Rundll32.exe (1760)/ ponmcup.aa koń trojański

**Posty:** 5 · przez **irmina** 22 Cze 2012, 22:16

Od paru dni internet mi bardzo zwolnił. Poza tym to odpalają mi sie zupełnie inne stronki niż te na które próbuje wejść. Eset mi wykrył rundll32.exe (1760)/ Ponmcup.aa koń trojański -- nie można wyleczyć. Podobny temat przewiną się juz przez forum. Nie wiem za bardzo gdzie to jest i jak to usunąć. Jak by wyglądał skrypt do otl? Mam jeszcze pytanie nr 2 centrum zabezpieczeń windowsa mi się wyłączyło i nie jak nie da rady go włączyć? co to może być ?

**Posty:** 12734 · przez **Mikou@j** 22 Cze 2012, 22:39

Przeczytaj ze zrozumieniem wszystko-o-logach-aktualizacja-30-01-2012-vt117887.html i wstaw odpowiednie logi.

**Posty:** 5 · przez **irmina** 23 Cze 2012, 07:56

http://wklej.org/id/778145/

**Posty:** 205 · przez **defacto19** 23 Cze 2012, 12:39

odinstaluj w dodaj usuń programy:
Akamai NetSession Interface Service

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL
IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\..\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - No CLSID value found
IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O33 - MountPoints2\{21872737-38cc-11e0-8eed-f04da2abfba2}\Shell - "" = AutoRun
O33 - MountPoints2\{21872737-38cc-11e0-8eed-f04da2abfba2}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{21872741-38cc-11e0-8eed-f04da2abfba2}\Shell - "" = AutoRun
O33 - MountPoints2\{21872741-38cc-11e0-8eed-f04da2abfba2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6108e688-39f9-11e0-b3d8-f04da2abfba2}\Shell - "" = AutoRun
O33 - MountPoints2\{6108e688-39f9-11e0-b3d8-f04da2abfba2}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{627bdafe-440b-11e0-b218-f04da2abfba2}\Shell - "" = AutoRun
O33 - MountPoints2\{627bdafe-440b-11e0-b218-f04da2abfba2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{627bdb0e-440b-11e0-b218-f04da2abfba2}\Shell - "" = AutoRun
O33 - MountPoints2\{627bdb0e-440b-11e0-b218-f04da2abfba2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{a46a658a-4560-11e0-9bf2-f04da2abfba2}\Shell - "" = AutoRun
O33 - MountPoints2\{a46a658a-4560-11e0-9bf2-f04da2abfba2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{c8cb1b94-7ffe-11e1-ab06-001e101f2c0e}\Shell - "" = AutoRun
O33 - MountPoints2\{c8cb1b94-7ffe-11e1-ab06-001e101f2c0e}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{c8cb1bad-7ffe-11e1-ab06-001e101f2c0e}\Shell - "" = AutoRun
O33 - MountPoints2\{c8cb1bad-7ffe-11e1-ab06-001e101f2c0e}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
[2012-06-23 07:35:45 | 000,000,310 | ---- | M] () -- C:\Windows\Tasks\Ityviappc.job

:Reg
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2]

:Commands
[emptytemp]

Kliknij Wykonaj skrypt.Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).
Pokaż nowy log OTL.txt oraz raport z usuwania.

Autor postu otrzymał pochwałę

**Posty:** 5 · przez **irmina** 24 Cze 2012, 09:33

http://wklej.org/id/778691/
http://wklej.org/id/778698/

wielkie dzięki za pomoc

teraz już wszystko jest ok

**Posty:** 18165 · przez **wojtas** 24 Cze 2012, 10:40

Akamai NetSession Interface Service czy to zostało odinstalowane ?

ten plik/i :

C:\Windows\SysWow64\serwvdrva.dll

przeskanuj tu
http://virusscan.jotti.org/
i tu :
http://www.virustotal.com/

i daj raporty ze skanu w następnym poście ( plik będzie ukryty)

Autor postu otrzymał pochwałę

**Posty:** 5 · przez **irmina** 25 Cze 2012, 20:56

Cieszyłam się za wcześnie sciana

. Pokazało mi dziś że dalej to mam tylko teraz to już rundll32.exe(1444). Usunełam Akamai NetSession. Załączam raport. Skany na tych stronkach nic nie wykryły

Kod: Zaznacz wszystko: OTL logfile created on: 2012-06-25 20:50:21 - Run 6 OTL by OldTimer - Version 3.2.51.0 Folder = c:\Users\ANIA\Desktop\ciekawe\otl 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,96 Gb Total Physical Memory | 2,70 Gb Available Physical Memory | 68,06% Memory free 7,92 Gb Paging File | 6,49 Gb Available in Paging File | 81,88% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 451,01 Gb Total Space | 416,80 Gb Free Space | 92,41% Space Free | Partition Type: NTFS Drive E: | 23,83 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: ANIA-KOMPUTER | User Name: ANIA | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2012-06-22 05:49:33 | 000,595,968 | ---- | M] (OldTimer Tools) -- c:\Users\ANIA\Desktop\ciekawe\otl\OTL.exe PRC - [2012-03-07 15:40:34 | 000,913,144 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe PRC - [2011-10-01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011-10-01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011-03-26 09:41:14 | 000,235,168 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10o_ActiveX.exe PRC - [2010-08-21 01:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe PRC - [2010-08-12 01:19:16 | 000,781,536 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe PRC - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010-06-08 17:49:26 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010-03-10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2012-06-14 20:23:56 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll MOD - [2012-06-14 20:23:28 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll MOD - [2012-06-14 20:23:20 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll MOD - [2012-05-11 09:51:38 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\06269663e6482bc4ceeb48c2a7d1ad34\IAStorUtil.ni.dll MOD - [2012-05-11 09:06:19 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll MOD - [2012-05-11 09:05:24 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll MOD - [2012-05-11 09:05:17 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll MOD - [2012-05-11 09:05:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll MOD - [2012-05-11 09:05:12 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll MOD - [2012-05-11 09:05:06 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll MOD - [2010-11-13 04:03:49 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pl_b77a5c561934e089\mscorlib.resources.dll MOD - [2010-11-06 19:15:03 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_pl_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2010-08-12 01:19:34 | 000,077,024 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll MOD - [2010-08-12 01:19:32 | 000,109,792 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll MOD - [2010-08-12 01:19:32 | 000,072,928 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll MOD - [2010-08-12 01:19:30 | 000,232,672 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll MOD - [2010-08-12 01:19:30 | 000,126,176 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll MOD - [2010-08-12 01:19:30 | 000,119,008 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll MOD - [2010-08-12 01:19:26 | 001,121,504 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dll MOD - [2010-08-12 01:19:16 | 000,781,536 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2012-03-07 15:40:34 | 000,913,144 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn) SRV:[b]64bit:[/b] - [2010-05-21 06:47:36 | 000,098,208 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe -- (AERTFilters) SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2011-10-01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011-10-01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2010-08-21 01:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService) SRV - [2010-06-08 17:49:30 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2010-03-18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010-03-10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2012-03-14 08:40:04 | 000,137,144 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr) DRV:[b]64bit:[/b] - [2012-03-14 08:40:02 | 000,209,768 | ---- | M] (ESET) [File_System | System | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm) DRV:[b]64bit:[/b] - [2012-03-14 08:40:02 | 000,148,528 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv) DRV:[b]64bit:[/b] - [2012-03-01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2011-10-01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:[b]64bit:[/b] - [2011-10-01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:[b]64bit:[/b] - [2011-10-01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:[b]64bit:[/b] - [2011-10-01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:[b]64bit:[/b] - [2011-03-11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011-03-11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2010-11-20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010-11-20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010-08-25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:[b]64bit:[/b] - [2010-08-12 17:51:30 | 000,175,168 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt) DRV:[b]64bit:[/b] - [2010-06-25 20:33:36 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:[b]64bit:[/b] - [2010-06-22 08:07:24 | 000,304,760 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService) DRV:[b]64bit:[/b] - [2010-06-08 17:33:14 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:[b]64bit:[/b] - [2010-03-17 23:29:52 | 000,232,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:[b]64bit:[/b] - [2010-03-03 18:45:24 | 001,594,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:[b]64bit:[/b] - [2009-12-07 20:53:26 | 000,117,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:[b]64bit:[/b] - [2009-12-07 20:36:48 | 000,246,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet) DRV:[b]64bit:[/b] - [2009-10-12 16:23:22 | 000,114,304 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ewusbdev.sys -- (hwusbdev) DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009-07-09 10:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:[b]64bit:[/b] - [2009-06-10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2006-11-01 19:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\..\SearchScopes,DefaultScope = {A28CEC26-A20B-4644-9C62-7F45EFA2242B} IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\..\SearchScopes\{A28CEC26-A20B-4644-9C62-7F45EFA2242B}: "URL" = http://www.google.com/search?hl=pl&q={searchTerms} IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-698385550-2439809146-2157312670-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "http://google.pl/" FF - user.js - File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-06-14 22:13:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012-06-19 14:15:17 | 000,000,000 | ---D | M] [2011-11-12 10:20:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ANIA\AppData\Roaming\mozilla\Extensions [2012-04-22 14:17:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012-04-22 14:17:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-03-09 09:11:43 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011-11-05 05:41:38 | 000,002,767 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\allegro-pl.xml [2011-11-05 05:41:38 | 000,001,406 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fbc-pl.xml [2011-11-05 05:41:38 | 000,000,917 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\merlin-pl.xml [2011-11-05 05:41:38 | 000,000,858 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\pwn-pl.xml [2011-11-05 05:41:38 | 000,001,183 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-pl.xml [2011-11-05 05:41:39 | 000,001,683 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2009-06-10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O4:[b]64bit:[/b] - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4:[b]64bit:[/b] - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.) O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-698385550-2439809146-2157312670-1000..\Run: [Akamai NetSession Interface] "C:\Users\ANIA\AppData\Local\Akamai\netsession_win.exe" File not found O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O16:[b]64bit:[/b] - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16:[b]64bit:[/b] - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16:[b]64bit:[/b] - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{58C89026-3DF5-45F1-B012-77C23A7AE20F}: DhcpNameServer = 212.33.77.94 212.33.89.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CFD043F-06C3-4A37-8C26-5D18ED28A30D}: NameServer = 89.108.195.21 217.17.34.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A473D629-2035-4C68-B53D-1E7DC02A1A18}: NameServer = 89.108.195.21 89.108.202.21 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0E4ABED-4DA5-4194-9A62-E8C187D8652E}: NameServer = 89.108.195.20 217.17.34.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FB34FB2A-BB43-425C-9EAD-C1536AE4F0F2}: NameServer = 89.108.195.20 217.17.34.10 O18:[b]64bit:[/b] - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012-02-22 22:11:15 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ] O32 - AutoRun File - [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.) - E:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2008-06-03 20:35:30 | 000,000,047 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{627bdb0e-440b-11e0-b218-f04da2abfba2}\Shell - "" = AutoRun O33 - MountPoints2\{627bdb0e-440b-11e0-b218-f04da2abfba2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2009-08-28 12:42:34 | 000,143,360 | R--- | M] (Huawei Technologies Co., Ltd.) O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012-06-24 08:58:20 | 000,000,000 | ---D | C] -- C:\_OTL [2012-06-23 07:17:53 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012-06-19 14:15:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET [2012-06-19 14:15:16 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET [2012-06-19 14:15:16 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2012-06-19 11:16:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012-06-19 05:08:26 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012-06-19 05:08:26 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012-06-19 05:08:26 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012-06-19 05:08:21 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012-06-19 05:08:21 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012-06-19 05:08:21 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012-06-19 05:08:12 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012-06-19 05:08:12 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2012-06-15 07:43:31 | 000,000,000 | ---D | C] -- C:\Users\ANIA\AppData\Roaming\Install.GS [2012-06-15 04:15:44 | 000,000,000 | ---D | C] -- C:\Users\ANIA\AppData\Roaming\Apple Computer [2012-06-14 22:13:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2012-06-14 22:13:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2012-06-14 22:11:59 | 000,000,000 | ---D | C] -- C:\Users\ANIA\AppData\Local\Apple [2012-06-14 22:11:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple [2012-06-14 21:43:09 | 000,000,000 | ---D | C] -- C:\Users\ANIA\AppData\Roaming\Abvent [2012-06-14 21:43:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Abvent [2012-06-14 21:42:52 | 000,000,000 | ---D | C] -- C:\Users\ANIA\AppData\Roaming\Abvent_Artlantis2 [2012-06-14 13:24:35 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012-06-14 13:24:34 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012-06-14 13:24:34 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012-06-14 13:24:34 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012-06-14 13:24:32 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012-06-14 13:24:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012-06-14 13:24:31 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012-06-14 13:24:31 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012-06-14 13:24:29 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012-06-14 13:24:29 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012-06-14 13:24:29 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012-06-14 13:24:28 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012-06-14 13:24:28 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012-06-14 07:28:36 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll [2012-06-14 07:28:36 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll [2012-06-14 07:28:36 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe [2012-06-14 07:28:29 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012-06-14 07:28:27 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012-06-14 07:28:27 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012-06-14 07:28:17 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll [2012-06-14 07:28:05 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012-06-14 07:28:04 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012-06-25 20:28:15 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012-06-25 20:28:15 | 000,013,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012-06-25 20:25:37 | 007,781,664 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat [2012-06-25 20:25:37 | 003,123,786 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012-06-25 20:25:37 | 002,619,032 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat [2012-06-25 20:25:37 | 002,506,580 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012-06-25 20:25:37 | 000,005,434 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012-06-25 20:20:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012-06-25 20:20:36 | 3191,623,680 | -HS- | M] () -- C:\hiberfil.sys [2012-06-23 07:34:09 | 000,000,020 | ---- | M] () -- C:\Users\ANIA\defogger_reenable [2012-06-23 07:30:37 | 000,050,477 | ---- | M] () -- C:\Users\ANIA\Desktop\Defogger.exe [2012-06-22 21:05:04 | 000,000,017 | ---- | M] () -- C:\Users\ANIA\AppData\Local\resmon.resmoncfg [2012-06-22 20:48:28 | 000,021,504 | ---- | M] () -- C:\Windows\SysNative\umstartup.etl [2012-06-18 20:56:48 | 000,114,688 | RHS- | M] () -- C:\Windows\SysWow64\serwvdrva.dll [2012-06-14 20:20:40 | 000,462,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012-06-03 00:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012-06-03 00:19:42 | 000,057,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012-06-03 00:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012-06-03 00:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012-06-03 00:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012-06-03 00:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012-06-02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012-06-02 15:15:12 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012-06-23 07:34:09 | 000,000,020 | ---- | C] () -- C:\Users\ANIA\defogger_reenable [2012-06-23 07:30:37 | 000,050,477 | ---- | C] () -- C:\Users\ANIA\Desktop\Defogger.exe [2012-06-22 21:05:04 | 000,000,017 | ---- | C] () -- C:\Users\ANIA\AppData\Local\resmon.resmoncfg [2012-06-19 08:24:22 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk [2012-06-18 20:56:48 | 000,114,688 | RHS- | C] () -- C:\Windows\SysWow64\serwvdrva.dll [2011-07-22 10:58:53 | 000,010,240 | ---- | C] () -- C:\Users\ANIA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-04-05 18:40:02 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011-02-25 20:57:30 | 000,031,826 | ---- | C] () -- C:\Users\ANIA\AppData\Roaming\UserTile.png [2011-02-10 12:30:23 | 001,549,394 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010-11-06 19:01:24 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin [2010-11-06 18:59:42 | 000,000,324 | ---- | C] () -- C:\Windows\Prelaunch.ini [2010-11-06 18:59:42 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini [2010-11-06 18:59:42 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini [2010-11-06 18:59:42 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini [2010-11-06 18:59:42 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini [2010-11-06 18:59:42 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini [2010-11-06 18:59:42 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini [2010-08-25 20:34:30 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin [2010-08-25 20:34:30 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin [2010-08-25 20:34:30 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin [2010-08-25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll [2010-08-25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll [color=#E56717]========== LOP Check ==========[/color] [2012-06-14 21:43:09 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\Abvent [2012-06-15 04:55:27 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\Abvent_Artlantis2 [2011-12-22 21:58:59 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\Autodesk [2011-06-17 08:49:59 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2011-10-31 18:19:25 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\Gadu-Gadu 10 [2012-06-15 07:45:53 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\Install.GS [2011-06-13 17:45:11 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\mojosoft [2011-10-19 19:38:22 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\OpenFM [2011-03-02 07:58:05 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\OpenOffice.org [2011-10-11 14:53:55 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\SoftGrid Client [2011-06-15 15:04:34 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\TP [2011-03-03 10:08:04 | 000,000,000 | ---D | M] -- C:\Users\ANIA\AppData\Roaming\Uniblue [2012-06-16 17:02:05 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011-03-03 18:38:30 | 000,000,216 | ---- | M] () -- C:\Windows\Tasks\SidebarExecute.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

Skaner malware'u Jotti
Ten plik został przeskanowany wcześniej. Wyniki poprzedniego skanowania są dostępne poniżej.
--------------------------------------------------------------------------------
Nazwa pliku:

12502
Stan:
Skanowanie zakończone. 0 z 20 skanerów zgłaszają szkodliwe oprogramowanie.
Dodatkowe informacje
Rozmiar pliku:

18432 bajtów
Typ pliku:

PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
MD5:

9e28bd26a9ce33ca2bff4a42a8772423
SHA1:
44b23f18c180f93b7db981c246ca2b2b1213cd5f
___________________________________________________________

SHA256:

7cada25c187fa6f51e4dbe971284f398d532fbb87226ef5fb98c86213aec26d9
File name:

serwvdrv.dll
Detection ratio:

0 / 42
Analysis date:

2012-06-25 18:39:29 UTC ( 0 minut ago )

ssdeep
384:XqIzQ++GubwXL31E48bhCcN8A9BHSfHl8IyVTWoU8Wat:aI8++TwXLlotHV/I8c

TrID
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

ExifTool
UninitializedDataSize....: 0
InitializedDataSize......: 6656
ImageVersion.............: 6.1
ProductName..............: Microsoft Windows Operating System
FileVersionNumber........: 6.1.7600.16385
LanguageCode.............: English (U.S.)
FileFlagsMask............: 0x003f
FileDescription..........: Unimodem Serial Wave driver
CharacterSet.............: Unicode
LinkerVersion............: 9.0
FileOS...................: Windows NT 32-bit
MIMEType.................: application/octet-stream
Subsystem................: Windows GUI
FileVersion..............: 6.1.7600.16385 (win7_rtm.090713-1255)
TimeStamp................: 2009:07:14 01:55:21+02:00
FileType.................: Win32 DLL
PEType...................: PE32
InternalName.............: SERWVDRV.DLL
ProductVersion...........: 6.1.7600.16385
SubsystemVersion.........: 6.1
OSVersion................: 6.1
OriginalFilename.........: SERWVDRV.DLL
LegalCopyright...........: Microsoft Corporation. All rights reserved.
MachineType..............: Intel 386 or later, and compatibles
CompanyName..............: Microsoft Corporation
CodeSize.................: 13824
FileSubtype..............: 9
ProductVersionNumber.....: 6.1.7600.16385
EntryPoint...............: 0x3a3a
ObjectFileType...........: Driver

Sigcheck
publisher................: Microsoft Corporation
product..................: Microsoft_ Windows_ Operating System
internal name............: SERWVDRV.DLL
copyright................: (c) Microsoft Corporation. All rights reserved.
original name............: SERWVDRV.DLL
signing date.............: 5:17 AM 7/14/2009
signers..................: Microsoft Windows
Microsoft Windows Verification PCA
Microsoft Root Certificate Authority
file version.............: 6.1.7600.16385 (win7_rtm.090713-1255)
description..............: Unimodem Serial Wave driver

Portable Executable structural information
Compilation timedatestamp.....: 2009-07-13 23:55:21
Target machine................: 0x14C (Intel 386 or later processors and compatible processors)
Entry point address...........: 0x00003A3A

PE Sections...................:

Name Virtual Address Virtual Size Raw Size Entropy MD5
.text 4096 13780 13824 6.18 da8eea2bc58f91b3aabd7b6937402587
.data 20480 3528 512 0.49 7ca47f4b2ec53d5484f9398f80d0c47c
.rsrc 24576 1312 1536 3.02 107c7fb8ee508c2cc6434514cdd4eca1
.reloc 28672 1190 1536 4.68 67af4ee801a8711ae8ec7a1ff0da02c2

PE Imports....................:

ADVAPI32.dll
RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegOpenKeyW

KERNEL32.dll
SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, InterlockedCompareExchange, Sleep, InterlockedExchange, WriteFileEx, SetWaitableTimer, CreateWaitableTimerW, GetTickCount, InitializeCriticalSection, QueryPerformanceCounter, LocalAlloc, CreateFileW, CloseHandle, GetOverlappedResult, CancelIo, WaitForSingleObject, GetLastError, DeviceIoControl, CreateEventW, DisableThreadLibraryCalls, GetProcessHeap, FreeLibrary, GetProcAddress, LocalFree, LoadLibraryW, lstrlenW, ClearCommError, InterlockedDecrement, LeaveCriticalSection, SetEvent, EnterCriticalSection, ReadFileEx, InterlockedIncrement, ResetEvent, HeapFree, HeapAlloc, QueueUserAPC, PurgeComm, DeleteCriticalSection, ExitThread, WaitForSingleObjectEx, CreateThread

WINMM.dll
DefDriverProc, GetDriverModuleHandle, DriverCallback

msvcrt.dll
_except_handler4_common, _amsg_exit, _initterm, free, malloc, _XcptFilter, memcpy, swprintf_s, memset, wcscpy_s, wcscat_s

USER32.dll
LoadStringW

PE Exports....................:

DriverProc, widMessage, wodMessage

Symantec Reputation
Suspicious.Insight

First seen by VirusTotal
2010-03-15 00:49:58 UTC ( 2 lata, 3 miesiące ago )

Last seen by VirusTotal
2012-06-25 18:39:29 UTC ( 1 minuta ago )

File names (max. 25)
1. 12502
2. serwvdrv.dll
3. smona131254319445341297192
4. 44b23f18c180f93b7db981c246ca2b2b1213cd5f
5. smona131254319431261524598
6. file-3305987_
7. smona_7cada25c187fa6f51e4dbe971284f398d532fbb87226ef5fb98c86213aec26d9.bin
8. D5C807700032086548CF00D5B5CB3E00040C33A9.dll
9. file-1739014_dll

**Posty:** 18165 · przez **wojtas** 26 Cze 2012, 16:03

nie ten plik przeskanowałaś :
SERWVDRV.DLL a serwvdrva.dll jest lekka różnica

ale dajemy usuwanie :

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
O4 - HKU\S-1-5-21-698385550-2439809146-2157312670-1000..\Run: [Akamai NetSession Interface] "C:\Users\ANIA\AppData\Local\Akamai\netsession_win.exe" File not found
[2012-06-18 20:56:48 | 000,114,688 | RHS- | M] () -- C:\Windows\SysWow64\serwvdrva.dll
[2011-03-03 18:38:30 | 000,000,216 | ---- | M] () -- C:\Windows\Tasks\SidebarExecute.job

:Commands
[emptytemp]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).

**Posty:** 5 · przez **irmina** 29 Cze 2012, 17:57

Pomogło

wielkie dzięki mistrzu:D

Kto jest na forum