06-14 19:41:36 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Pulpit [2013-06-15 07:45:57 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Recent [2013-06-14 19:43:12 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Szablony [2013-05-20 15:48:57 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Ulubione [2013-06-05 22:51:56 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Dominika.RODZINA-9D15E03.000\Ustawienia lokalne [2013-05-21 18:12:27 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\LocalService\Cookies [2008-07-12 11:28:02 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\LocalService\Dane aplikacji [2013-05-02 20:04:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\LocalService\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\LocalService\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\LocalService\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\LocalService\Pulpit [2009-02-28 16:08:08 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\LocalService\Ustawienia lokalne [2008-07-12 11:28:01 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Cookies [2008-07-12 11:26:27 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Dane aplikacji [2013-05-06 21:23:35 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Menu Start [2008-07-12 13:11:02 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Moje dokumenty [2013-05-05 21:15:46 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\NetHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\PrintHood [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Pulpit [2013-05-06 21:25:53 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Recent [2013-05-05 21:15:45 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\SendTo [2013-05-05 20:49:57 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Szablony [2008-07-12 11:21:46 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Ulubione [2013-05-05 20:49:46 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Martyna.RODZINA-9D15E03\Ustawienia lokalne [2008-07-12 13:11:02 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\NetworkService\Cookies [2008-08-28 21:05:37 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\NetworkService\Dane aplikacji [2008-07-12 11:27:38 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\NetworkService\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\NetworkService\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\NetworkService\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\NetworkService\Ustawienia lokalne [2008-07-12 11:27:39 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\TEMP\Cookies [2013-05-02 20:06:14 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\TEMP\Dane aplikacji [2013-05-02 20:13:19 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\TEMP\Menu Start [2013-05-02 20:12:21 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\TEMP\Moje dokumenty [2013-05-02 20:15:27 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\TEMP\Recent [2013-05-02 20:15:15 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\TEMP\Ulubione [2013-05-02 20:06:28 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\TEMP\Ustawienia lokalne [2013-05-02 20:06:28 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\TEMP.RODZINA-9D15E03\Cookies [2013-05-19 17:21:38 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\TEMP.RODZINA-9D15E03\Dane aplikacji [2013-05-19 17:26:29 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\TEMP.RODZINA-9D15E03\Ustawienia lokalne [2013-05-19 17:21:38 | 000,000,000 | ---D | M]

 

 

 

Widać również, że foldery kont się replikują wg takiego modelu:

 

C:\Documents and Settings\Dominika

C:\Documents and Settings\Dominika.RODZINA-9D15E03

 

Utworzyły się też foldery tymczasowe (zastępcze) któregoś konta:

 

C:\Documents and Settings\TEMP

C:\Documents and Settings\TEMP.RODZINA-9D15E03

 

To wszystko świadczy, że jest problem z dostępem do właściwego katalogu konta. Podobny temat: KLIK. Wstępnie podaj mi dodatkowe raporty:

 

1. Uruchom sid.vbs i podaj log: KLIK (punkt 3).

 

2. Uruchom SystemLook i w oknie wklej:

 

:reg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

 

Klik w Look i przedstaw log.

 

 

 

 

.