prosim o kontrolu chyba winlogon.exe

[sromatko]

mam problem jakmile zapnu antivir nod32 vyběhne mi hned nalezen wirus v system32\iifdabby.dll s komentařem The file can be deleted. It is strongly recommended that you back up any crucial data before you proceed. Event occurred at an attempt to access the file by the application: \??\C:\WINDOWS\system32\winlogon.exe. nejde to uložit do karanteny a brzdi to strašně pc


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:56, on 23.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\KEMailKb\KEMailKb.EXE
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Cyberlink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SensorsView\drv\svsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Opera\opera.exe
C:\Program Files\ESET\nod32.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [KEMailKb] C:\PROGRA~1\KEMailKb\KEMailKb.EXE
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [f4e5d9a3] rundll32.exe "C:\WINDOWS\system32\aunefunf.dll",b
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [BMf7d6ea3f] Rundll32.exe "C:\WINDOWS\system32\lpfgdagq.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O4 - HKLM\..\Policies\Explorer\Run: [vpnxgv] C:\DOCUME~1\TOM~1\LOCALS~1\Temp\vpnxgv.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22BC71EE-1393-4ABE-95AC-045640947945}: NameServer = 193.179.143.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D98E99E-0A75-48E1-AA00-4C67824F85AF}: NameServer = 193.179.143.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{22BC71EE-1393-4ABE-95AC-045640947945}: NameServer = 193.179.143.3
O17 - HKLM\System\CS2\Services\Tcpip\..\{22BC71EE-1393-4ABE-95AC-045640947945}: NameServer = 193.179.143.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: msvb - {A255E748-4DA8-432B-9542-F765EE32BC3E} - (no file)
O21 - SSODL: sysdx - {6C7478FB-05C1-4192-85E2-4DFE32ABE891} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Unknown owner - D:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe (file missing)
O23 - Service: Sensor View Service (sviewsvc) - Unknown owner - C:\Program Files\SensorsView\drv\svsvc.exe

--
End of file - 6463 bytes

[Reklama]

[zlobyl]

Ahoj, vítám tě tu na PC-Help.


Použij ComboFix: (před jeho aplikací si však vypni všechny rezidentní štíty)

Stáhni ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[sromatko]

tak combofix jsem provedl poprve v nouzovem režimu ale nevitvořil žadny soubor.tak jsem to skusil v normalnim režimu a to mi ted piše nejakou chybu

[zlobyl]

ComboFix se má spouštět v normálním režimu.

Zkus Start-Spustit a napiš ComboFix[mezera]/u

ComboFix by se měl odinstalovat a pak bys ho mohl znovu zkusit použít.


Pokud to nepomůže, tak bys mohl napsat, jakou hlášku ti to vyhazuje.

[sromatko]

tak mam ale už po prvnim použiti ta chyba přestala pak jsem cely system skontroloval nodem a už šly vylečit nejake soubory a vše je ted v klidku ale pro jistotu sem davam ten vytah z combofix

(21:57:24)(MainThread)(Alert) main: -> ###################### Log started ######################
(21:57:24)(MainThread)(Informal) main.engine.start: -> Starting thread
(21:57:24)(MainThread)(Informal) main.engine.start: -> Thread init done
(21:57:24)(WorkThread)(Informal) Thread.run.VolumeManager: -> Found new volume
-VolumeName: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(21:57:24)(WorkThread)(Informal) Thread.run.VolumeManager.CDefragVolume::start: -> Attaching InterferenceProtector to volume
-volume: \??\Volume{15554038-ccc5-11db-b71b-806d6172696f}

(21:57:24)(WorkThread)(Informal) Thread.run.VolumeManager.DefragVolumeManager: -> Adding volume.
-Name: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\
-Drive Path: C:\
-Filesystem: NTFS

(21:57:25)(WorkThread)(Informal) Thread.run.VolumeManager.DefragVolumeManager.DefragVolumeManager: -> Registered change notification for volume.
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(21:57:25)(WorkThread)(Informal) Thread.run: -> Starting new defragmentation
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(21:57:25)(WorkThread)(Informal) Thread.run.Defragger: -> Begin work
-State: 0
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(21:57:25)(WorkThread)(Informal) Thread.run.Defragger: -> Initializing volume state
(21:57:25)(WorkThread)(Informal) Thread.run.Defragger.VolumeState: -> Marking file as unmovable.
-FileID: 281474976710656
-Path: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\$MFT

(21:57:29)(WorkThread)(Informal) Thread.run.Defragger.CDesktopActivityMonitorManager: -> New session found
-sessionid: 0
-status: WTSDisconnected
-name:

(21:57:29)(WorkThread)(Error) Thread.run.Defragger.CDesktopActivityMonitorManager.CDesktopActivityMonitorManager: -> Error creating session avatar
-Error: BindToObjectFailed (-2147023174) for session 0

(21:57:29)(WorkThread)(Informal) Thread.run.Defragger.CDesktopActivityMonitorManager: -> New session found
-sessionid: 65536
-status: WTSListen
-name: RDP-Tcp

(21:57:29)(WorkThread)(Error) Thread.run.Defragger.CDesktopActivityMonitorManager.CDesktopActivityMonitorManager: -> Error creating session avatar
-Error: BindToObjectFailed (-2147023174) for session 65536

(21:57:29)(WorkThread)(Informal) Thread.run.Defragger.CDesktopActivityMonitorManager: -> New session found
-sessionid: 2
-status: WTSActive
-name: Console

(21:57:29)(WorkThread)(Error) Thread.run.Defragger.CDesktopActivityMonitorManager.CDesktopActivityMonitorManager: -> Error creating session avatar
-Error: BindToObjectFailed (-2147023174) for session 2

(21:57:29)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\pagefile.sys
-fileid: 23362423066984475
-error: NT (3221225539): sharing violation

(21:57:31)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\RECYCLER\S-1-5-21-1220945662-484061587-682003330-1003
-fileid: 1407374883565818
-error: NT (3221225485): invalid parameter

(21:57:34)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a
-fileid: 1407374883592653
-error: NT (3221225485): invalid parameter

(21:57:40)(WorkThread)(Informal) Thread.run.Defragger: -> Finished initializing volume state
-Don't use areas: (8768064..8858272)
-Total Clusters: 9727349

(21:57:40)(WorkThread)(Informal) Thread.run.Defragger.CDefragger: -> Enough free clusters found.
-Total clusters: 9727349
-Free clusters: 4964788
-Usable free clusters: 4874581
-Needed free clusters: 16

(21:57:40)(WorkThread)(Informal) Thread.run.Defragger: -> Compensating unmovable
(21:57:41)(WorkThread)(Informal) Thread.run.Defragger: -> Finished compensating unmovable
(21:57:41)(WorkThread)(Informal) Thread.run.Defragger: -> Creating target state
(21:57:42)(WorkThread)(Informal) Thread.run.Defragger: -> Finished creating target state
-WorstDesperation: 0

(21:57:42)(WorkThread)(Informal) Thread.run.Defragger: -> Uncompensating unmovable
(21:57:42)(WorkThread)(Informal) Thread.run.Defragger: -> Finished uncompensating unmovable.
(21:57:42)(WorkThread)(Informal) Thread.run.Defragger: -> Moving clusters
(21:58:01)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(21:58:01)(WorkThread)(Error) Thread.run.Defragger.ClusterMover: -> Error moving file.
-action: move to target
-file: 28428972647835538
-error: NT (3221225485): invalid parameter

(21:58:01)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(21:58:01)(WorkThread)(Error) Thread.run.Defragger.ClusterMover: -> Error moving file.
-action: move to target
-file: 28428972647835538
-error: NT (3221225485): invalid parameter

(21:58:07)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(21:58:07)(WorkThread)(Error) Thread.run.Defragger.ClusterMover: -> Error moving file.
-action: make free space
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\$MFTMirr
-error: Win32 (87)

(21:58:07)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(21:58:07)(WorkThread)(Error) Thread.run.Defragger.ClusterMover: -> Error moving file.
-action: move to target
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\$MFTMirr
-error: Win32 (87)

(21:58:13)(WorkThread)(Informal) Thread.run.Defragger: -> Finished moving clusters.
(21:58:14)(WorkThread)(Informal) Thread.run: -> Done defragging all volume for single run. Returning.
(21:58:14)(WorkThread)(Informal) Thread.run.DefragVolumeManager: -> Unregistered change notification for volume.
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(21:58:14)(WorkThread)(Informal) Thread.run: -> thread::run has finished
(21:58:14)(MainThread)(Informal) main.engine::cleanupAfterStop: -> thread ended. Deleting thread object.
(21:58:14)(MainThread)(Informal) main.engine::cleanupAfterStop: -> Thread object deleted.
(21:58:19)(MainThread)(Informal) main.Engine destructor: -> Calling stop.
(21:58:19)(MainThread)(Informal) main.Engine destructor: -> Deleting config.
(21:58:19)(MainThread)(Informal) main.Engine destructor: -> Engine destructor finished.
(08:07:44)(MainThread)(Alert) main: -> ###################### Log started ######################
(08:07:44)(MainThread)(Informal) main.engine.start: -> Starting thread
(08:07:44)(MainThread)(Informal) main.engine.start: -> Thread init done
(08:07:44)(WorkThread)(Informal) Thread.run.VolumeManager: -> Found new volume
-VolumeName: \\?\Volume{15554039-ccc5-11db-b71b-806d6172696f}\

(08:08:16)(WorkThread)(Informal) Thread.run.VolumeManager.CDefragVolume::start: -> Attaching InterferenceProtector to volume
-volume: \??\Volume{15554039-ccc5-11db-b71b-806d6172696f}

(08:08:16)(WorkThread)(Informal) Thread.run.VolumeManager.DefragVolumeManager: -> Adding volume.
-Name: \\?\Volume{15554039-ccc5-11db-b71b-806d6172696f}\
-Drive Path: D:\
-Filesystem: NTFS

(08:08:16)(WorkThread)(Informal) Thread.run.VolumeManager.DefragVolumeManager.DefragVolumeManager: -> Registered change notification for volume.
-Volume: \\?\Volume{15554039-ccc5-11db-b71b-806d6172696f}\

(08:08:16)(WorkThread)(Informal) Thread.run: -> Starting new defragmentation
-Volume: \\?\Volume{15554039-ccc5-11db-b71b-806d6172696f}\

(08:08:16)(WorkThread)(Informal) Thread.run.Defragger: -> Begin work
-State: 0
-Volume: \\?\Volume{15554039-ccc5-11db-b71b-806d6172696f}\

(08:08:16)(WorkThread)(Informal) Thread.run.Defragger: -> Initializing volume state
(08:08:16)(WorkThread)(Informal) Thread.run.Defragger.VolumeState: -> Marking file as unmovable.
-FileID: 281474976710656
-Path: \\?\Volume{15554039-ccc5-11db-b71b-806d6172696f}\$MFT

(08:09:12)(WorkThread)(Informal) Thread.run.Defragger.CDesktopActivityMonitorManager: -> New session found
-sessionid: 0
-status: WTSActive
-name: Console

(08:09:12)(WorkThread)(Error) Thread.run.Defragger.CDesktopActivityMonitorManager.CDesktopActivityMonitorManager: -> Error creating session avatar
-Error: BindToObjectFailed (-2147221164) for session 0

(08:09:12)(WorkThread)(Informal) Thread.run.Defragger.CDesktopActivityMonitorManager: -> New session found
-sessionid: 65536
-status: WTSListen
-name: RDP-Tcp

(08:09:12)(WorkThread)(Error) Thread.run.Defragger.CDesktopActivityMonitorManager.CDesktopActivityMonitorManager: -> Error creating session avatar
-Error: BindToObjectFailed (-2147221164) for session 65536

(08:09:15)(WorkThread)(Informal) Thread.run.Defragger: -> Finished initializing volume state
-Don't use areas: (812512..874528)
-Total Clusters: 9801650

(08:09:15)(WorkThread)(Informal) Thread.run.Defragger.CDefragger: -> Enough free clusters found.
-Total clusters: 9801650
-Free clusters: 2249214
-Usable free clusters: 2187218
-Needed free clusters: 16

(08:09:15)(WorkThread)(Informal) Thread.run.Defragger: -> Compensating unmovable
(08:09:15)(WorkThread)(Informal) Thread.run.Defragger: -> Finished compensating unmovable
(08:09:15)(WorkThread)(Informal) Thread.run.Defragger: -> Creating target state
(08:09:17)(WorkThread)(Informal) Thread.run.Defragger: -> Finished creating target state
-WorstDesperation: 0

(08:09:17)(WorkThread)(Informal) Thread.run.Defragger: -> Uncompensating unmovable
(08:09:17)(WorkThread)(Informal) Thread.run.Defragger: -> Finished uncompensating unmovable.
(08:09:17)(WorkThread)(Informal) Thread.run.Defragger: -> Moving clusters
(08:28:49)(WorkThread)(Informal) Thread.run.Defragger: -> Finished moving clusters.
(08:28:49)(WorkThread)(Informal) Thread.run: -> Done defragging all volume for single run. Returning.
(08:28:49)(WorkThread)(Informal) Thread.run.DefragVolumeManager: -> Unregistered change notification for volume.
-Volume: \\?\Volume{15554039-ccc5-11db-b71b-806d6172696f}\

(08:28:49)(WorkThread)(Informal) Thread.run: -> thread::run has finished
(08:28:49)(MainThread)(Informal) main.engine::cleanupAfterStop: -> thread ended. Deleting thread object.
(08:28:49)(MainThread)(Informal) main.engine::cleanupAfterStop: -> Thread object deleted.
(08:54:02)(MainThread)(Informal) main.Engine destructor: -> Calling stop.
(08:54:02)(MainThread)(Informal) main.Engine destructor: -> Deleting config.
(08:54:02)(MainThread)(Informal) main.Engine destructor: -> Engine destructor finished.
(08:54:07)(MainThread)(Alert) main: -> ###################### Log started ######################
(08:54:07)(MainThread)(Informal) main.engine.start: -> Starting thread
(08:54:07)(MainThread)(Informal) main.engine.start: -> Thread init done
(08:54:07)(WorkThread)(Informal) Thread.run.VolumeManager: -> Found new volume
-VolumeName: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(08:54:07)(WorkThread)(Informal) Thread.run.VolumeManager.CDefragVolume::start: -> Attaching InterferenceProtector to volume
-volume: \??\Volume{15554038-ccc5-11db-b71b-806d6172696f}

(08:54:07)(WorkThread)(Informal) Thread.run.VolumeManager.DefragVolumeManager: -> Adding volume.
-Name: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\
-Drive Path: C:\
-Filesystem: NTFS

(08:54:07)(WorkThread)(Informal) Thread.run.VolumeManager.DefragVolumeManager.DefragVolumeManager: -> Registered change notification for volume.
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(08:54:07)(WorkThread)(Informal) Thread.run: -> Starting new defragmentation
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(08:54:07)(WorkThread)(Informal) Thread.run.Defragger: -> Begin work
-State: 0
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(08:54:07)(WorkThread)(Informal) Thread.run.Defragger: -> Initializing volume state
(08:54:07)(WorkThread)(Informal) Thread.run.Defragger.VolumeState: -> Marking file as unmovable.
-FileID: 281474976710656
-Path: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\$MFT

(08:54:14)(WorkThread)(Informal) Thread.run.Defragger.CDesktopActivityMonitorManager: -> New session found
-sessionid: 0
-status: WTSActive
-name: Console

(08:54:14)(WorkThread)(Error) Thread.run.Defragger.CDesktopActivityMonitorManager.CDesktopActivityMonitorManager: -> Error creating session avatar
-Error: BindToObjectFailed (-2147221164) for session 0

(08:54:14)(WorkThread)(Informal) Thread.run.Defragger.CDesktopActivityMonitorManager: -> New session found
-sessionid: 65536
-status: WTSListen
-name: RDP-Tcp

(08:54:14)(WorkThread)(Error) Thread.run.Defragger.CDesktopActivityMonitorManager.CDesktopActivityMonitorManager: -> Error creating session avatar
-Error: BindToObjectFailed (-2147221164) for session 65536

(08:54:15)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\hiberfil.sys
-fileid: 120189815055457439
-error: NT (3221225539): sharing violation

(08:54:16)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\RECYCLER\S-1-5-21-1220945662-484061587-682003330-1003
-fileid: 1407374883565818
-error: NT (3221225485): invalid parameter

(08:54:20)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a
-fileid: 1688849860303309
-error: NT (3221225485): invalid parameter

(08:54:22)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a
-fileid: 25051272927295910
-error: NT (3221225485): invalid parameter

(08:54:24)(WorkThread)(Error) Thread.run.Defragger.VolumeState: -> Error accessing file info.
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\pagefile.sys
-fileid: 13510798882171587
-error: NT (3221225539): sharing violation

(08:54:31)(WorkThread)(Informal) Thread.run.Defragger: -> Finished initializing volume state
-Don't use areas: (8268800..8576256)
-Total Clusters: 9727349

(08:54:31)(WorkThread)(Informal) Thread.run.Defragger.CDefragger: -> Enough free clusters found.
-Total clusters: 9727349
-Free clusters: 3470111
-Usable free clusters: 3433611
-Needed free clusters: 16

(08:54:31)(WorkThread)(Informal) Thread.run.Defragger: -> Compensating unmovable
(08:54:31)(WorkThread)(Informal) Thread.run.Defragger: -> Finished compensating unmovable
(08:54:31)(WorkThread)(Informal) Thread.run.Defragger: -> Creating target state
(08:54:35)(WorkThread)(Informal) Thread.run.Defragger: -> Finished creating target state
-WorstDesperation: 0

(08:54:35)(WorkThread)(Informal) Thread.run.Defragger: -> Uncompensating unmovable
(08:54:35)(WorkThread)(Informal) Thread.run.Defragger: -> Finished uncompensating unmovable.
(08:54:35)(WorkThread)(Informal) Thread.run.Defragger: -> Moving clusters
(08:58:48)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(08:59:11)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(08:59:42)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(08:59:42)(WorkThread)(Error) Thread.run.Defragger.ClusterMover: -> Error moving file.
-action: make free space
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\$MFTMirr
-error: Win32 (87)

(08:59:42)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(08:59:42)(WorkThread)(Error) Thread.run.Defragger.ClusterMover: -> Error moving file.
-action: move to target
-file: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\$MFTMirr
-error: Win32 (87)

(09:04:10)(WorkThread)(Informal) Thread.run.Defragger.ClusterMover: -> Updating physical free mask.
(09:08:19)(MainThread)(Informal) main.engine::stop: -> Calling runcontroller.signalStop.
(09:08:19)(WorkThread)(Informal) Thread.run.DefragVolumeManager: -> Unregistered change notification for volume.
-Volume: \\?\Volume{15554038-ccc5-11db-b71b-806d6172696f}\

(09:08:19)(WorkThread)(Informal) Thread.run: -> thread::run has finished
(09:08:19)(MainThread)(Informal) main.engine::stop.engine::cleanupAfterStop: -> thread ended. Deleting thread object.
(09:08:19)(MainThread)(Informal) main.engine::stop.engine::cleanupAfterStop: -> Thread object deleted.
(09:08:21)(MainThread)(Informal) main.Engine destructor: -> Calling stop.
(09:08:21)(MainThread)(Informal) main.Engine destructor: -> Deleting config.
(09:08:21)(MainThread)(Informal) main.Engine destructor: -> Engine destructor finished.

[zlobyl]

Tohle není podle mě log z ComboFixu.

Ale pokud se problém vyřešil, tak jsem jedině rád.