Pasożyt win32:rootkit-gen [rtk] w programie avast

**Posty:** 31 · przez **motylek1570** 21 Sie 2010, 01:03

u mnie już jest 4 godz, a mam 47%.. dalej leci na C. no cóż, do piątej powinnam się wyrobić

**Posty:** 584 · przez **Andziorka** 21 Sie 2010, 01:09

zostaw najwyżej komputer włączony na noc, do rana się zeskanuje, a Ty się wyśpisz chociaż

**Posty:** 31 · przez **motylek1570** 21 Sie 2010, 01:14

mam jeszcze pytanie, czy to możliwe, że skanuje się drugi raz to samo? ostatni na liście był dysk wymienny G, został przeskanowany, a teraz znów leci C: Documents and Settings, który już był skanowany na samym początku..

**Posty:** 584 · przez **Andziorka** 21 Sie 2010, 01:42

U mnie też tak jakoś dziwnie i nie po kolei leciało z tego co pamiętam, także nie ma co się martwić tym.

**Posty:** 31 · przez **motylek1570** 21 Sie 2010, 01:49

Alleluja! skończył

choć jeszcze raz się zaciął. Teraz mam jednak problem bo nie wiem gdzie mam znależć raport? :oops:

Dodano Dzisiaj, 01:55:
znalazłam folder LOG bo chyba tam trzeba szukać, ale nie mogę wypakować plików..

**Posty:** 584 · przez **Andziorka** 21 Sie 2010, 02:00

W okienku skanera masz Reports i klikasz Save to file.

**Posty:** 31 · przez **motylek1570** 21 Sie 2010, 02:11

kiedy nic takiego nie widzę

mam to okienko:
http://motylek1570.wrzuta.pl/obraz/5rp2Wd9IxXI/bez_tytulu
ale to chyba nie o to chodzi?

**Posty:** 584 · przez **Andziorka** 21 Sie 2010, 02:17

Po zeskanowaniu powinno być takie okienko i na dole jest Reports i tam dajesz Save to file. Zamykałaś coś po zeskanowaniu? A kliknij na to report i zobacz czy nie da się zapisać. Jeśli nie to trudno - zrestartuj komputer, włącz przywracanie systemu, uruchom Avasta i zobacz czy nadal wykrywa jakiś syf.

**Posty:** 31 · przez **motylek1570** 21 Sie 2010, 02:23

niczego nie zamykałam.. chyba, że zrobiłam to niechcący tak szybko że nawet nie zauważyłam..

ja zawsze muszę z czymś nawalić.. klikam na ten report ale niczego nie da się zapisać.

**Posty:** 584 · przez **Andziorka** 21 Sie 2010, 02:38

Trudno.

zrestartuj komputer, włącz przywracanie systemu, uruchom Avasta i zobacz czy nadal wykrywa jakiś syf.

zobaczymy czy będzie ok

**Posty:** 31 · przez **motylek1570** 21 Sie 2010, 21:26

Jeszcze w nocy zrestartowałam komputer i włączyłam przywracanie systemu, ale jak później chciałam włączyć avasta, to kompletnie nic się działo. Minęło prawie 15 minut i nic, dlatego zrestartowałam jeszcze raz ale było to samo. Nie miałam już cierpliwości więc poszłam spać

dziś włączyłam avasta, zrobiłam szybki skan i w końcu niczego nie znalazł.

Jednak komputer dalej się zacina. Chwię chodzi zupełnie normalnie, a później koniec, albo wiesza się przeglądarka i nie daje się wyłączyć albo np chciałam otorzyć folder, minęło ponad 10 minut i nic się nie działo, nic innego również nie dało się włączyć, więc nie wytrzymałam i zrestartowałam kompa. Teraz jest ok ale nie wiem na jak długo.. :-|

**Posty:** 584 · przez **Andziorka** 21 Sie 2010, 23:09

Daj loga z OTL. Sprawdź temperatury komputera programem Everest i podaj na forum. I wykonaj optymalizację systemu: http://forum.programosy.pl/optymalizacja-windowsa-xp-vt89133.html

**Posty:** 31 · przez **motylek1570** 22 Sie 2010, 13:54

http://motylek1570.wrzuta.pl/obraz/1V2PLBed0ca/bez_tytulu

Dodano Dzisiaj, 14:06:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-08-22 13:42:23 - Run 2 OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\ania\Pulpit\Nowy folder2 Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 65,00 Mb Available Physical Memory | 26,00% Memory free 618,00 Mb Paging File | 159,00 Mb Available in Paging File | 26,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 14,11 Gb Free Space | 72,24% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,12 Gb Free Space | 84,54% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 6,39 Gb Free Space | 23,11% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-08-20 14:25:51 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe PRC - [2010-06-14 11:47:02 | 000,836,464 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-11-25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2006-11-21 19:38:22 | 000,035,328 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2005-05-09 20:45:00 | 002,678,784 | ---- | M] () -- C:\Program Files\PLANET WL-8310\WLANPRO.exe PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\acs.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-08-20 14:25:51 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe MOD - [2004-08-04 00:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\DRIVERS\83661971.sys -- (83661971) DRV - [2010-08-21 01:34:53 | 000,007,168 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\utm3mtq3.sys -- (utm3mtq3) DRV - [2009-11-25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-11-25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2009-11-25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-11-25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-11-25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2005-01-21 11:19:28 | 000,411,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2004-08-04 01:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2004-08-04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2004-08-04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2004-06-04 02:18:52 | 000,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/ IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/ IE - HKU\S-1-5-21-790525478-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2001-10-26 19:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\PLANET WL-8310 Configuration Utility.lnk = C:\Program Files\PLANET WL-8310\WLANPRO.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reg.lnk = C:\Program Files\PLANET WL-8310\Reg.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282296148218 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004-06-04 01:36:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-08-20 20:53:45 | 000,000,000 | RHSD | M] - C:\Autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-08-20 20:53:46 | 000,000,000 | RHSD | M] - D:\Autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-08-20 20:53:46 | 000,000,000 | RHSD | M] - E:\Autorun.inf -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-08-20 20:58:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\Virus Removal Tool [2010-08-20 20:53:45 | 000,000,000 | RHSD | C] -- C:\Autorun.inf [2010-08-20 20:24:40 | 073,765,816 | ---- | C] ( ) -- C:\Documents and Settings\ania\Pulpit\setup_9.0.0.722_20.08.2010_21-52.exe [2010-08-20 17:29:32 | 000,000,000 | ---D | C] -- C:\ERDNT [2010-08-20 17:29:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT [2010-08-20 17:29:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010-08-20 17:28:37 | 000,000,000 | ---D | C] -- C:\!FixIEDef [2010-08-20 17:28:02 | 001,142,662 | ---- | C] (Malwareteks.com) -- C:\Documents and Settings\ania\Pulpit\FixIEDef.exe [2010-08-20 15:44:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474 [2010-08-20 15:28:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles [2010-08-20 15:26:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates [2010-08-20 14:26:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak [2010-08-20 14:07:28 | 002,059,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe [2010-08-20 14:07:25 | 002,018,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe [2010-08-20 14:07:21 | 002,182,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe [2010-08-20 14:07:12 | 002,138,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe [2010-08-20 13:47:29 | 000,454,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys [2010-08-20 13:38:57 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll [2010-08-20 13:38:56 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll [2010-08-20 13:38:33 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll [2010-08-20 13:38:27 | 001,985,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll [2010-08-20 13:37:51 | 011,076,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll [2010-08-20 13:30:59 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe [2010-08-20 13:26:36 | 000,273,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys [2010-08-20 11:33:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall [2010-08-20 11:32:58 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$ [2010-08-20 11:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$MSI31Uninstall_KB893803v2$ [2010-08-20 11:24:25 | 000,044,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wups2.dll [2010-08-20 11:24:25 | 000,023,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll.mui [2010-08-20 11:24:25 | 000,018,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng.dll.mui [2010-08-20 11:24:23 | 000,016,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaucpl.cpl.mui [2010-08-20 11:24:21 | 000,015,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui [2010-08-20 11:24:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution [2010-08-19 19:16:14 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\ania\IECompatCache [2010-08-19 19:12:38 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\ania\PrivacIE [2010-08-19 19:02:57 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\ania\IETldCache [2010-08-19 18:58:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM [2010-08-19 18:57:10 | 000,018,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll [2010-08-19 18:55:48 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2010-08-19 18:55:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pl-PL [2010-08-18 19:46:22 | 000,848,856 | ---- | C] (Panda Security ) -- C:\Documents and Settings\ania\Pulpit\USBVaccineSetup.exe [2010-08-18 19:00:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Malwarebytes [2010-08-18 18:59:49 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010-08-18 18:59:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2010-08-18 18:59:42 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010-08-18 18:59:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010-08-18 18:55:40 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\ania\Pulpit\mbam-setup-1.46_[www.programosy.pl].exe [2010-08-18 18:06:46 | 000,000,000 | ---D | C] -- C:\Program Files\Odkurzacz [2010-08-18 18:03:29 | 006,986,501 | ---- | C] (Franmo Software ) -- C:\Documents and Settings\ania\Pulpit\odk12.4.0.30setup_[www.programosy.pl].exe [2010-08-18 18:00:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\Nieużywane skróty pulpitu [2010-08-17 19:09:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2010-08-14 21:54:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\Nowy folder2 [2010-08-08 16:47:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-08-08 16:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\Nowe Gadu-Gadu [2010-07-29 22:43:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-07-29 22:42:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun [2010-07-29 22:42:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010-07-29 22:42:12 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-29 22:42:12 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:12 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2010-07-29 22:36:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Sun [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-08-22 13:33:27 | 000,022,767 | ---- | M] () -- C:\Documents and Settings\ania\Pulpit\bez tytułu.JPG [2010-08-22 13:19:08 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-08-22 12:56:30 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-08-22 12:54:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-08-21 22:42:07 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\ania\NTUSER.DAT [2010-08-21 22:42:07 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\ania\ntuser.ini [2010-08-21 20:17:52 | 000,000,552 | ---- | M] () -- C:\WINDOWS\win.ini [2010-08-21 20:17:52 | 000,000,239 | ---- | M] () -- C:\WINDOWS\system.ini [2010-08-21 20:17:52 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2010-08-21 18:34:35 | 000,005,632 | ---- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-08-21 01:34:53 | 000,007,168 | ---- | M] () -- C:\WINDOWS\System32\drivers\utm3mtq3.sys [2010-08-20 20:49:40 | 073,765,816 | ---- | M] ( ) -- C:\Documents and Settings\ania\Pulpit\setup_9.0.0.722_20.08.2010_21-52.exe [2010-08-20 17:28:04 | 001,142,662 | ---- | M] (Malwareteks.com) -- C:\Documents and Settings\ania\Pulpit\FixIEDef.exe [2010-08-20 16:36:14 | 000,266,208 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-08-20 15:48:13 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010-08-20 15:44:38 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job [2010-08-18 19:46:53 | 000,848,856 | ---- | M] (Panda Security ) -- C:\Documents and Settings\ania\Pulpit\USBVaccineSetup.exe [2010-08-18 18:59:54 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-08-18 18:57:52 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\ania\Pulpit\mbam-setup-1.46_[www.programosy.pl].exe [2010-08-18 18:09:01 | 000,068,456 | ---- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2010-08-18 18:07:15 | 000,000,856 | ---- | M] () -- C:\Documents and Settings\ania\Pulpit\Szybkie Czyszczenie Dysku.lnk [2010-08-18 18:07:15 | 000,000,760 | ---- | M] () -- C:\Documents and Settings\ania\Pulpit\Odkurzacz.lnk [2010-08-18 18:05:31 | 006,986,501 | ---- | M] (Franmo Software ) -- C:\Documents and Settings\ania\Pulpit\odk12.4.0.30setup_[www.programosy.pl].exe [2010-08-18 14:40:56 | 005,854,052 | -H-- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-08-11 17:09:13 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010-08-09 14:54:27 | 000,000,369 | -H-- | M] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-08-01 12:33:10 | 000,000,468 | ---- | M] () -- C:\Documents and Settings\ania\Moje dokumenty\spider.sav [2010-07-29 22:42:02 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:02 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:42:01 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-08-22 13:31:55 | 000,022,767 | ---- | C] () -- C:\Documents and Settings\ania\Pulpit\bez tytułu.JPG [2010-08-21 01:34:48 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\utm3mtq3.sys [2010-08-20 15:44:37 | 000,000,260 | ---- | C] () -- C:\WINDOWS\tasks\WGASetup.job [2010-08-18 18:59:54 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-08-18 18:07:15 | 000,000,856 | ---- | C] () -- C:\Documents and Settings\ania\Pulpit\Szybkie Czyszczenie Dysku.lnk [2010-08-18 18:07:15 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\ania\Pulpit\Odkurzacz.lnk [2004-10-12 07:40:58 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2004-10-12 07:39:48 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2004-10-12 07:39:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2004-10-09 07:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2004-10-05 09:16:08 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-07-17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-06-04 02:18:49 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar52119x.sys [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar5211.sys [2004-06-04 02:18:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2004-06-04 02:06:30 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2004-06-04 02:00:52 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2004-06-04 02:00:52 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2004-06-04 02:00:49 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2004-06-04 02:00:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2004-06-04 02:00:48 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [color=#E56717]========== LOP Check ==========[/color] [2004-06-04 02:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Panda Security [2010-08-08 16:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-06-24 18:31:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Opera [2010-08-20 15:44:38 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

Dodano Dzisiaj, 14:07:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-08-22 13:42:23 - Run 2 OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\ania\Pulpit\Nowy folder2 Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 65,00 Mb Available Physical Memory | 26,00% Memory free 618,00 Mb Paging File | 159,00 Mb Available in Paging File | 26,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 14,11 Gb Free Space | 72,24% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,12 Gb Free Space | 84,54% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 6,39 Gb Free Space | 23,11% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = Opera.HTML] -- C:\Program Files\Opera\opera.exe (Opera Software) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0FE76E17-23F0-457C-9126-DE043402FE1F}" = Opera 10.60 "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12 "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007 "{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007 "{94E4FBD6-540C-4DB6-A469-B1FA248DA33E}" = PLANET WL-8310 "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ALLPlayer V3.0_is1" = ALLPlayer V3.X "avast!" = avast! Antivirus "C-Media Audio" = C-Media 3D Audio "ENTERPRISE" = Microsoft Office Enterprise 2007 "EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.00 "Foxit Reader" = Foxit Reader "ie8" = Windows Internet Explorer 8 "IrfanView" = IrfanView (remove only) "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "NVIDIA Drivers" = NVIDIA Drivers "Odkurzacz 12.4_is1" = Odkurzacz 12.4 "Picasa 3" = Picasa 3 "Winamp" = Winamp (remove only) "WinRAR archiver" = Archiwizator WinRAR "XP Codec Pack" = XP Codec Pack [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Antivirus Events ] Error - 2010-08-14 15:38:30 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 15:38:48 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 15:45:01 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:33:49 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:36:14 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:36:41 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:58:36 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 17:00:48 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-15 12:18:20 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = AAVM - initialization error: Unhandled exception in AavmProviderStop [Inner], MAIL. Error - 2010-08-16 07:44:39 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = AAVM - initialization error: Unhandled exception in AavmProviderStop [Inner], MAIL. [ Application Events ] Error - 2010-07-29 16:47:44 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd flash.ocx, wersja 6.0.79.0, adres błędu 0x0001cfd3. Error - 2010-07-29 16:51:06 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd mshtml.dll, wersja 6.0.2900.2180, adres błędu 0x0007f463. Error - 2010-08-15 10:19:42 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ashWebSv.exe, wersja 4.8.1367.0, moduł powodujący błąd aswCmnB.dll, wersja 4.8.1367.0, adres błędu 0x0000893c. Error - 2010-08-15 10:52:51 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ashWebSv.exe, wersja 4.8.1367.0, moduł powodujący błąd aswCmnB.dll, wersja 4.8.1367.0, adres błędu 0x0000893c. Error - 2010-08-15 12:47:03 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ashWebSv.exe, wersja 4.8.1367.0, moduł powodujący błąd aswCmnB.dll, wersja 4.8.1367.0, adres błędu 0x0000893c. [ System Events ] Error - 2010-08-21 14:32:07 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-21 14:32:07 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-21 14:32:32 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-21 14:32:32 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-22 06:57:31 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7026 Description = Nie można załadować następujących sterowników startu rozruchowego lub systemowego: 83661971 Error - 2010-08-22 06:58:08 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-22 06:58:08 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-22 06:59:00 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-22 06:59:00 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-22 07:04:29 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7034 Description = Usługa avast! Web Scanner niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. < End of report >

**Posty:** 584 · przez **Andziorka** 22 Sie 2010, 21:45

W okienko OTL wklej poniższy skrypt i klik na Wykonaj skrypt:

:Processes
explorer.exe

:OTL
O32 - AutoRun File - [2010-08-20 20:53:45 | 000,000,000 | RHSD | M] - C:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-08-20 20:53:46 | 000,000,000 | RHSD | M] - D:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-08-20 20:53:46 | 000,000,000 | RHSD | M] - E:\Autorun.inf -- [ NTFS ]

:Files
C:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
C:\WINDOWS\Tasks\WGASetup.job

:REG
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]
[clearallrestorepoints]
[start explorer]
[Reboot]

**Posty:** 31 · przez **motylek1570** 22 Sie 2010, 22:05

Zrobione

Kod: Zaznacz wszystko: All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== OTL ========== File not found. File not found. File not found. ========== FILES ========== C:\Autorun.inf folder moved successfully. Folder move failed. D:\Autorun.inf scheduled to be moved on reboot. Folder move failed. E:\Autorun.inf scheduled to be moved on reboot. C:\WINDOWS\Tasks\WGASetup.job moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: ania ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 1805767 bytes ->Java cache emptied: 4621 bytes ->Opera cache emptied: 240 bytes ->Flash cache emptied: 1800 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 449322 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 2,00 mb Restore points cleared and new OTL Restore Point set! OTL by OldTimer - Version 3.2.10.0 log created on 08222010_214934 Files\Folders moved on Reboot... Folder move failed. D:\Autorun.inf scheduled to be moved on reboot. Folder move failed. E:\Autorun.inf scheduled to be moved on reboot. File\Folder C:\WINDOWS\temp\_avast4_\unp255507392.tmp not found! File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found! C:\WINDOWS\temp\Perflib_Perfdata_5f0.dat moved successfully. Registry entries deleted on Reboot...

**Posty:** 584 · przez **Andziorka** 22 Sie 2010, 22:22

Uruchom OTL i kliknij na Sprzątnij. To by było na tyle.

**Posty:** 31 · przez **motylek1570** 24 Sie 2010, 22:51

Andziorka :* komputer co prawda ma jeszcze czasem chwile zadumy

ale już sporadycznie

Baaaaaaaardzo dziękuję za pomoc

Jestem strasznie wdzięczna za wszystko :* Naprawdę bardzo Ci dziękuję :*

Kto jest na forum