Wirus - exploit.cve2008.5353

**Posty:** 52 · przez **Jean** 22 Lut 2010, 21:08

Czołem ;] Na wstępie chcę od razu zaznaczyć, że z kompem od dłuższego czasu nic się nie dzieje, mimo to po dzisiejszym skanie z Doctora Weba, zostały wykryte wirusy typu Exploit.CVE2008.5353 oraz Antiload Java. Skanowałam dodatkowo te pliki Avastem, lecz on uznaje te pliki za "czyste". I jeszcze Doctor Web nie jest w stanie usunąć tych plików. Co w tej sytuacji powinnam zrobić? Z góry dzięki ;]

Kod: Zaznacz wszystko: DwShield uruchomiony Wersja silnika: 5.00 (5.00.1.12222) Wersja silnika API: 2.02 [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\ae1ff466 - 267 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\29b9cc08 - 1 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\6f1e1df8 - 19562 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\850a0fce - 27102 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\e4deffb4 - 21223 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\ac2e8d0b - 26228 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\615dd218 - 23251 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\c2d897fc - 14982 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\c2e8a107 - 17748 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\f532509f - 18725 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\ee3fe377 - 18429 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\5472df8e - 872 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\6168a3a6 - 142240 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\74ceda10 - 66726 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\07522543 - 24512 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\2c801051 - 82762 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\a43549ea - 514157 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\8bcd92f2 - 1106 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\2a33ad5f - 1569 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\c0139ceb - 1834 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\ca20bf48 - 1458 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\a5af5790 - 2146 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\6dd2f760 - 1714 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\eed3ffe6 - 2095 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\ee96f754 - 2715 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\023e5931 - 2545 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\736dc27f - 2801 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\6e070bb6 - 6197 wykrywanych wirusów [Antywirusowa baza danych] C:\Users\\AppData\Local\Temp\RarSFX2\9b76d59b - 28348 wykrywanych wirusów Całkowita ilość wirusów: 1073315 [Auto-test] C:\Users\\AppData\Local\Temp\RarSFX2\65xc2XP.exe Plik klucza: C:\Users\\AppData\Local\Temp\RarSFX2\setup.key Numer licencji: : Zarejestrowany dla: An unauthorized User Klucz licencyjny aktywny od: 2009-09-14 Klucz licencyjny wygasa: 2010-03-17 Proces w pamięci: System:4 - OK [Test pamięci] Nie znaleziono wirusów

**Posty:** 4459 · przez **jarski185** 22 Lut 2010, 21:12

Eloszka- zasady-wstawiania-logow-vt93842.html

**Posty:** 2183 · przez **NieWiem** 22 Lut 2010, 22:36

Ja myślę, że tu się może obejść bez logów :wink:

No chyba że okaże się tutaj jakieś coś mega, ale to nam może pokazać Malwarebytes'.

1.

Pobierz program TFC
Zamknij wszystkie otwarte programy - inaczej TFC zrobi to za Ciebie
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Kliknij przycisk Start
Czyszczenie lokalizacji tymczasowych może chwilę potrwać (ale znowu bez przesady), uzbrój się w cierpliwość.
Jeśli padnie prośba o restart - zgódź się.

2.

Pobierz program Malwarebytes' Anti-Malware i zainstaluj.
Wersja freeware nie ma opcji automatycznych aktualizacji, dlatego pod koniec instalacji upewnij się, że zaznaczone są opcje:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Wciśnij Finish.
Przeprowadź pełne skanowanie komputera.
Raport z tego skanowania proszę wkleić na forum w tagach [code], lub na stronie http://www.wklej.org a w odpowiedzi podać tylko linka do tej strony.

**Posty:** 52 · przez **Jean** 23 Lut 2010, 00:42

Hm, Malwarebytes' Anti-Malware nie wykrył niczego podejrzanego. Wykonałam jeszcze wcześniej log z OTL.

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.44 Wersja bazy definicji: 3777 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 2010-02-22 22:48:38 mbam-log-2010-02-22 (22-48-38).txt Typ skanowania: Pełne skanowanie (C:\|E:\|) Przeskanowane obiekty: 198599 Upłynęło: 42 minute(s), 56 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 0 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: (Nie wykryto groźnych plików)

Kod: Zaznacz wszystko: OTL logfile created on: 2010-02-22 20:17:29 - Run 1 OTL by OldTimer - Version 3.1.30.1 Folder = C:\Users\\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 49,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 71,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 74,37 Gb Total Space | 32,64 Gb Free Space | 43,88% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 73,21 Gb Total Space | 25,52 Gb Free Space | 34,85% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-02-22 20:15:02 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\\Desktop\OTL.exe PRC - [2010-02-07 20:58:10 | 001,800,464 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe PRC - [2010-02-07 20:57:49 | 000,723,632 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe PRC - [2009-06-12 20:09:14 | 000,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-02-05 21:08:45 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-02-05 21:08:40 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-02-05 21:08:26 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-02-05 21:06:04 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-02-05 21:01:25 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2008-10-29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008-09-24 14:32:48 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2008-01-30 15:28:06 | 000,643,072 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\System32\Ati2evxx.exe PRC - [2008-01-29 18:51:52 | 004,911,104 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008-01-29 15:00:40 | 000,430,080 | ---- | M] () -- C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe PRC - [2008-01-25 11:22:14 | 000,509,816 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\SmoothView\SmoothView.exe PRC - [2008-01-22 14:25:26 | 000,712,704 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\FlashCards\TCrdMain.exe PRC - [2008-01-22 11:00:30 | 004,624,384 | ---- | M] () -- C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe PRC - [2008-01-21 15:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe PRC - [2008-01-17 16:27:52 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TPwrMain.exe PRC - [2008-01-17 16:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe PRC - [2008-01-09 13:02:08 | 001,056,768 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\NDSTray.exe PRC - [2007-12-25 12:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe PRC - [2007-12-25 12:06:52 | 000,405,504 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe PRC - [2007-12-06 18:12:58 | 000,095,528 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe PRC - [2007-12-06 18:12:44 | 001,029,416 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PRC - [2007-12-03 17:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe PRC - [2007-11-21 16:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe PRC - [2007-09-28 15:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe PRC - [2006-10-05 11:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe PRC - [2006-08-23 15:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-02-22 20:15:02 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\\Desktop\OTL.exe MOD - [2010-02-07 20:59:24 | 000,171,552 | ---- | M] (COMODO) -- C:\Windows\System32\guard32.dll MOD - [2008-01-21 03:23:44 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2010-02-07 20:57:49 | 000,723,632 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent) SRV - [2009-02-05 21:08:40 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-02-05 21:08:26 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-02-05 21:06:04 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-02-05 21:01:25 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2008-09-24 14:32:48 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2008-04-23 09:24:59 | 000,138,168 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2008-01-30 15:28:06 | 000,643,072 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\Windows\System32\Ati2evxx.exe -- (Ati External Event Utility) SRV - [2008-01-21 15:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv) SRV - [2008-01-21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008-01-17 16:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv) SRV - [2007-12-25 12:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service) SRV - [2007-12-03 17:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service) SRV - [2007-11-21 16:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv) SRV - [2007-09-28 15:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2006-11-02 13:35:29 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\ehome\ehstart.dll -- (ehstart) SRV - [2006-10-05 11:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2006-08-23 15:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-02-07 21:01:26 | 000,074,328 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (inspect) DRV - [2010-02-07 20:59:20 | 000,029,520 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp) DRV - [2010-02-07 20:59:19 | 000,130,960 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdguard.sys -- (cmdGuard) DRV - [2009-11-16 16:58:51 | 000,278,984 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2009-11-16 16:58:51 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009-02-05 21:07:23 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP) DRV - [2009-02-05 21:07:12 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-02-05 21:06:59 | 000,051,792 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt) DRV - [2009-02-05 21:06:20 | 000,051,376 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-02-05 21:06:10 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2008-12-11 20:03:27 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2008-07-31 23:17:04 | 000,043,872 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2008-02-15 17:01:18 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2008-01-30 16:24:00 | 003,483,648 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2008-01-30 11:34:20 | 002,058,528 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-01-21 14:42:24 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32) DRV - [2008-01-21 03:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR) DRV - [2008-01-21 03:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2008-01-21 03:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2008-01-21 03:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2008-01-21 03:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2008-01-21 03:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2008-01-21 03:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2008-01-21 03:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2008-01-21 03:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2008-01-21 03:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2008-01-21 03:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2008-01-21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2008-01-21 03:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2008-01-21 03:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2008-01-21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2008-01-21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2008-01-21 03:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2008-01-21 03:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2008-01-21 03:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2008-01-21 03:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2008-01-21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2008-01-21 03:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) DRV - [2008-01-21 03:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2008-01-21 03:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008-01-21 03:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2008-01-21 03:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2007-12-28 19:21:54 | 000,104,448 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007-12-17 11:45:20 | 000,018,432 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR) DRV - [2007-12-06 18:12:48 | 000,196,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP) DRV - [2007-11-09 14:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ) DRV - [2007-09-29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor) DRV - [2007-09-26 06:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Sterownik karty Intel(R) DRV - [2007-07-30 10:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2007-07-30 09:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2007-01-04 12:48:04 | 000,104,344 | ---- | M] (Analog Devices Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e4usbaw.sys -- (e4usbaw) DRV - [2007-01-04 12:47:48 | 000,069,656 | ---- | M] (Analog Deivces) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\e4ldr.sys -- (E4LOADER) General Purpose USB Driver (e4ldr.sys) DRV - [2006-11-28 14:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006-11-20 13:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk) DRV - [2006-11-02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006-11-02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006-11-02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006-11-02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006-11-02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006-11-02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006-11-02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006-11-02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006-11-02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006-11-02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006-11-02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006-11-02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006-11-02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006-11-02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006-11-02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006-11-02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006-11-02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006-11-02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006-11-02 07:37:21 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv) DRV - [2006-10-23 15:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec) DRV - [2006-10-18 10:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-494912332-2433614648-2813404568-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl IE - HKU\S-1-5-21-494912332-2433614648-2813404568-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-494912332-2433614648-2813404568-1000\S-1-5-21-494912332-2433614648-2813404568-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-06-12 20:09:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-02-21 22:53:14 | 000,000,000 | ---D | M] [2009-06-05 13:28:09 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\mozilla\Extensions [2009-06-05 13:28:09 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\mozilla\Firefox\Profiles\1zzvxu1h.default\extensions [2009-06-05 13:29:03 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\mozilla\Firefox\Profiles\2zzqfk7y.Profil\extensions [2009-06-12 00:37:02 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2006-06-03 17:43:22 | 000,000,896 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2008-04-03 18:19:08 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2007-03-31 18:11:54 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2006-06-03 17:43:22 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2008-03-28 22:36:04 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2007-01-05 12:40:56 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2006-09-18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3 - HKU\S-1-5-21-494912332-2433614648-2813404568-1000\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found. O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony) O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO) O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION) O4 - HKLM..\Run: [NDSTray.exe] File not found O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA) O4 - HKLM..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe (Toshiba) O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation) O4 - HKU\S-1-5-21-494912332-2433614648-2813404568-1000..\Run: [TOSCDSPD] File not found O4 - HKU\S-1-5-21-494912332-2433614648-2813404568-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O4 - Startup: C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-494912332-2433614648-2813404568-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-494912332-2433614648-2813404568-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-494912332-2433614648-2813404568-1000_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O9 - Extra Button: eBay - {76577871-04EC-495E-A12B-91F7C3600AFA} - File not found O9 - Extra Button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - File not found O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-494912332-2433614648-2813404568-1000\..Trusted Domains: internet ([]about in Internet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll) - C:\PROGRA~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll File not found O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll (COMODO) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - File not found O24 - Desktop WallPaper: C:\Users\\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O24 - Desktop BackupWallPaper: C:\Users\\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-09-18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009-04-22 14:23:32 | 000,048,076 | ---- | M] () - E:\AutoUpdate Blocker.zip -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-02-22 20:15:00 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Users\\Desktop\OTL.exe [2010-02-22 17:30:00 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010-02-08 08:40:18 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mdimon.dll [2010-02-05 21:52:54 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Template [2010-02-05 20:33:55 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Thinstall [2010-02-05 20:00:00 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\Seven Zip [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-02-22 20:16:12 | 002,621,440 | -HS- | M] () -- C:\Users\\NTUSER.DAT [2010-02-22 20:15:02 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\\Desktop\OTL.exe [2010-02-22 20:13:24 | 111,862,100 | ---- | M] () -- C:\Users\\Desktop\[Hatsuyuki-Suspeedia]_Shugo_Chara!!_Doki_59_[1280x720][9de1abe6].mkv.part [2010-02-22 20:13:24 | 000,000,000 | ---- | M] () -- C:\Users\\Desktop\[Hatsuyuki-Suspeedia]_Shugo_Chara!!_Doki_59_[1280x720][9de1abe6].mkv [2010-02-22 19:36:14 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl [2010-02-22 19:36:10 | 000,000,312 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job [2010-02-22 19:36:09 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010-02-22 19:36:06 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010-02-22 19:36:06 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010-02-22 19:35:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010-02-22 19:35:52 | 2145,345,536 | -HS- | M] () -- C:\hiberfil.sys [2010-02-22 16:35:32 | 031,723,224 | ---- | M] () -- C:\Users\\Desktop\launch.exe [2010-02-22 15:08:37 | 000,524,288 | -HS- | M] () -- C:\Users\\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2010-02-22 15:08:37 | 000,065,536 | -HS- | M] () -- C:\Users\\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010-02-22 15:08:29 | 005,360,349 | -H-- | M] () -- C:\Users\\AppData\Local\IconCache.db [2010-02-22 07:19:30 | 000,095,664 | ---- | M] () -- C:\Users\\AppData\Local\GDIPFONTCACHEV1.DAT [2010-02-22 07:17:57 | 000,358,384 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010-02-21 22:53:13 | 000,000,128 | ---- | M] () -- C:\Windows\win.ini [2010-02-21 20:13:14 | 000,001,833 | ---- | M] () -- C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2010-02-19 17:06:03 | 000,101,376 | ---- | M] () -- C:\Users\\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-02-08 08:40:20 | 000,000,544 | ---- | M] () -- C:\Windows\ODBC.INI [2010-02-07 21:41:13 | 000,002,284 | ---- | M] () -- C:\Users\\AppData\Roaming\wklnhst.dat [2010-02-07 21:01:26 | 000,074,328 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\inspect.sys [2010-02-07 20:59:24 | 000,171,552 | ---- | M] (COMODO) -- C:\Windows\System32\guard32.dll [2010-02-07 20:59:20 | 000,029,520 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdhlp.sys [2010-02-07 20:59:19 | 000,130,960 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdguard.sys [2010-01-26 12:03:44 | 000,385,355 | ---- | M] () -- C:\Users\\Konachan.com - 38389 byousoku_5_centimetre comix_wave scenic shinkai_makoto train.jpg [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-02-05 21:52:52 | 000,002,284 | ---- | C] () -- C:\Users\\AppData\Roaming\wklnhst.dat [2010-01-26 12:03:42 | 000,385,355 | ---- | C] () -- C:\Users\\Konachan.com - 38389 byousoku_5_centimetre comix_wave scenic shinkai_makoto train.jpg [2009-11-24 15:12:41 | 000,000,050 | ---- | C] () -- C:\Windows\MegaManager.INI [2009-11-16 16:58:51 | 000,278,984 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2009-11-16 16:58:51 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2009-09-02 15:43:15 | 000,000,169 | ---- | C] () -- C:\Windows\adidsl.ini [2009-09-02 15:43:15 | 000,000,021 | ---- | C] () -- C:\Windows\Fast800.ini [2009-09-02 15:41:48 | 000,000,990 | ---- | C] () -- C:\Windows\adiras.ini [2009-09-02 15:41:42 | 000,046,892 | ---- | C] () -- C:\Windows\System32\ADADIX16.DLL [2009-03-26 18:32:51 | 000,000,544 | ---- | C] () -- C:\Windows\ODBC.INI [2009-03-16 17:58:57 | 000,000,175 | ---- | C] () -- C:\Users\\AppData\Roaming\default.rss [2009-01-25 09:50:39 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll [2009-01-25 09:50:38 | 000,795,648 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2009-01-25 09:50:37 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2009-01-25 09:50:37 | 000,130,048 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2009-01-25 09:50:36 | 000,057,344 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2009-01-25 09:50:36 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest [2008-12-23 14:20:23 | 000,004,767 | ---- | C] () -- C:\Windows\Irremote.ini [2008-12-23 14:09:14 | 000,771,584 | ---- | C] () -- C:\Windows\System32\RGSS100J.dll [2008-12-19 16:53:58 | 000,000,680 | ---- | C] () -- C:\Users\\AppData\Local\d3d9caps.dat [2008-12-11 20:03:27 | 000,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2008-12-09 17:27:35 | 000,101,376 | ---- | C] () -- C:\Users\\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008-12-09 15:40:15 | 000,010,132 | ---- | C] () -- C:\Windows\System32\tosmreg.ini [2008-12-09 15:40:14 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini [2008-12-09 15:40:14 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll [2008-12-09 15:40:14 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini [2008-05-13 08:12:33 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI [2008-04-23 09:15:39 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll [2008-04-23 09:15:39 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll [2008-04-23 09:15:39 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll [2008-04-23 09:15:39 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll [2008-04-23 09:15:39 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll [2008-04-23 09:15:39 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll [2008-04-23 08:47:55 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2008-04-23 08:29:39 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008-04-23 08:28:04 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1329.dll [2008-01-28 18:01:42 | 000,057,344 | ---- | C] () -- C:\Windows\System32\SmartFaceVCapt.dll [2008-01-28 18:01:06 | 000,471,040 | ---- | C] () -- C:\Windows\System32\SmartFaceVCP.dll [2008-01-28 17:53:02 | 006,701,056 | ---- | C] () -- C:\Windows\System32\FaceHI.dll [2008-01-28 17:53:02 | 000,995,328 | ---- | C] () -- C:\Windows\System32\FaceRec.dll [2008-01-28 17:53:02 | 000,126,976 | ---- | C] () -- C:\Windows\System32\SmartFaceVCtrl.dll [2008-01-28 17:52:28 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IppLib.dll [2007-12-21 15:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll [2006-11-02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006-11-02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2005-07-22 20:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll [color=#E56717]========== LOP Check ==========[/color] [2009-07-16 22:06:16 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Audacity [2008-12-11 20:03:08 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\DAEMON Tools [2009-11-22 20:04:20 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\GHISLER [2009-05-20 14:02:53 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\GlarySoft [2010-02-05 21:52:54 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Template [2010-02-05 20:33:55 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Thinstall [2009-03-16 18:28:08 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Toshiba [2010-02-22 15:08:31 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\uTorrent [2010-02-22 19:36:10 | 000,000,312 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job [2010-02-22 15:08:42 | 000,032,532 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] < End of report >

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-02-22 20:17:29 - Run 1 OTL by OldTimer - Version 3.1.30.1 Folder = C:\Users\Joanna\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 49,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 71,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 74,37 Gb Total Space | 32,64 Gb Free Space | 43,88% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 73,21 Gb Total Space | 25,52 Gb Free Space | 34,85% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) htmlfile [print] -- Reg Error: Key error. http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [Browse with &IrfanView] -- "e:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "FirewallDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{43C1B1D9-8495-4783-ACA1-C0AD4345055D}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{5118A1CA-4976-4174-998A-9C42198F86C9}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{E67DEC23-C9F7-4EF6-B4EC-9310DE9E0E08}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "TCP Query User{05E1389C-33A3-444D-8B25-9A14264F5182}E:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=e:\program files\mirc\mirc.exe | "TCP Query User{48B2FE32-D401-4127-8279-7FD289E178B8}E:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=e:\program files\utorrent\utorrent.exe | "TCP Query User{545A42E1-0CC7-4F8C-9F32-C977BB1A72BF}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | "TCP Query User{730D0960-C3B3-4660-B1B4-66A860598F5A}E:\program files\gadu-gadu\gg.exe" = protocol=6 | dir=in | app=e:\program files\gadu-gadu\gg.exe | "TCP Query User{91616C47-A231-408D-BA4A-FE1022769CE1}C:\program files\gadu-gadu\gg.exe" = protocol=6 | dir=in | app=c:\program files\gadu-gadu\gg.exe | "TCP Query User{AA740910-03AC-4229-9947-09B7999901BC}E:\program files\gadu-gadu\gg.exe" = protocol=6 | dir=in | app=e:\program files\gadu-gadu\gg.exe | "UDP Query User{2E2B5E22-090C-4337-8FB3-6F48447A95FF}E:\program files\gadu-gadu\gg.exe" = protocol=17 | dir=in | app=e:\program files\gadu-gadu\gg.exe | "UDP Query User{36CBFEEB-0586-4475-BC75-6F4663605C6F}E:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=e:\program files\utorrent\utorrent.exe | "UDP Query User{57EF6667-F545-4498-996C-22D3F720D25E}E:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=e:\program files\mirc\mirc.exe | "UDP Query User{5AD1D1B1-8300-4510-A1EB-AB0706C7CADC}E:\program files\gadu-gadu\gg.exe" = protocol=17 | dir=in | app=e:\program files\gadu-gadu\gg.exe | "UDP Query User{5FB82B95-C9E7-43F1-BC7F-0EB2F65DC5C5}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | "UDP Query User{821A24E5-3F6D-47C8-8F0C-C4416C9DA2A4}C:\program files\gadu-gadu\gg.exe" = protocol=17 | dir=in | app=c:\program files\gadu-gadu\gg.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help "{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode "{09527978-C15B-6AF8-5582-C9784F8F3B69}" = Catalyst Control Center Localization Chinese Traditional "{0A6A6F94-7EFC-2FEA-CC70-FB6A22188F88}" = Catalyst Control Center Localization Swedish "{0AB16A24-2465-0F1A-C12E-BFAB6F612191}" = Catalyst Control Center Localization Japanese "{0C36CB3D-A859-B0CE-253A-89C27BAB2AA4}" = CCC Help French "{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool "{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM "{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights "{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist "{16E42331-56E6-53BC-428C-6E2020E58025}" = Catalyst Control Center Localization Portuguese "{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM "{1B8FAB81-0811-FAE4-A77C-33683B43A9D8}" = ccc-utility "{1D88A6A6-C2C6-3E2F-DDB6-A635090141B0}" = Catalyst Control Center Graphics Full New "{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{25F83D04-6D32-5AAD-C057-AEA7B8C746E3}" = Catalyst Control Center Localization Spanish "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 13 "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com "{2883F6F5-0509-43F3-868C-D50330DD9DD3}" = TOSHIBA Hardware Setup "{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart "{306B39C9-3AB1-4161-8567-9C7E50B41AE3}" = Microsoft Works "{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax "{3573E889-A6BA-DADE-8F70-8B756D0A6573}" = CCC Help German "{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba "{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help "{3FD66338-6A62-96FE-BE27-957F1D5A4C1C}" = CCC Help Italian "{44AB916C-E8AE-3A81-269A-2A55C4802C7A}" = Catalyst Control Center Graphics Full Existing "{48284361-3F81-8AD3-0630-72AEDB614936}" = Catalyst Control Center Localization Korean "{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = SAGEM F@st 800-840 "{4B1E87C3-00DE-4898-8E39-E390AAEF2391}" = TOSHIBA Supervisor Password "{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help "{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter "{507DB37B-FFE7-429E-FF1B-D46F3BB0FE96}" = Catalyst Control Center Graphics Light "{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap "{54E1A977-FC97-AAAB-A3C2-CA8ED6545951}" = Catalyst Control Center Localization Italian "{55BDC5EB-A3CF-46D6-9F23-3144436AECAE}" = Podreczniki TOSHIBA "{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{5980B928-1C95-4B3E-957B-B02D8147FF9E}" = Desktop SMS "{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02 "{5A62A775-A29A-4CE1-BBC2-4A9CD0B211EF}" = Nero Live Help "{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision "{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help "{5C42EAB8-54F9-423A-948C-1CBEF25F8DB4}" = Nero PhotoSnap Help "{5C9BB0B3-E830-4814-BBA4-D93535E1C7B9}" = Nero Live "{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator "{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center "{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{74D7540C-9E12-A710-00CF-D8F4DC7465F4}" = CCC Help Chinese Traditional "{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed "{753973C4-B961-43BF-B2D4-3C8C92F7216E}" = Nero DriveSpeed "{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder "{78523651-D8B1-11DC-CCEE-741589645873}" = Nero DiscSpeed "{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree "{80B0B1FC-41C9-D8B9-D183-D31218875F73}" = CCC Help Swedish "{86BBFA80-9ED0-793A-0A10-6CB37BF6409C}" = CCC Help Portuguese "{8750318B-6559-BD76-E8C5-1DE2C8CA961A}" = CCC Help Korean "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista "{8C654BD0-1949-43DE-84F2-EC2A1ABB0CB4}" = Nero ShowTime "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{91B067A5-89C8-3C29-57EE-597034D56D42}" = Catalyst Control Center Core Implementation "{9317BC0B-8869-8D99-41F3-DE4ECE37A8A4}" = CCC Help Chinese Standard "{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express "{948FFAAE-C57F-447B-9B07-3721E950BFDC}" = Nero ShowTime "{9607BEEE-ED89-FE20-C992-AF3DC46EBEB5}" = Catalyst Control Center Localization German "{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer "{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter "{9bb62e93-2057-469b-b125-6a2199caa5e8}" = Nero 9 "{9D32CC0B-4B40-F54A-AAF1-39E9173500AD}" = CCC Help Japanese "{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center "{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer "{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable "{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress "{A8399F58-234A-48C6-BA55-30C15738BF3C}" = Nero CoverDesigner "{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress "{A98321B3-98EE-4BB3-B55A-C6DFD3A47933}" = CCC Help English "{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool "{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed "{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3 "{AF8B7B36-0427-22DD-8005-07869A67CE20}" = ccc-core-static "{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor "{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser "{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator "{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help "{BCD82AB5-670D-4242-90FA-1F97103C16CD}" = Movie Templates - Starter Kit "{C19D5636-D868-57D1-A36E-EF1056E9813C}" = Catalyst Control Center Localization Chinese Standard "{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition "{C99C89A3-119A-45E6-B26E-DD5643CAA0C5}" = Menu Templates - Starter Kit "{CB685FA8-9C7A-73F5-3BBF-38B8F63A1C48}" = Catalyst Control Center Graphics Previews Vista "{CD1826A5-CFCC-4C6E-9F9D-E181876162EA}" = Nero Rescue Agent "{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba "{D580C9A6-3240-721A-19F0-E4C8A1F400DA}" = CCC Help Dutch "{D58A1E94-9EEA-4C6E-B9FB-D7C63DC6C941}" = Catalyst Control Center - Branding "{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help "{DECF4937-8E72-5723-E82E-74A566F73197}" = Catalyst Control Center Localization French "{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series "{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget "{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher "{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help "{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights "{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities "{EFD48405-94CC-71B6-A915-5B0121C6C7E3}" = Catalyst Control Center Localization Dutch "{F041BEBB-2E74-01BC-7DAB-CF352809FE79}" = CCC Help Spanish "{F06B8809-3C26-E6A0-3D80-084331666B73}" = Skins "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA "{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision "{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop 7.0 CE" = Adobe Photoshop 7.0 CE "Anime List" = Anime List 2.0 "Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.7 (Unicode) "avast!" = avast! Antivirus "COMODO Internet Security" = COMODO Internet Security "Działania Macierzowe_is1" = Działania Macierzowe v1.1.0 "Gadu-Gadu" = Gadu-Gadu 7.1 "Glary Utilities_is1" = Glary Utilities 2.11.0.638 "InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center "InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder "InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition "InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher "InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package "IrfanView" = IrfanView (remove only) "jv16 PowerTools_is1" = jv16 PowerTools 1.3 "KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.5.3 "mIRC" = mIRC "Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11) "Picasa 3" = Picasa 3 "Revo Uninstaller" = Revo Uninstaller 1.83 "SynTPDeinstKey" = Synaptics Pointing Device Driver "TOSHIBA Software Modem" = TOSHIBA Software Modem "Totalcmd" = Total Commander (Remove or Repair) "uTorrent" = µTorrent "Wielki słownik angielsko-polski i polsko-angielski PWN-OXFORD" = Wielki słownik angielsko-polski i polsko-angielski PWN-OXFORD "Windows Media Encoder 9" = Windows Media Encoder 9 Series "WinRAR archiver" = Archiwizator WinRAR [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2009-07-07 18:40:20 Source = WinMgmt | ID = 10 Description = Error - 2009-07-07 18:41:10 || Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd gg.exe, wersja 7.1.0.6, sygnatura czasowa 0x43f5c9bd, moduł powodujący błąd gg.exe, wersja 7.1.0.6, sygnatura czasowa 0x43f5c9bd, kod wyjątku 0xc0000005, przesunięcie błędu 0x000a7c0c, identyfikator procesu 0xa8, godzina rozpoczęcia aplikacji 0x01c9ff5406303480. Error - 2009-07-07 18:42:27 || Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd gg.exe, wersja 7.1.0.6, sygnatura czasowa 0x43f5c9bd, moduł powodujący błąd gg.exe, wersja 7.1.0.6, sygnatura czasowa 0x43f5c9bd, kod wyjątku 0xc0000005, przesunięcie błędu 0x000a7c0c, identyfikator procesu 0x13bc, godzina rozpoczęcia aplikacji 0x01c9ff5433d89710. Error - 2009-07-07 18:43:28 || Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd gg.exe, wersja 7.1.0.6, sygnatura czasowa 0x43f5c9bd, moduł powodujący błąd gg.exe, wersja 7.1.0.6, sygnatura czasowa 0x43f5c9bd, kod wyjątku 0xc0000005, przesunięcie błędu 0x000a7c0c, identyfikator procesu 0x159c, godzina rozpoczęcia aplikacji 0x01c9ff545871bb10. Error - 2009-07-07 18:51:47 || Source = WinMgmt | ID = 10 Description = Error - 2009-07-08 05:16:53 || Source = WinMgmt | ID = 10 Description = Error - 2009-07-08 05:25:04 || Source = EventSystem | ID = 4621 Description = Error - 2009-07-08 05:27:36 || Source = WinMgmt | ID = 10 Description = Error - 2009-07-09 03:01:14 || Source = WinMgmt | ID = 10 Description = Error - 2009-07-09 11:42:18 || Source = WinMgmt | ID = 10 Description = [ System Events ] Error - 2010-02-21 17:32:45 || Source = cdrom | ID = 262151 Description = W urządzeniu \Device\CdRom0 wystąpił zły blok. Error - 2010-02-21 18:41:25 || Source = DCOM | ID = 10010 Description = Error - 2010-02-22 02:18:24 || Source = HTTP | ID = 15016 Description = Error - 2010-02-22 02:19:10 || Source = Service Control Manager | ID = 7000 Description = Error - 2010-02-22 10:08:33 || Source = DCOM | ID = 10010 Description = Error - 2010-02-22 10:30:16 || Source = HTTP | ID = 15016 Description = Error - 2010-02-22 10:31:33 || Source = Service Control Manager | ID = 7000 Description = Error - 2010-02-22 14:35:59 || Source = EventLog | ID = 6008 Description = Poprzednie zamknięcie systemu przy 19:34:59 na 2010-02-22 było nieoczekiwane. Error - 2010-02-22 14:36:09 || Source = HTTP | ID = 15016 Description = Error - 2010-02-22 14:37:27 || Source = Service Control Manager | ID = 7000 Description = < End of report >

**Posty:** 2183 · przez **NieWiem** 23 Lut 2010, 09:32

No ja tu nic nie widzę.

**Posty:** 52 · przez **Jean** 23 Lut 2010, 19:54

No dobra xd Dzięki za fatygę ;] A jeszcze jedno, co zrobić z dwoma plikami, które Dr Web uznał je za zainfekowane? Zostawić je w spokoju bądź usunąć je ręcznie?

**Posty:** 2183 · przez **NieWiem** 23 Lut 2010, 20:33

Wrzuć je na www.virscan.org i pokaż wyniki.

**Posty:** 52 · przez **Jean** 23 Lut 2010, 22:15

Oż...Pierwszy plik jest czysty, ale ten drugi...wyniki poniżej ^^"

Kod: Zaznacz wszystko: VirSCAN.org Scanned Report : Scanned time : 2010/02/23 21:07:45 (CET) Scanner results: 47% skanerów(1736) znalazło szkodliwe oprogramowanie! File Name : jar_cache4809410999693662651.tmp File Size : 5017 byte File Type : Zip archive data, at least v2.0 to extract MD5 : 8d0fc1e46e887a2f5ad8e08497430b2a SHA1 : 7df2204a8b8f0bc8f1df690d00c3ee1df5006cb1 Online report : http://virscan.org/report/cc73a5ffe07b824eec54055536cab699.html Scanner Engine Ver Sig Ver Sig Date Time Scan result a-squared 4.5.0.8 20100223200420 2010-02-23 6.60 Exploit.Java.CVE-2008-5353!IK AhnLab V3 2010.02.23.01 2010.02.23 2010-02-23 1.43 - AntiVir 8.2.1.172 7.10.4.134 2010-02-23 0.33 - Antiy 2.0.18 20100219.3860160 2010-02-19 0.27 Trojan/Java.OpenStream.af[Downloader] Arcavir 2009 201002231635 2010-02-23 0.02 - Authentium 5.1.1 201002231423 2010-02-23 1.25 - AVAST! 4.7.4 100223-1 2010-02-23 0.00 - AVG 8.5.720 271.1.1/2705 2010-02-23 0.23 - BitDefender 7.81008.5306468 7.30514 2010-02-24 5.36 Exploit.Java.CVE.5353.A ClamAV 0.95.3 10436 2010-02-23 0.01 Exploit.JS-7 Comodo 3.13.579 4038 2010-02-23 0.89 VirTool.Win32.Exploit.CVE-2008-5353.~A CP Secure 1.3.0.5 2010.02.24 2010-02-24 0.01 Troj.Exploit.Java.ByteVerify Dr.Web 5.0.1.12222 2010.02.24 2010-02-24 5.52 Exploit.CVE2008.5353 F-Prot 4.4.4.56 20100223 2010-02-23 1.26 - F-Secure 7.02.73807 2010.02.23.09 2010-02-23 9.99 Exploit:Java/OpenStream.B [FSE] Fortinet 11.523- 11.523 2010-02-23 0.19 - GData 19.10662/19.773 20100223 2010-02-23 6.20 Trojan-Downloader.Java.OpenStream.af [Engine:A] ViRobot 20100223 2010.02.23 2010-02-23 0.41 - Ikarus T3.1.01.80 2010.02.23.75265 2010-02-23 4.67 Exploit.Java.CVE-2008-5353 JiangMin 13.0.900 2010.02.23 2010-02-23 4.80 - Kaspersky 5.5.10 2010.02.23 2010-02-23 0.04 Trojan-Downloader.Java.OpenStream.af KingSoft 2009.2.5.15 2010.2.23.19 2010-02-23 0.57 - McAfee 5.3.00 5901 2010-02-23 3.74 Exploit-ByteVerify Microsoft 1.5406 2010.02.23 2010-02-23 6.94 Exploit:Java/CVE-2008-5353.C Norman 6.01.09 6.01.00 2010-02-10 4.01 JS/ByteVerify.D Panda 9.05.01 2010.02.23 2010-02-23 1.76 - Trend Micro 9.120-1004 6.870.11 2010-02-23 0.02 JAVA_BYTEVER.AT Quick Heal 10.00 2010.02.23 2010-02-23 1.35 - Rising 20.0 22.34.01.03 2010-02-09 0.33 - Sophos 3.04.1 4.50 2010-02-24 3.42 Troj/ByteVer-H Sunbelt 3.9.2405.2 5694 2010-02-22 2.89 - Symantec 1.3.0.24 20100221.004 2010-02-21 0.00 - nProtect 20100221.01 7495680 2010-02-21 4.43 Exploit.Java.CVE.5353.A The Hacker 6.5.1.6 v00206 2010-02-23 0.37 - VBA32 3.12.12.2 20100222.2233 2010-02-22 2.56 - VirusBuster 4.5.11.10 10.119.69/2016005 2010-02-23 2.45 -

**Posty:** 18165 · przez **wojtas** 23 Lut 2010, 22:21

skasuj

Kto jest na forum