Herss.exe i proxy spam.

[Mikacz]

Jestem kompletnie zielona jeśli chodzi o logi, więc szukam kogoś, kto zerknąłby w nie i powiedział, czy cokolwiek da się jeszcze odratować czy jednak muszę zafundować sprzętowi format. Od pewnego czasu przy uruchomieniu wyskakuje mi komunikat o problemach z aplikacją herss.exe i jej zamknięciu. Ponadto, na kilku stronach najwidoczniej zostałam zbanowana za proxy spam, czyli coś na pewno mi szaleje na dysku.

Log z OTLa dorzucam, może ktoś będzie miły i mnie poratuje

OTL
Extras

Biorąc pod uwagę fakt, że kompa morduje też mój młodszy brat i ojciec, to wszystko pewnie jest w stanie agonalnym

[kominekl]

Mamy tu wiele problemów. Infekcyjne modyfikacje systemu i infekcje z pamięci przenośnych, ale nie bój się . Da się to naprawić. Miałaś kiedyś problemy z uruchomieniem systemu i podmieniałaś jakieś pliki? Odinstaluj -> MarketResearch, Winamp Toolbar i Veoh Web Player Video Finder.

Następnie uruchom OTL -> w oknie Własne opcje skanowania/skrypt wklej:

:Processes
killallprocesses

:OTL

MOD - [2011-08-20 13:03:53 | 000,122,880 | RHS- | M] () -- C:\WINDOWS\system32\arking0.dll
MOD - [2011-08-20 13:03:52 | 000,078,336 | RHS- | M] () -- C:\Documents and Settings\mika.DOM-30A9F977263\Ustawienia lokalne\Temp\cvasds0.dll
SRV - File not found [Auto | Stopped] -- -- (qpxkznl)
SRV - File not found [Auto | Stopped] -- -- (agfqm)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
IE - HKCU\..\URLSearchHook: {C94E154B-1459-4A47-966B-4B843BEFC7DB} - Reg Error: Key error. File not found
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2653012&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2653012&SearchSource=2&q="
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohTVPlugin: C:\Program Files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll File not found
[2011-08-18 13:05:25 | 000,000,000 | ---D | M] ("Winamp Toolbar") -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2011-03-12 11:34:06 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\extensions\personas@christopher.beard
[2011-04-27 12:52:36 | 000,002,354 | ---- | M] () -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\searchplugins\aol-web-search.xml
[2009-07-27 21:42:17 | 000,000,681 | ---- | M] () -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\searchplugins\ask.xml
[2009-09-29 19:56:40 | 000,002,239 | ---- | M] () -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\searchplugins\askcom.xml
[2011-08-10 07:40:48 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\searchplugins\conduit.xml
[2010-03-17 17:42:20 | 000,002,055 | ---- | M] () -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\searchplugins\daemon-search.xml
[2009-11-08 17:02:29 | 000,000,362 | ---- | M] () -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\searchplugins\winamp-search.xml
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [WireLessKeyboard] File not found
O4 - HKCU..\Run: [cdoosoft] C:\Documents and Settings\mika.DOM-30A9F977263\Ustawienia lokalne\Temp\herss.exe ()
O4 - HKCU..\Run: [King_ar] C:\WINDOWS\system32\arking.exe ()
O32 - AutoRun File - [2011-08-20 13:25:41 | 000,000,063 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011-08-20 13:25:41 | 000,000,063 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011-08-20 13:25:41 | 000,000,063 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011-08-20 13:25:41 | 000,000,063 | RHS- | M] () - G:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{0231d9f3-caf0-11df-9ac2-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{0231d9f3-caf0-11df-9ac2-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{6a02c5a6-9a3b-11df-9a24-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{6a02c5a6-9a3b-11df-9a24-001fd0b66fc6}\Shell\AutoRun\command - "" = H:\Startme.exe
O33 - MountPoints2\{86cc8686-00d3-11de-be79-001fd0b66fc6}\Shell\AutoRun\command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{86cc8686-00d3-11de-be79-001fd0b66fc6}\Shell\open\Command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{92830824-4877-11de-8012-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{92830824-4877-11de-8012-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{a2f26c42-4e1d-11df-98db-001fd0b66fc6}\Shell\AutoRun\command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{a2f26c42-4e1d-11df-98db-001fd0b66fc6}\Shell\open\Command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{aa18d10b-0362-11de-be8a-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{aa18d10b-0362-11de-be8a-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{adf6baba-9e32-11de-9658-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{adf6baba-9e32-11de-9658-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{afd20018-8abc-11e0-9ced-001fd0b66fc6}\Shell\AutoRun\command - "" = y6cqb2is.exe
O33 - MountPoints2\{afd20018-8abc-11e0-9ced-001fd0b66fc6}\Shell\open\Command - "" = y6cqb2is.exe
O33 - MountPoints2\{b8710964-28d8-11de-bf30-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{b8710964-28d8-11de-bf30-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{c8f03c05-b068-11df-9a65-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{c8f03c05-b068-11df-9a65-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{cdf5cbe8-f922-11dd-be54-001fd0b66fc6}\Shell\AutoRun\command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{cdf5cbe8-f922-11dd-be54-001fd0b66fc6}\Shell\open\Command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{d4e277cb-0901-11e0-9b83-001fd0b66fc6}\Shell\AutoRun\command - "" = H:\y6cqb2is.exe
O33 - MountPoints2\{d4e277cb-0901-11e0-9b83-001fd0b66fc6}\Shell\open\Command - "" = H:\y6cqb2is.exe
O33 - MountPoints2\{d4e2a564-b565-11e0-9d67-001fd0b66fc6}\Shell\AutoRun\command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{d4e2a564-b565-11e0-9d67-001fd0b66fc6}\Shell\open\Command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{d73c2b9f-ed8a-11df-9b22-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{d73c2b9f-ed8a-11df-9b22-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{e38a0552-dc3e-11de-9752-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{e38a0552-dc3e-11de-9752-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{ee7d65da-bcfa-11e0-9d7b-001fd0b66fc6}\Shell - "" = AutoRun
O33 - MountPoints2\{ee7d65da-bcfa-11e0-9d7b-001fd0b66fc6}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
[2011-08-20 13:03:49 | 000,000,416 | ---- | M] () -- C:\WINDOWS\tasks\PCConfidential.job
[2011-08-15 17:58:09 | 000,000,360 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2011-08-15 17:00:00 | 000,000,388 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:47AC5B8DA59DF18D

:Files
C:\Documents and Settings\mika.DOM-30A9F977263\Menu Start\Programy\Autostart\Adobe Gamma.lnk
C:\WINDOWS\System32\arking.exe
C:\WINDOWS\System32\arking1.dll
C:\WINDOWS\System32\arking0.dll
C:\WINDOWS\System32\unrar.dll
C:\y6cqb2is.exe

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CloneCDTray"=-
"DivXUpdate"=-
"NvCplDaemon"=-
"NvMediaCenter"=-
"nwiz"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL.

[Mikacz]

Ok, odinstalowałam (za wyjątkiem MarketResearch, za cholerę znaleźć nie mogę ^^).

Log z usuwania
Nowy log

[kominekl]

Wykonaj pełne skanowanie Malwarebytes`em Anti-Malware -> http://www.instalki.pl/programy/download/Windows/antyspyware/Malwarebytes_Anti-Malware.html, jeśli coś znajdzie usuń i daj raport. Po tym podaj ponownie logi z OTL.

[Mikacz]

Malware
OTL

[wojtas]

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
MOD - [2011-08-20 23:07:52 | 000,081,920 | ---- | M] () -- C:\WINDOWS\system32\tu776498.dll
MOD - [2011-08-20 23:05:39 | 000,081,920 | ---- | M] () -- C:\WINDOWS\system32\r}776498.dll
SRV - File not found [Auto | Stopped] -- -- (vrgwchw)
SRV - File not found [Auto | Stopped] -- -- (nzlgk)
FF - prefs.js..browser.search.defaultthis.engineName: "Veoh Web Player Customized Web Search"
[2011-08-15 14:14:31 | 000,000,000 | ---D | M] (Veoh Web Player Community Toolbar) -- C:\Documents and Settings\mika.DOM-30A9F977263\Dane aplikacji\Mozilla\Firefox\Profiles\17j3uyhm.default\extensions\{cd90bf73-20f6-44ef-993d-bb920303bd2e}
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - File not found
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = File not found
O20 - Winlogon\Notify\cryptnet32: DllName - cryptnet32.dll - File not found
[2011-08-20 23:07:52 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\tu776498.dll
[2011-08-20 23:07:52 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\tu776498.dl_
[2011-08-20 23:05:59 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\li776498.dl_
[2011-08-20 23:05:58 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\us776498.dll
[2011-08-20 23:05:58 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\li776498.dll
[2011-08-20 23:05:58 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\us776498.dl_
[2011-08-20 23:05:45 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\xg776498.dll
[2011-08-20 23:05:45 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\xg776498.dl_
[2011-08-20 23:05:39 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\r}776498.dll
[2011-08-20 23:05:39 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\r}776498.dl_
[2011-08-20 17:31:18 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\xj776498.dll
[2011-08-20 17:31:18 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\xj776498.dl_
[2011-08-20 17:31:06 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\qi776498.dll
[2011-08-20 17:31:06 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\qi776498.dl_
[2011-08-20 17:22:04 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\vo776498.dll
[2011-08-20 17:22:04 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\vo776498.dl_
[2011-08-20 17:19:19 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\tn776498.dll
[2011-08-20 17:19:19 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\tn776498.dl_
[2011-08-20 17:19:09 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\w{776498.dll
[2011-08-20 17:19:09 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\w{776498.dl_
[2011-08-20 17:18:24 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\an776498.dll
[2011-08-20 17:18:24 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\an776498.dl_
[2011-08-20 17:12:28 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\kr776498.dll
[2011-08-20 17:12:28 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\kr776498.dl_
[2011-08-20 10:52:26 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\tp776498.dll
[2011-08-20 10:52:26 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\tp776498.dl_
[2011-08-20 10:52:26 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\tp776498.dll
[2011-08-20 10:52:26 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\tp776498.dl_
[2011-08-13 20:09:04 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\w776498.dl_
[2011-08-13 20:08:49 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\w776498.dll
[2011-08-05 13:28:51 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\t~776498.dll
[2011-08-05 13:28:51 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\t~776498.dl_
[2011-07-30 16:06:08 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\br776498.dll
[2011-07-30 16:06:08 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\br776498.dl_
[2011-07-25 15:49:11 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\rd776498.dll
[2011-07-25 15:49:11 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\rd776498.dl_
[2011-07-25 15:29:52 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\mz776498.dll
[2011-07-25 15:29:52 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\mz776498.dl_
[2011-07-23 18:41:30 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\ww776498.dll
[2011-07-23 18:41:30 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\ww776498.dl_
[2011-07-22 13:16:03 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\mv776498.dll
[2011-07-22 13:16:03 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\mv776498.dl_
[2011-08-20 23:01:52 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tu776498.dll
[2011-08-20 23:01:52 | 000,044,748 | -H-- | C] () -- C:\WINDOWS\System32\tu776498.dl_
[2011-08-20 17:19:09 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\w{776498.dll
[2011-08-20 17:19:09 | 000,044,748 | -H-- | C] () -- C:\WINDOWS\System32\w{776498.dl_
[2011-08-16 11:14:56 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tp776498.dll
[2011-08-16 11:14:56 | 000,044,748 | -H-- | C] () -- C:\WINDOWS\System32\tp776498.dl_
[2011-08-13 12:56:16 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\an776498.dll
[2011-08-13 12:56:16 | 000,044,748 | -H-- | C] () -- C:\WINDOWS\System32\an776498.dl_
[2011-07-25 15:29:52 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mz776498.dll
[2011-07-25 15:29:52 | 000,044,748 | -H-- | C] () -- C:\WINDOWS\System32\mz776498.dl_
[2011-07-23 18:41:30 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ww776498.dll
[2011-07-23 18:41:30 | 000,044,748 | -H-- | C] () -- C:\WINDOWS\System32\ww776498.dl_
[2011-07-22 13:16:03 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mv776498.dll
[2011-07-22 13:16:03 | 000,044,748 | -H-- | C] () -- C:\WINDOWS\System32\mv776498.dl_
[2011-07-19 17:52:18 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nt776498.dll
[2011-07-17 14:20:54 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\br776498.dll
[2011-07-17 13:54:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\w776498.dll
[2011-07-15 14:21:54 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\np776498.dll
[2011-07-11 22:27:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ak776498.dll
[2011-06-29 10:04:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\r}776498.dll
[2011-06-27 14:49:51 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xj776498.dll
[2011-06-27 14:45:45 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tb776498.dll
[2011-06-27 14:45:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\uk776498.dll
[2011-06-27 14:44:29 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\vo776498.dll
[2011-06-26 13:48:05 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xz776498.dll
[2011-06-26 12:03:40 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\wz776498.dll
[2011-06-25 14:04:12 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kz776498.dll
[2011-06-24 13:28:44 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\on776498.dll
[2011-06-24 11:13:25 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011-06-23 18:56:33 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qx776498.dll
[2011-06-21 17:32:13 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\uo776498.dll
[2011-06-21 12:53:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lv776498.dll
[2011-06-20 15:24:41 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nu776498.dll
[2011-06-19 13:47:21 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kt776498.dll
[2011-06-19 13:47:19 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lt776498.dll
[2011-06-17 08:59:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sq776498.dll
[2011-06-14 20:57:32 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\no776498.dll
[2011-06-13 21:01:36 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tn776498.dll
[2011-06-13 10:48:57 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xb776498.dll
[2011-06-12 11:14:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\im776498.dll
[2011-06-10 11:26:33 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ik776498.dll
[2011-06-09 09:06:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ri776498.dll
[2011-06-07 13:44:42 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kh776498.dll
[2011-06-02 13:42:37 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nc776498.dll
[2011-06-02 12:57:40 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\vb776498.dll
[2011-06-01 10:15:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\u€776498.dll
[2011-05-31 20:05:57 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\m€776498.dll
[2011-05-28 14:14:58 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\n}776498.dll
[2011-05-26 11:14:13 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\vz776498.dll
[2011-05-23 20:24:03 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tx776498.dll
[2011-05-23 10:27:06 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\uw776498.dll
[2011-05-22 09:49:13 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\uv776498.dll
[2011-05-21 11:04:32 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\uu776498.dll
[2011-05-20 20:47:09 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ju776498.dll
[2011-05-19 11:27:05 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\rs776498.dll
[2011-05-18 10:22:26 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qr776498.dll
[2011-05-17 13:18:45 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\jr776498.dll
[2011-05-16 13:16:16 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\iq776498.dll
[2011-05-14 20:21:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\so776498.dll
[2011-05-14 14:58:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ko776498.dll
[2011-05-13 16:23:58 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mn776498.dll
[2011-05-13 15:18:28 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ay776498.dll
[2011-05-13 15:17:12 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sb776498.dll
[2011-05-13 15:16:48 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tl776498.dll
[2011-05-13 15:16:41 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\k{776498.dll
[2011-05-13 15:16:34 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\a~776498.dll
[2011-05-13 14:56:28 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\pb776498.dll
[2011-05-11 16:35:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kl776498.dll
[2011-05-10 13:16:55 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lk776498.dll
[2011-05-09 09:59:08 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ni776498.dll
[2011-05-07 11:48:56 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\hh776498.dll
[2011-05-07 07:08:21 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\jg776498.dll
[2011-05-06 09:38:43 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\jf776498.dll
[2011-05-05 09:40:49 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ke776498.dll
[2011-05-04 10:16:07 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ld776498.dll
[2011-05-03 18:30:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\rd776498.dll
[2011-04-27 09:45:29 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\t{776498.dll
[2011-04-24 21:09:26 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ty776498.dll
[2011-04-23 19:58:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sx776498.dll
[2011-04-18 10:00:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\is776498.dll
[2011-04-15 10:17:40 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ro776498.dll
[2011-04-13 10:27:47 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tm776498.dll
[2011-04-12 11:42:37 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sl776498.dll
[2011-04-10 11:49:37 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\pj776498.dll
[2011-04-09 11:01:31 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\si776498.dll
[2011-04-07 19:50:44 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sh776498.dll
[2011-04-07 09:31:48 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\jh776498.dll
[2011-04-05 23:26:33 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sf776498.dll
[2011-04-05 18:52:12 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nf776498.dll
[2011-04-04 07:59:21 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\td776498.dll
[2011-04-03 11:38:25 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kd776498.dll
[2011-04-02 21:19:09 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\pc776498.dll
[2011-03-29 10:39:34 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\u}776498.dll
[2011-03-24 20:34:17 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sy776498.dll
[2011-03-23 18:21:51 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nx776498.dll
[2011-03-22 20:04:44 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qw776498.dll
[2011-03-21 20:27:56 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sv776498.dll
[2011-03-21 14:48:57 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\iv776498.dll
[2011-03-20 15:38:57 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lu776498.dll
[2011-03-19 13:39:26 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mt776498.dll
[2011-03-18 10:08:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\js776498.dll
[2011-03-17 11:19:08 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qq776498.dll
[2011-03-16 12:35:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sp776498.dll
[2011-03-15 10:15:25 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\to776498.dll
[2011-03-12 11:30:56 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ql776498.dll
[2011-03-11 13:11:40 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\il776498.dll
[2011-03-10 14:36:54 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\jk776498.dll
[2011-03-09 13:54:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qi776498.dll
[2011-03-08 12:21:48 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\li776498.dll
[2011-02-27 20:53:55 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xo776498.dll
[2011-01-26 11:25:28 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\uy776498.dll
[2011-01-26 11:23:53 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\be776498.dll
[2011-01-24 18:18:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qe776498.dll
[2011-01-15 13:25:10 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\wo776498.dll
[2011-01-14 18:22:18 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\wl776498.dll
[2011-01-06 01:43:14 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2011-01-04 17:37:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sd776498.dll(1).VIR
[2011-01-04 17:37:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\sd776498.dll
[2010-12-09 10:20:33 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\vi776498.dll(1).VIR
[2010-12-09 10:20:33 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\vi776498.dll
[2010-12-03 19:35:58 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ps776498.dll(1).VIR
[2010-12-03 19:35:58 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ps776498.dll
[2010-11-29 15:29:53 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\o~776498.dll(1).VIR
[2010-11-26 10:57:41 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\j{776498.dll(1).VIR
[2010-11-26 10:52:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qz776498.dll(1).VIR
[2010-11-20 17:14:30 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\qu776498.dll(1).VIR
[2010-11-20 12:26:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ku776498.dll(1).VIR
[2010-11-20 06:38:06 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xt776498.dll(1).VIR
[2010-11-20 06:38:06 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xt776498.dll
[2010-11-19 20:53:17 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tt776498.dll(1).VIR
[2010-11-19 20:53:17 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tt776498.dll
[2010-11-19 10:29:34 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\os776498.dll(1).VIR
[2010-11-19 10:29:34 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\os776498.dll
[2010-11-15 18:36:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mr776498.dll(1).VIR
[2010-11-15 18:36:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mr776498.dll
[2010-11-15 18:34:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\q776498.dll(1).VIR
[2010-11-07 19:44:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xg776498.dll(1).VIR
[2010-11-07 19:44:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xg776498.dll
[2010-09-30 10:46:07 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nr776498.dll(1).VIR
[2010-09-30 10:46:07 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nr776498.dll
[2010-09-29 21:41:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\t~776498.dll(1).VIR
[2010-09-29 21:41:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\t~776498.dll
[2010-09-27 17:27:53 | 000,486,912 | ---- | C] () -- C:\WINDOWS\gamedelete.exe
[2010-09-22 17:04:29 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\pw776498.dll(1).VIR
[2010-09-19 13:06:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\us776498.dll(1).VIR
[2010-09-19 13:06:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\us776498.dll
[2010-09-18 09:09:21 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\wr776498.dll(1).VIR
[2010-09-09 16:22:02 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mj776498.dll(1).VIR
[2010-09-09 12:41:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kj776498.dll(1).VIR
[2010-09-09 12:41:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kj776498.dll
[2010-09-06 19:57:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\w€776498.dll(1).VIR
[2010-08-31 18:04:05 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\o€776498.dll(1).VIR
[2010-08-24 17:15:54 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lr776498.dll(1).VIR
[2010-08-24 17:15:54 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lr776498.dll
[2010-08-20 09:05:53 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tr776498.dll(1).VIR
[2010-08-20 09:05:53 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\tr776498.dll
[2010-08-20 09:05:31 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ur776498.dll(1).VIR
[2010-08-18 09:57:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\xr776498.dll(1).VIR
[2010-08-17 15:19:14 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\pr776498.dll(1).VIR
[2010-08-17 15:13:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\or776498.dll(1).VIR
[2010-08-17 15:13:24 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\or776498.dll
[2010-08-17 10:07:50 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kr776498.dll(1).VIR
[2010-08-17 10:07:50 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\kr776498.dll
[2010-08-17 10:06:38 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ls210095.dll(1).VIR

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"

:Services
vrgwchw
nzlgk

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).

[Mikacz]

Raport z czyszczenia
Nowy log

[wojtas]

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
DRV - [2011-08-21 22:22:38 | 000,005,077 | ---- | M] () [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\rnuiko.sys -- (MCIDRV_2600_6_0)
MOD - [2011-08-21 22:25:07 | 000,081,920 | ---- | M] () -- C:\WINDOWS\system32\tu776498.dll
MOD - [2011-08-21 22:22:30 | 000,081,920 | ---- | M] () -- C:\WINDOWS\system32\r}776498.dll
O33 - MountPoints2\{86cc8686-00d3-11de-be79-001fd0b66fc6}\Shell\AutoRun\command - "" = I:\y6cqb2is.exe
O33 - MountPoints2\{86cc8686-00d3-11de-be79-001fd0b66fc6}\Shell\open\Command - "" = I:\y6cqb2is.exe
[2011-08-21 22:25:07 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\tu776498.dll
[2011-08-21 22:25:07 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\tu776498.dl_
[2011-08-21 22:22:38 | 000,005,077 | ---- | M] () -- C:\WINDOWS\System32\drivers\rnuiko.sys
[2011-08-21 22:22:37 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\us776498.dll
[2011-08-21 22:22:37 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\us776498.dl_
[2011-08-21 22:22:35 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\li776498.dll
[2011-08-21 22:22:35 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\li776498.dl_
[2011-08-21 22:22:34 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\xg776498.dll
[2011-08-21 22:22:34 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\xg776498.dl_
[2011-08-21 22:22:30 | 000,081,920 | ---- | M] () -- C:\WINDOWS\System32\r}776498.dll
[2011-08-21 22:22:30 | 000,044,748 | -H-- | M] () -- C:\WINDOWS\System32\r}776498.dl_

:Services
MCIDRV_2600_6_0

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). Przy podpiętym urządzeniu przenośnym (pendrive, telefon - to co jest podłączane do komputera) , uruchom USBFIX z opcji Listing i pokaż raport na forum.

[Mikacz]

Czyszczenie
USBFix
otl

Pendrive tatusiowy, a on lubi różne niewiadomstwa znosić (żadne argumenty nie skutkują bo "jestem starszym to wiem lepiej", typ z rodzaju nieprzetłumaczalnych) .

[kominekl]

Wejdź w tryb awaryjny. Podepnij wszystkie pamięci przenośne (podłączone podczas skanu USBFix`em). Następnie uruchom OTL -> w oknie Własne opcje skanowania/skrypt wklej:

:Processes
killallprocesses

:OTL

MOD - [2011-08-21 23:41:23 | 000,081,920 | ---- | M] () -- C:\WINDOWS\system32\tu776498.dll
MOD - [2011-08-21 23:37:54 | 000,081,920 | ---- | M] () -- C:\WINDOWS\system32\r}776498.dll

:Files
C:\WINDOWS\System32\tu776498.dll
C:\WINDOWS\System32\tu776498.dl_
C:\WINDOWS\System32\us776498.dll
C:\WINDOWS\System32\us776498.dl_
C:\WINDOWS\System32\li776498.dl_
C:\WINDOWS\System32\xg776498.dll
C:\WINDOWS\System32\li776498.dll
C:\WINDOWS\System32\xg776498.dl_
C:\WINDOWS\System32\r}776498.dll
C:\WINDOWS\System32\r}776498.dl_
C:\WINDOWS\System32\kr776498.dll
C:\WINDOWS\System32\kr776498.dl_
C:\WINDOWS\System32\qc776498.dll
E:\y6cqb2is.exe
F:\y6cqb2is.exe
G:\y6cqb2is.exe

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL.

[Mikacz]

Dobra, temat można zamknąć, tak czy inaczej musiałam zrobić format (komputer umarł całkowicie przy próbie uruchomienia w trybie awaryjnym). Dzięki serdeczne za pomoc! ^^