Avast wykrywa infekcje explorer nie otwiera stron

**Posty:** 250 · przez **tenzin** 31 Maj 2010, 19:37

witam,
na drugim kompie, pojawiaja sie liczne nieprowidlowosci w dzialaniu systemu.
Aavast wykrywa liczne infekcje. Nie dziala litera "e" z ogonkiem.Inne polskie litery działają.
Przy próbie wystukania tej litery (alt+e) otwiera sie strona:clk.tradedoubler.
Poza tym przez dlugi czas system nie chcial pobierac zadnych plikow, okazalo sie, ze po wylaczeniu ochrony dostepowej avasta system zaczal normalnie pobierac.
Co dziwne, mimo wylaczenia ochrony dostepowej avast nadal wykrywa infekcje i pyta czy podjac dzialanie.

Logi:
Nie posiadam programow emulujacych, proba uruchomienia: SPTDinst-v162-x86.exe zakonczyla sie informacja: No SPTD version was detected.

Wielokrotne podjete proby uruchomienia GMERA zakonczyly sie niepowodzeniem (program sciagnalem kilka razy, rowniez wersje zip).Program jakby uruchmaial sie po czym znikal z Menedzera zadan.
Ponoc tez na pendrivie podlaczonym do tego kompa sa jakies wirusy, ale nie wiem jak to sprawdzic)

Raport z OTL (bez extras, nie wiem dlaczego):

Kod: Zaznacz wszystko: OTL logfile created on: 2010-05-31 19:23:34 - Run 2 OTL by OldTimer - Version 3.2.5.2 Folder = C:\Documents and Settings\x\Pulpit\Grzegorz Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 894,00 Mb Total Physical Memory | 453,00 Mb Available Physical Memory | 51,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 70,00% Paging File free Paging file location(s): C:\pagefile.sys 1344 2688 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 55,89 Gb Total Space | 36,51 Gb Free Space | 65,33% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 1,88 Gb Total Space | 1,66 Gb Free Space | 88,40% Space Free | Partition Type: FAT F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: YOUR-809F4D2AF6 Current User Name: x Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-05-31 19:23:03 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Pulpit\Grzegorz\OTL.exe PRC - [2009-08-17 18:07:23 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-08-17 18:07:17 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-08-17 17:58:55 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2009-01-21 14:08:06 | 001,095,560 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsSvc.exe PRC - [2009-01-07 13:40:56 | 000,348,752 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe PRC - [2008-12-08 14:33:48 | 001,173,384 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsTray.exe PRC - [2008-08-12 12:23:18 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2008-04-14 19:21:16 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007-04-02 14:15:40 | 000,061,440 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTDevSrv.exe PRC - [2007-03-12 12:22:00 | 000,517,768 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe PRC - [2006-08-03 18:40:26 | 000,100,032 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe PRC - [2006-01-28 06:13:58 | 001,589,248 | ---- | M] (TOSHIBA Inc.) -- C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe PRC - [2005-12-22 16:34:22 | 001,077,329 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\Touch and Launch\PadExe.exe PRC - [2005-12-17 01:21:00 | 000,151,552 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\Toshiba.exe PRC - [2005-11-18 00:44:38 | 000,798,720 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSServ.exe PRC - [2005-11-03 01:41:04 | 000,978,944 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\NDSTray.exe PRC - [2005-10-06 06:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE PRC - [2005-05-13 12:03:16 | 000,118,784 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe PRC - [2005-04-12 13:04:18 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe PRC - [2005-01-18 01:38:38 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-05-31 19:23:03 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Pulpit\Grzegorz\OTL.exe MOD - [2010-05-31 19:17:13 | 000,070,656 | RHS- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\temp\nodqq0.dll MOD - [2009-02-13 15:11:44 | 000,100,864 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\klg.dat MOD - [2008-11-13 15:19:40 | 000,148,944 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\smum32.dll MOD - [2008-04-14 19:16:32 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-08-17 18:07:17 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-08-17 18:07:01 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-08-17 18:04:21 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-08-17 17:58:55 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2009-01-21 14:08:06 | 001,095,560 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService) SRV - [2009-01-07 13:40:56 | 000,348,752 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService) SRV - [2007-04-02 14:15:40 | 000,061,440 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTDevSrv.exe -- (CTDevice_Srv) SRV - [2006-08-03 18:40:26 | 002,119,360 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate) SRV - [2006-08-03 18:40:26 | 000,100,032 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Harmonogram automatycznej usługi LiveUpdate) SRV - [2005-07-08 01:13:14 | 000,036,864 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\acs.exe -- (ACS) SRV - [2005-01-18 01:38:38 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-08-17 18:06:43 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-08-17 18:05:52 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2009-08-17 18:05:37 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-08-17 18:04:40 | 000,051,376 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-08-17 18:04:29 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-08-17 18:03:21 | 000,026,944 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2009-04-03 12:18:26 | 000,130,936 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore) DRV - [2006-01-12 17:21:18 | 000,031,872 | ---- | M] (Quanta Computer, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\qkbfiltr.sys -- (qkbfiltr) DRV - [2005-12-17 01:15:06 | 000,191,936 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP) DRV - [2005-12-12 07:40:44 | 001,414,656 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2005-11-29 23:51:34 | 000,936,960 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV) DRV - [2005-11-29 23:50:48 | 000,225,792 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWATI.sys -- (HSFHWATI) DRV - [2005-11-29 23:50:46 | 000,669,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf) DRV - [2005-10-06 06:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM) DRV - [2005-10-06 06:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M) DRV - [2005-10-06 06:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M) DRV - [2005-10-06 06:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM) DRV - [2005-10-06 06:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM) DRV - [2005-10-06 06:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM) DRV - [2005-10-06 06:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN) DRV - [2005-09-13 04:08:30 | 000,468,736 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2005-09-12 04:30:00 | 000,089,264 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB) DRV - [2005-08-25 13:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM) DRV - [2005-08-25 13:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N) DRV - [2005-08-12 06:20:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM) DRV - [2005-06-17 09:17:48 | 000,352,000 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6hal.sys -- (CAMCHALA) DRV - [2005-06-17 09:17:00 | 000,038,144 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6aud.sys -- (CAMCAUD) DRV - [2005-06-11 06:42:00 | 000,005,504 | ---- | M] (Quanta Computer Corp) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BoiHwSetup.sys -- (BoiHwsetup) DRV - [2005-05-05 15:27:38 | 000,007,936 | ---- | M] (Quanta Computer, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\qmofiltr.sys -- (qmofiltr) DRV - [2005-03-04 20:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) DRV - [2004-08-04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2003-09-19 02:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc) DRV - [2003-09-11 00:36:54 | 000,021,060 | ---- | M] (InterVideo, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iviaspi.sys -- (Iviaspi) DRV - [2003-01-29 23:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2004-08-04 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll (GG Network S.A.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O3 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found. O3 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [CFSServ.exe] File not found O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions) O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools) O4 - HKLM..\Run: [NDSTray.exe] File not found O4 - HKLM..\Run: [PadTouch] C:\Program Files\Toshiba\Touch and Launch\PadExe.exe (TOSHIBA) O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation) O4 - HKLM..\Run: [Toshiba Hotkey Utility] C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe (TOSHIBA Inc.) O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation) O4 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.) O4 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006..\Run: [nod32] C:\Documents and Settings\x\Ustawienia lokalne\temp\nodqq.exe () O4 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0 O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0 O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1 O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O7 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll (Google Inc.) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 89.228.7.228 217.172.224.160 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-02-17 09:35:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-05-31 19:23:44 | 000,000,063 | RHS- | M] () - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-05-31 19:23:46 | 000,000,063 | RHS- | M] () - E:\autorun.inf -- [ FAT ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] File not found -- C:\Documents and Settings\x\Pulpit\CAELVHKO. [2010-05-13 20:31:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Pulpit\duuuuuupa [2010-05-13 20:31:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Nowy folder [2010-05-13 20:29:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\VDownloader [2010-05-13 20:29:36 | 000,000,000 | ---D | C] -- C:\Program Files\VDownloader [2010-05-13 20:28:52 | 006,940,800 | ---- | C] (Vitzo Limited ) -- C:\Documents and Settings\x\Pulpit\vdownloadersetup2.7_[www.programosy.pl].exe [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] File not found -- C:\Documents and Settings\x\Pulpit\CAELVHKO. [2010-05-31 19:25:51 | 000,000,063 | RHS- | M] () -- C:\autorun.inf [2010-05-31 19:20:00 | 000,001,036 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010-05-31 19:16:03 | 000,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010-05-31 19:15:59 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-05-31 19:15:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-05-31 19:15:49 | 937,742,336 | -HS- | M] () -- C:\hiberfil.sys [2010-05-31 19:14:38 | 006,029,312 | ---- | M] () -- C:\Documents and Settings\x\ntuser.dat [2010-05-31 19:14:38 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\x\ntuser.ini [2010-05-31 18:50:39 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\justyna.doc [2010-05-31 15:58:43 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-05-30 18:42:36 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\prosba o zatwierdzenie - kl 2 i 3.doc [2010-05-26 20:18:25 | 000,023,552 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\33- 25.05.10 - organizacja zajÄ™Ä‡[1].doc [2010-05-26 19:54:53 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\klas kl I.doc [2010-05-25 19:44:03 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2010-05-25 19:44:03 | 000,000,762 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Gadu-Gadu 10.lnk [2010-05-24 16:56:42 | 043,870,568 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\setuppol.exe [2010-05-20 19:08:45 | 000,033,792 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-05-18 20:32:13 | 000,024,576 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\sprawdzian II kl.doc [2010-05-14 19:45:02 | 000,057,344 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\scenariusz lekcji_Cuda dzisiaj.doc [2010-05-14 19:44:53 | 000,036,864 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Czy Bóg może działać cuda także w moim życiu.doc [2010-05-14 19:39:40 | 000,015,400 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Czy Bóg może działać cuda także w moim życiu_ - scenariusz katechezy.zip [2010-05-13 21:45:07 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010-05-13 20:29:39 | 000,001,538 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\VDownloader.lnk [2010-05-13 20:28:52 | 006,940,800 | ---- | M] (Vitzo Limited ) -- C:\Documents and Settings\x\Pulpit\vdownloadersetup2.7_[www.programosy.pl].exe [2010-05-12 21:39:19 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010-05-08 19:23:23 | 000,011,727 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\podreczniki_i_programy.zip [2010-05-07 15:11:12 | 000,111,616 | RHS- | M] () -- C:\i8ikdjwt.exe [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-05-31 18:40:46 | 000,111,616 | RHS- | C] () -- C:\i8ikdjwt.exe [2010-05-31 18:40:46 | 000,000,063 | RHS- | C] () -- C:\autorun.inf [2010-05-31 18:39:51 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\justyna.doc [2010-05-28 19:29:21 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\prosba o zatwierdzenie - kl 2 i 3.doc [2010-05-26 20:18:24 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\33- 25.05.10 - organizacja zajÄ™Ä‡[1].doc [2010-05-26 19:46:27 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\klas kl I.doc [2010-05-14 19:45:02 | 000,057,344 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\scenariusz lekcji_Cuda dzisiaj.doc [2010-05-14 19:44:53 | 000,036,864 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Czy Bóg może działać cuda także w moim życiu.doc [2010-05-14 19:39:40 | 000,015,400 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Czy Bóg może działać cuda także w moim życiu_ - scenariusz katechezy.zip [2010-05-13 21:46:49 | 000,094,000 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2010-05-13 20:29:39 | 000,001,538 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\VDownloader.lnk [2010-05-13 20:29:39 | 000,000,178 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\eBay.url [2010-05-13 20:29:38 | 000,026,694 | ---- | C] () -- C:\WINDOWS\System32\eBay.ico [2010-05-12 21:33:34 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\sprawdzian II kl.doc [2010-05-08 19:23:21 | 000,011,727 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\podreczniki_i_programy.zip [2009-09-11 19:34:00 | 000,000,030 | ---- | C] () -- C:\WINDOWS\TextSpy.ini [2009-05-12 18:42:40 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-02-18 10:27:11 | 000,000,206 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2008-11-01 20:33:10 | 000,000,012 | ---- | C] () -- C:\WINDOWS\System32\shell31.dll [2008-08-07 20:03:16 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll [2008-08-07 20:01:38 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008-08-07 20:00:57 | 000,001,282 | ---- | C] () -- C:\WINDOWS\System32\libFLAC.dll [2008-08-07 20:00:43 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll [2008-08-07 20:00:42 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll [2008-08-07 20:00:42 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll [2008-08-07 20:00:35 | 000,001,279 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll [2008-08-07 20:00:35 | 000,001,279 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll [2008-08-07 20:00:35 | 000,001,279 | ---- | C] () -- C:\WINDOWS\System32\avi.dll [2008-08-07 20:00:34 | 000,001,283 | ---- | C] () -- C:\WINDOWS\System32\mmfinfo.dll [2008-08-07 20:00:34 | 000,001,282 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll [2008-08-07 20:00:34 | 000,001,279 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll [2008-08-07 20:00:34 | 000,001,278 | ---- | C] () -- C:\WINDOWS\System32\ts.dll [2008-08-07 20:00:33 | 000,001,285 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll [2008-08-07 19:59:56 | 000,001,289 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll [2008-08-07 19:59:56 | 000,001,288 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-08-07 19:59:55 | 000,001,288 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-08-07 19:59:55 | 000,001,287 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll [2008-08-07 19:59:55 | 000,001,286 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll [2008-08-07 19:59:55 | 000,001,285 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-08-07 19:59:54 | 000,001,291 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll [2008-08-07 19:59:54 | 000,001,288 | ---- | C] () -- C:\WINDOWS\System32\ff_realaac.dll [2008-08-07 19:59:54 | 000,001,287 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll [2008-08-07 19:59:53 | 000,001,289 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll [2008-08-07 19:59:53 | 000,001,287 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll [2008-08-07 19:59:53 | 000,001,287 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll [2008-08-07 19:59:52 | 000,009,216 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll [2008-08-07 19:59:50 | 000,001,282 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008-02-04 21:47:27 | 000,000,122 | ---- | C] () -- C:\WINDOWS\mdm.ini [2008-02-04 20:48:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NSREX.INI [2008-02-02 10:02:34 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll [2006-02-17 14:07:17 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006-02-17 13:37:01 | 000,000,556 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006-02-17 13:27:23 | 000,000,222 | ---- | C] () -- C:\WINDOWS\wininit.ini [2006-02-17 13:21:28 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2006-02-17 13:21:28 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2006-02-17 13:21:28 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2006-02-17 13:21:28 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2006-02-17 13:21:28 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2006-02-17 13:21:28 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2006-02-17 13:19:16 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI [2006-02-17 13:16:00 | 000,012,430 | ---- | C] () -- C:\WINDOWS\HWSetupStr.ini [2006-02-17 13:16:00 | 000,002,070 | R--- | C] () -- C:\WINDOWS\SVPW32Str.ini [2006-02-17 13:08:39 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini [2006-02-17 13:08:39 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll [2006-02-17 13:08:39 | 000,009,344 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini [2006-02-17 13:08:39 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini [2006-02-17 09:20:39 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll [2006-02-17 09:20:39 | 000,000,083 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2006-01-26 19:03:32 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\TPeculiarity.dll [2005-12-08 20:56:50 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\tsbwls.dll [2005-11-29 05:33:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2001-07-31 09:17:12 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL [1999-01-22 18:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [color=#E56717]========== LOP Check ==========[/color] [2010-03-01 20:10:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-03-01 20:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2008-01-28 20:52:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\MSN Search Toolbar [2008-09-08 12:12:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\MythPeople [2008-09-08 12:11:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\n7-89-o9-3r-4t-r9 [2010-05-31 19:16:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2008-01-27 21:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\toshiba [2009-09-19 21:43:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Ancient Quest of Saqqarah__cminion [2008-02-02 18:01:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Gadu-Gadu [2010-03-01 21:09:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Gadu-Gadu 10 [2009-09-19 15:44:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\GameHouse [2009-09-11 19:30:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\InterTrust [2008-01-29 12:44:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\InterVideo [2010-03-21 16:58:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\ipla [2009-09-19 21:40:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\Saqqarah [2008-01-27 21:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\x\Dane aplikacji\toshiba [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:DFC5A2B2 < End of report >

Jesli popelnilem jakies bledy to prosze o ich wskazanie:)

**Posty:** 2183 · przez **NieWiem** 31 Maj 2010, 19:43

Zamiast Gmera pokaż raport z RootRepeal.

Pobierz RootRepeal.
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Na dole okna wybierz zakładkę Report
Wciśnij przycisk Scan. W wyskakującym oknie zaznacz następujące opcje:
- Drivers
- Processes
- SSDT
- Hidden Services
Wciskamy OK i w następnym oknie zaznaczamy all drives.
Upewniamy się, żę wszystkie inne okna czy komunikatory są wyłączone - ten skan może dawać wiele fałszywych odczytów, więc nie powinno się mu przeszkadzać.
Ponowne wciśnięcie OK uruchomi program.
Po zakończonym skanowaniu dostępny stanie się przycisk Save Report. Wciskamy i zapisujemy wyniki skanowania.
Ten raport może być dość długi, dlatego zalecam, aby wkleić go na stronie http://www.wklej.org, a w swoim poście podać tylko link do strony z wynikami.

**Posty:** 250 · przez **tenzin** 31 Maj 2010, 19:55

Dziekuje za błyskawiczną odpowiedź.
Niestety nie moge zastosowac sie do wszystkich wskazówek ponieważ po wykonaniu:

•Wciśnij przycisk Scan. W wyskakującym oknie zaznacz następujące opcje:
◦Drivers
◦Processes
◦SSDT
◦Hidden Services

nie pojawia sie wymienione dalej okienko (w którym zaznaczamy all drives), tylko program od razu wyrzuca raport (probowalem kilka razy):

Kod: Zaznacz wszystko: ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2010/05/31 19:51 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xEEB91000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7C23000 Size: 8192 File Visible: No Signed: - Status: - Name: mchInjDrv.sys Image Path: C:\WINDOWS\system32\Drivers\mchInjDrv.sys Address: 0xF7E0C000 Size: 2560 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xEB71A000 Size: 49152 File Visible: No Signed: - Status: - Hidden Services ------------------- Service Name: H Image Path: "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" ==EOF==

Pozdrawiam,

**Posty:** 2183 · przez **NieWiem** 31 Maj 2010, 19:59

W sumie to nie widę tu nic oprócz infekcji z pendriva.

Postaraj się jeszcze uruchomić Gmera w trybie awaryjnym.

**Posty:** 250 · przez **tenzin** 01 Cze 2010, 14:11

Dopiero za trzecim razem udało sie zapisac log z gmera w trybie awaryjnym.Każdrazowo skanowanie trwało ponad 2 godziny sciana

.
Za pierwszym razem nie chciał zapisać loga a nie można było równiez otworzyc zadnego dokumentu tekstwego, za drugim razem po kliknieciu na zapisz gmer wylaczyl sie, trzecia proba udana

.

Log z gmera:

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-06-01 14:00:46 Windows 5.1.2600 Dodatek Service Pack 3 Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\kwpdypob.sys ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system32\winlogon.exe[200] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4 .text C:\WINDOWS\system32\winlogon.exe[200] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C .text C:\WINDOWS\system32\winlogon.exe[200] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78 .text C:\WINDOWS\system32\winlogon.exe[200] WS2_32.dll!connect 71A54A07 5 Bytes JMP 10003AF0 .text C:\WINDOWS\system32\winlogon.exe[200] WS2_32.dll!send 71A54C27 5 Bytes JMP 10003264 .text C:\WINDOWS\system32\winlogon.exe[200] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 100027F8 .text C:\WINDOWS\system32\winlogon.exe[200] WS2_32.dll!recv 71A5676F 5 Bytes JMP 1000278C .text C:\WINDOWS\system32\winlogon.exe[200] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 10003A9C .text C:\WINDOWS\system32\services.exe[252] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4 .text C:\WINDOWS\system32\services.exe[252] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C .text C:\WINDOWS\system32\services.exe[252] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78 .text C:\WINDOWS\system32\services.exe[252] ws2_32.dll!connect 71A54A07 5 Bytes JMP 10003AF0 .text C:\WINDOWS\system32\services.exe[252] ws2_32.dll!send 71A54C27 5 Bytes JMP 10003264 .text C:\WINDOWS\system32\services.exe[252] ws2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 100027F8 .text C:\WINDOWS\system32\services.exe[252] ws2_32.dll!recv 71A5676F 5 Bytes JMP 1000278C .text C:\WINDOWS\system32\services.exe[252] ws2_32.dll!WSASend 71A568FA 5 Bytes JMP 10003A9C .text C:\WINDOWS\system32\lsass.exe[264] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4 .text C:\WINDOWS\system32\lsass.exe[264] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C .text C:\WINDOWS\system32\lsass.exe[264] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78 .text C:\WINDOWS\system32\lsass.exe[264] WS2_32.dll!connect 71A54A07 5 Bytes JMP 10003AF0 .text C:\WINDOWS\system32\lsass.exe[264] WS2_32.dll!send 71A54C27 5 Bytes JMP 10003264 .text C:\WINDOWS\system32\lsass.exe[264] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 100027F8 .text C:\WINDOWS\system32\lsass.exe[264] WS2_32.dll!recv 71A5676F 5 Bytes JMP 1000278C .text C:\WINDOWS\system32\lsass.exe[264] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 10003A9C .text C:\WINDOWS\system32\svchost.exe[428] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4 .text C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C .text C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78 .text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!connect 71A54A07 5 Bytes JMP 10003AF0 .text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!send 71A54C27 5 Bytes JMP 10003264 .text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 100027F8 .text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!recv 71A5676F 5 Bytes JMP 1000278C .text C:\WINDOWS\system32\svchost.exe[428] ws2_32.dll!WSASend 71A568FA 5 Bytes JMP 10003A9C .text C:\WINDOWS\system32\svchost.exe[572] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4 .text C:\WINDOWS\system32\svchost.exe[572] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C .text C:\WINDOWS\system32\svchost.exe[572] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78 .text C:\WINDOWS\system32\svchost.exe[572] ws2_32.dll!connect 71A54A07 5 Bytes JMP 10003AF0 .text C:\WINDOWS\system32\svchost.exe[572] ws2_32.dll!send 71A54C27 5 Bytes JMP 10003264 .text C:\WINDOWS\system32\svchost.exe[572] ws2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 100027F8 .text C:\WINDOWS\system32\svchost.exe[572] ws2_32.dll!recv 71A5676F 5 Bytes JMP 1000278C .text C:\WINDOWS\system32\svchost.exe[572] ws2_32.dll!WSASend 71A568FA 5 Bytes JMP 10003A9C .text C:\WINDOWS\Explorer.EXE[836] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4 .text C:\WINDOWS\Explorer.EXE[836] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C .text C:\WINDOWS\Explorer.EXE[836] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78 .text C:\WINDOWS\Explorer.EXE[836] ws2_32.dll!connect 71A54A07 5 Bytes JMP 10003AF0 .text C:\WINDOWS\Explorer.EXE[836] ws2_32.dll!send 71A54C27 5 Bytes JMP 10003264 .text C:\WINDOWS\Explorer.EXE[836] ws2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 100027F8 .text C:\WINDOWS\Explorer.EXE[836] ws2_32.dll!recv 71A5676F 5 Bytes JMP 1000278C .text C:\WINDOWS\Explorer.EXE[836] ws2_32.dll!WSASend 71A568FA 5 Bytes JMP 10003A9C .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4 .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78 .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] ws2_32.dll!connect 71A54A07 5 Bytes JMP 10003AF0 .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] ws2_32.dll!send 71A54C27 5 Bytes JMP 10003264 .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] ws2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 100027F8 .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] ws2_32.dll!recv 71A5676F 5 Bytes JMP 1000278C .text C:\WINDOWS\system32\NOTEPAD.EXE[1160] ws2_32.dll!WSASend 71A568FA 5 Bytes JMP 10003A9C ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device ACPI.sys (Sterownik ACPI dla systemu NT/Microsoft Corporation) ---- EOF - GMER 1.0.15 ----

**Posty:** 2183 · przez **NieWiem** 01 Cze 2010, 14:44

Pobierz program KatesKiller od Kaspersky'ego i zapisz go na pulpicie
Program jest spakowany do ZIPa, więc będziesz go musiał rozpakować ( PPM -> Wyodrębnij wszystkie... )
WAŻNE: Program musi znajdować się na pulpicie !
Idź do Start -> Uruchom i wklej to co poniżej :
"%userprofile%\Pulpit\kateskiller.exe" -y -l raport.txt -v

i kliknij OK
Rozpocznie się praca programu KatesKiller
Po jej zakończeniu zawartość raportu ( plik raport.txt powinien się znajdować na pulpicie ) wklejasz na stronę http://www.wklej.org i dajesz mi linka.

Plus nowe logi z OTL.

**Posty:** 250 · przez **tenzin** 02 Cze 2010, 10:49

Dzieki za odpowiedz, ale link do kateskiller nie dziala, a nie moge znaleźć tego narzedzia na stronie Kaspersky ani w Sieci.
Pozdrawiam,

**Posty:** 2183 · przez **NieWiem** 02 Cze 2010, 11:32

U mnie działa, czyli blokuje ją zwyczajnie infekcja.
Pobierz tą paczkę - to jest spakowany przeze mnie KatesKiller. Jest czysty.
Prezencik dla Ciebie!
Reszta wg instrukcji z poprzedniego posta.

Dołącz także raport z OTL robiony po pracy KatesKillera, ale wg poniższej konfiguracji:
uruchom, wciśnij u góry na panelu "none", a na dole w ramce wklej

/md5start
ws2_32.dll
kernel32.dll
user32.dll
ntdll.dll
/md5stop

i dopiero wciskasz Run Scan

**Posty:** 250 · przez **tenzin** 02 Cze 2010, 13:35

Dzieki, poszło

.

Raport z Kateskiller
http://www.wklej.org/id/343964/

Kod: Zaznacz wszystko: OTL logfile created on: 2010-06-02 13:25:18 - Run 3 OTL by OldTimer - Version 3.2.5.2 Folder = C:\Documents and Settings\x\Pulpit\Grzegorz Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 894,00 Mb Total Physical Memory | 507,00 Mb Available Physical Memory | 57,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): C:\pagefile.sys 1344 2688 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 55,89 Gb Total Space | 36,54 Gb Free Space | 65,38% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: YOUR-809F4D2AF6 Current User Name: x Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< MD5 for: KERNEL32.DLL >[/color] [2004-08-04 13:00:00 | 001,012,224 | ---- | M] (Microsoft Corporation) MD5=578BB2F44597CB53451DED99013573F3 -- C:\WINDOWS\$NtUninstallKB935839$\kernel32.dll [2009-03-21 16:04:15 | 001,020,416 | ---- | M] (Microsoft Corporation) MD5=6CFFFD4A53F08D1BE0222D859BF93B29 -- C:\WINDOWS\$hf_mig$\KB959426\SP3QFE\kernel32.dll [2009-03-21 16:08:59 | 001,018,368 | ---- | M] (Microsoft Corporation) MD5=77C951B64413E80EEC0359426DCA938B -- C:\WINDOWS\system32\dllcache\kernel32.dll [2009-03-21 16:08:59 | 001,018,368 | ---- | M] (Microsoft Corporation) MD5=77C951B64413E80EEC0359426DCA938B -- C:\WINDOWS\system32\kernel32.dll [2007-04-16 17:54:44 | 001,013,248 | ---- | M] (Microsoft Corporation) MD5=C0AAFEE37EE787D9609D9FE00FA427F8 -- C:\WINDOWS\$NtServicePackUninstall$\kernel32.dll [2007-04-16 18:11:16 | 001,014,784 | ---- | M] (Microsoft Corporation) MD5=D8ACC0B8C46FC756E3F64C14EAF9CE8F -- C:\WINDOWS\$hf_mig$\KB935839\SP2QFE\kernel32.dll [2008-04-14 19:20:34 | 001,018,368 | ---- | M] (Microsoft Corporation) MD5=FCE4ECC34A36EDACF03DBE8DE5E28910 -- C:\WINDOWS\$NtUninstallKB959426$\kernel32.dll [2008-04-14 19:20:34 | 001,018,368 | ---- | M] (Microsoft Corporation) MD5=FCE4ECC34A36EDACF03DBE8DE5E28910 -- C:\WINDOWS\ServicePackFiles\i386\kernel32.dll [color=#A23BEC]< MD5 for: NTDLL.DLL >[/color] [2008-04-14 19:19:14 | 000,714,240 | ---- | M] (Microsoft Corporation) MD5=344E9C9B857D6A930576F6E08EC1F8AC -- C:\WINDOWS\$NtUninstallKB956572$\ntdll.dll [2008-04-14 19:19:14 | 000,714,240 | ---- | M] (Microsoft Corporation) MD5=344E9C9B857D6A930576F6E08EC1F8AC -- C:\WINDOWS\ServicePackFiles\i386\ntdll.dll [2009-02-09 13:00:17 | 000,723,456 | ---- | M] (Microsoft Corporation) MD5=4577955ACDA3229ECEA9065AD25A3B40 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\ntdll.dll [2009-02-09 12:53:43 | 000,722,944 | ---- | M] (Microsoft Corporation) MD5=75F21EA0824F6E932764EEA3D320F2AE -- C:\WINDOWS\system32\dllcache\ntdll.dll [2009-02-09 12:53:43 | 000,722,944 | ---- | M] (Microsoft Corporation) MD5=75F21EA0824F6E932764EEA3D320F2AE -- C:\WINDOWS\system32\ntdll.dll [2004-08-04 13:00:00 | 000,716,288 | ---- | M] (Microsoft Corporation) MD5=A33545010D5DFDFB9B892921603B287E -- C:\I386\NTDLL.DLL [2004-08-04 13:00:00 | 000,716,288 | ---- | M] (Microsoft Corporation) MD5=A33545010D5DFDFB9B892921603B287E -- C:\I386\SYSTEM32\NTDLL.DLL [2004-08-04 13:00:00 | 000,716,288 | ---- | M] (Microsoft Corporation) MD5=A33545010D5DFDFB9B892921603B287E -- C:\WINDOWS\$NtServicePackUninstall$\ntdll.dll [color=#A23BEC]< MD5 for: USER32.DLL >[/color] [2004-08-04 13:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=0C81764F50F32D376E6E4B9E9F4B01A0 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll [2007-03-08 17:51:57 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=11ABDECC02EFC1D2B6A6A0FA46C26594 -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2005-03-02 20:21:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=6A93565BE9B8422EB7538C66AC732D76 -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2007-03-08 17:38:47 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=A37A4637F84F8DD771274EAF8D17FA65 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2008-04-14 19:20:56 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=A435C5C069AFD901751AC323AD238793 -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008-04-14 19:20:56 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=A435C5C069AFD901751AC323AD238793 -- C:\WINDOWS\system32\user32.dll [2005-03-02 20:18:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B7EEB1A1AF740306049241DDF61F21FF -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll [color=#A23BEC]< MD5 for: WS2_32.DLL >[/color] [2004-08-04 13:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=AB82237486B727DD7DAB36A76F38A3A2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll [2008-04-14 19:20:58 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=C0AA2AB856680C44739B41E01F5BD4E9 -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll [2008-04-14 19:20:58 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=C0AA2AB856680C44739B41E01F5BD4E9 -- C:\WINDOWS\system32\ws2_32.dll < End of report >

Próba naciśnicia "e z kreską" nadal powoduje otwarcie strony: tradedoubler.
A avast mimo, ze wyłączyłem mu osłone dostepowa, wykrywa co jakis czas jakas infekcje.
Pozdrawiam,

**Posty:** 2183 · przez **NieWiem** 02 Cze 2010, 14:20

Log z Katesa jest pocieszający

Teraz nowy komplet OTL + Gmer.

**Posty:** 250 · przez **tenzin** 02 Cze 2010, 16:39

Dzieki:).
Logi, ponizej:
OTL: http://wklej.org/id/344069/
Extras: http://wklej.org/id/344073/

Gmer :

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-06-02 16:34:36 Windows 5.1.2600 Dodatek Service Pack 3 Running: f5t6662b.exe; Driver: C:\DOCUME~1\x\USTAWI~1\Temp\kwpdypob.sys ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\system32\services.exe[596] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002 IAT C:\WINDOWS\system32\services.exe[596] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000 ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device ACPI.sys (Sterownik ACPI dla systemu NT/Microsoft Corporation) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions) ---- EOF - GMER 1.0.15 ----

**Posty:** 2183 · przez **NieWiem** 02 Cze 2010, 17:23

Główny problem rozwiązany. Teraz pozbywamy się jakichś robaków co sobie z pendriva przyszły.

Odpal OTL i wklej mu:

:processes
:files
C:\Documents and Settings\x\Ustawienia lokalne\temp\nodqq0.dll
C:\i8ikdjwt.exe
:OTL
O3 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O4 - HKU\S-1-5-21-4269063892-4221354316-3019914497-1006..\Run: [nod32] C:\Documents and Settings\x\Ustawienia lokalne\temp\nodqq.exe ()
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O32 - AutoRun File - [2010-06-02 14:38:22 | 000,000,063 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:DFC5A2B2
:reg
:services
:commands
[purity]
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Wciskasz Run Fix, potwierdzasz restart i pokazujesz raport po restarcie.

Potem nowy log z OTL. Konfiguracja jak w przyklejonym, tylko w oknie na dole wklej dodatkowo takie coś:

C:\*

**Posty:** 250 · przez **tenzin** 03 Cze 2010, 13:07

Ponizej logi zgodnie z podana kolejnoscia:)
http://wklej.org/id/344508/

http://wklej.org/id/344510/
http://wklej.org/id/344511/

Co z pendrivami?. (Łącznie są dwa pendrivy).
Pozdrawiam

**Posty:** 18165 · przez **wojtas** 03 Cze 2010, 17:47

przy podpiętych pendrivach dodaj jeszcze log z USBFIX z opcji 5

**Posty:** 250 · przez **tenzin** 02 Lip 2010, 09:27

Przepraszam, nie bardzo rozumiem co znaczy z "z opcji 5", ale wykonałem skan usbfix.

Wklejam świeże logi:
GMER
http://wklej.org/id/359231/

OTL
http://wklej.org/id/359232/

Extras
http://wklej.org/id/359233/

Usbfix:

Kod: Zaznacz wszystko: ############################## | UsbFix 7.015 | [Research] User: x (Administrator) # YOUR-809F4D2AF6 [ ] Updated 01/07/10 by El Desaparecido / C_XX Started at 15:40:23 | 01/07/2010 Website: http://pagesperso-orange.fr/NosTools/index.html Contact: FindyKill.Contact@gmail.com CPU: Intel(R) Celeron(R) M processor 1.70GHz Microsoft Windows XP Home Edition (5.1.2600 32-Bit) # Dodatek Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall: Enabled Antivirus: avast! antivirus 4.8.1368 [VPS 100701-0] 4.8.1368 [(!) Disabled | Updated] Firewall: Norton Internet Worm Protection 2006 [(!) Disabled] RAM -> 894 Mb C:\ (%systemdrive%) -> Fixed drive # 56 Gb (36 Mb free - 65%) [] # NTFS D:\ -> CD-ROM E:\ -> Removable drive # 2 Gb (2 Mb free - 88%) [] # FAT ################## | Files # Infected Folders | Found ! C:\WINDOWS\AhnRpta.exe Found ! E:\f662sjd.exe Found ! E:\Autorun.inf Found ! E:\i8ikdjwt.exe ################## | Registry | Found ! HKLM\Software\Classes\CLSID\{BB4C402F-882A-4526-8C08-51278EA437C1} Found ! HKLM\Software\Classes\CLSID\MADOWN Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools Found ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives ################## | Mountpoints2 | ################## | Vaccin | (!) This computer is not vaccinated! ################## | E.O.F |

**Posty:** 2183 · przez **NieWiem** 02 Lip 2010, 09:31

Cześć

Pokaż raport z USBFix z opcji Listing

I na Boga, wracasz po miesiącu?? :1:

**Posty:** 250 · przez **tenzin** 02 Lip 2010, 15:31

Przepraszam, że dopiero po miesiącu, ale to nie mój komputer i pomagam jak mam do niego dostep.
Znów nie działa litera e z kreską. Po kliknieciu alt+e otwiera sie tym razem strona ebay.

usbfix z opcji listing

Kod: Zaznacz wszystko: ############################## | UsbFix 7.015 | [Listing] User: x (Administrator) # YOUR-809F4D2AF6 [ ] Updated 01/07/10 by El Desaparecido / C_XX Started at 15:27:44 | 02/07/2010 Website: http://pagesperso-orange.fr/NosTools/index.html Contact: FindyKill.Contact@gmail.com CPU: Intel(R) Celeron(R) M processor 1.70GHz Microsoft Windows XP Home Edition (5.1.2600 32-Bit) # Dodatek Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall: Enabled Antivirus: avast! antivirus 4.8.1368 [VPS 100701-1] 4.8.1368 [(!) Disabled | Updated] Firewall: Norton Internet Worm Protection 2006 [(!) Disabled] RAM -> 894 Mb C:\ (%systemdrive%) -> Fixed drive # 56 Gb (36 Mb free - 65%) [] # NTFS D:\ -> CD-ROM E:\ -> Removable drive # 2 Gb (2 Mb free - 88%) [] # FAT ################## | Listing | [13/04/2009 - 17:51:58 | D ] C:\9d18150cb949e60ebb063f3f8710 [30/08/2008 - 20:40:05 | A | 640] C:\ALLPlayer V3.4.lnk [17/02/2006 - 09:35:16 | A | 0] C:\AUTOEXEC.BAT [01/06/2010 - 11:38:56 | RASH | 211] C:\boot.ini [04/08/2004 - 13:00:00 | RASH | 4952] C:\Bootfont.bin [30/08/2008 - 19:58:38 | A | 9329] C:\ComboFix.txt [17/02/2006 - 09:35:16 | A | 0] C:\CONFIG.SYS [31/05/2010 - 20:05:28 | D ] C:\Documents and Settings [28/02/2008 - 21:35:03 | D ] C:\dyplomowany [30/03/2009 - 19:58:52 | D ] C:\Film [02/02/2008 - 17:49:57 | A | 4349168] C:\gg77.exe [19/09/2009 - 21:40:27 | D ] C:\Gry [02/07/2010 - 15:21:36 | ASH | 937742336] C:\hiberfil.sys [27/01/2008 - 21:48:11 | D ] C:\I386 [17/02/2006 - 09:35:16 | RASH | 0] C:\IO.SYS [07/12/2009 - 21:15:25 | D ] C:\Książka [17/02/2006 - 09:35:16 | RASH | 0] C:\MSDOS.SYS [27/01/2008 - 21:48:11 | RHD ] C:\MSOCache [21/04/2008 - 16:39:11 | D ] C:\muzyka [22/09/2009 - 12:33:35 | D ] C:\My Recordings [04/08/2004 - 13:00:00 | RASH | 47564] C:\NTDETECT.COM [07/12/2008 - 19:31:10 | RASH | 251152] C:\ntldr [02/07/2010 - 15:21:35 | ASH | 1409286144] C:\pagefile.sys [01/07/2010 - 19:15:26 | D ] C:\Problem z kompem [01/06/2010 - 11:40:12 | RD ] C:\Program Files [01/07/2010 - 15:44:04 | SHD ] C:\RECYCLER [02/02/2008 - 10:06:25 | A | 90] C:\Setup.log [01/08/2008 - 00:14:47 | A | 1872] C:\Skype.lnk [27/01/2008 - 21:56:17 | D ] C:\SUPPORT [30/03/2006 - 23:51:19 | AH | 123] C:\SWSTAMP.TXT [03/06/2010 - 12:08:01 | SHD ] C:\System Volume Information [17/02/2006 - 20:13:06 | D ] C:\Toolscd [01/07/2010 - 15:40:48 | D ] C:\UsbFix [02/07/2010 - 15:27:44 | A | 2453] C:\UsbFix.txt [03/03/2008 - 18:37:35 | D ] C:\VALUEADD [12/06/2010 - 15:32:55 | D ] C:\WINDOWS [15/02/2009 - 18:12:05 | D ] C:\zdjęcia [16/08/2009 - 14:04:30 | D ] C:\_OTL [02/06/2010 - 10:28:30 | RSH | 61] E:\autorun.inf [07/05/2010 - 15:11:12 | RSH | 111616] E:\i8ikdjwt.exe [31/05/2010 - 19:26:32 | A | 67888] E:\OTL.Txt [02/06/2010 - 01:18:00 | A | 2881536] E:\Archikatedra.ppt [26/05/2010 - 10:21:52 | RSH | 113152] E:\f662sjd.exe [06/06/2010 - 20:24:24 | A | 138240] E:\KARTA WYCIECZKI.doc [02/06/2010 - 12:42:18 | A | 28160] E:\prosba o zatwierdzenie - kl 2 i 3.doc [08/11/2009 - 18:29:30 | D ] E:\dvd prezentacje [19/11/2009 - 20:41:18 | D ] E:\wyjscia [06/01/2010 - 19:15:22 | A | 1057792] E:\religia.ppt [06/01/2010 - 19:17:44 | D ] E:\Nowy folder [06/01/2010 - 19:12:46 | A | 1754838] E:\Sakramenty inaczej - prezentacja multimedialna.zip [26/05/2010 - 15:40:32 | H | 110592] E:\~WRL0005.tmp [27/05/2010 - 15:28:24 | A | 110592] E:\KARTA WYCIECZKI przedt..doc [28/05/2010 - 09:14:24 | A | 83968] E:\Zgoda rodziców.doc [31/05/2010 - 18:40:16 | A | 23552] E:\justyna.doc ################## | E.O.F |

**Posty:** 2183 · przez **NieWiem** 04 Lip 2010, 02:24

tenzin napisał(a):Znów nie działa litera e z kreską. Po kliknieciu alt+e otwiera sie tym razem strona ebay.

To raczej jest wina nie wirusów, a ustawień spowodowanych instalacją jakiegoś dodatkowego oprogramowania.

= = = = = O T L = = = = =

Uruchom OTL

W oknie na dole wklej:

Kod: Zaznacz wszystko: :processes :services :otl O4 - HKLM..\Run: [CFSServ.exe] File not found O4 - HKLM..\Run: [NDSTray.exe] File not found O4 - HKLM..\RunOnce: [] File not found O32 - AutoRun File - [2010-06-02 10:28:30 | 000,000,061 | RHS- | M] () - E:\autorun.inf -- [ FAT ] :files C:\RECYCLER E:\autorun.inf E:\i8ikdjwt.exe E:\f662sjd.exe :reg :commands [emptytemp] [emptyflash] [clearallrestorepoints]

Wciśnij Run Fix i zatwierdź restart

Do wglądu raport z czyszczenia i nowy log z OTL oraz z USBFix z opcji Listing

**Posty:** 250 · przez **tenzin** 05 Lip 2010, 11:55

Dzieki. Juz wklejam...

Raport z czyszczenia OTL: http://wklej.org/id/360474/

Nowy OTL: http://wklej.org/id/360475/

Extras: http://wklej.org/id/360477/

USBFIX Listing: http://wklej.org/id/360478/

Pozdrawiam,

**Posty:** 2183 · przez **NieWiem** 06 Lip 2010, 14:30

tenzin, co miało puścić to puściło.

= = = = = K A S P E R S K Y O N - L I N E S C A N N E R = = = = =

Z Internet Explorera albo Mozilla Firefoxa wejdź na Kaspersky On-Line

Zapytany o instalację i bazę danych kliknij Accept
Zamknij wszystkie programy, wyłącz na czas skanowania antywirusa.
Wciśnij Run -> zacznie się ściąganie i instalacja. Może to chwilę zająć

Po zakończeniu pojawi się informacja czy system jest czysty czy nie. Nie będzie opcji sprzątania/usuwania
Potrzebujemy tylko raportu z tego skanowania - nie podejmuj działań związanych z dezynfekcją na własną rękę

Wciśnij View Scan Report, zapisz jako plik *.txt i wklej go

Kto jest na forum