Hardcorowa infekcja windowsa visty

[Dosfaq]

Tak jak w temacie, mojej dziewczynie skończyła się licencja na Pande Antyvirus Pro 2010 i nagle komputer zaczął wariować, wyskakujące okienka w przeglądarce, strasznie zamulony procek + blue screnny.
Komputer to jakiś nowy lapek od Asusa, pracuje na Windows Vista 32 bit. Jedyne czym udało mi się go w miarę opanować to Microsoft Essentials 2, Spybot Search and Destroy i darmowe AVG 2010.
Tutaj procesy zamulające :
http://zapodaj.net/8e66bb6759b9.jpg.html

A tutaj skan z OTL'a :
http://www.wklej.org/id/554815/

Tutaj Extras.txt z OTL'a :
http://www.wklej.org/id/554820/

A Tutaj skan z Gmera który wyszedł dopiero za drugim razem bo przerwał go blue screen :sciana: :
http://www.wklej.org/id/554822/

Mam nadzieję że jesteś w stanie mi pomóc, liczę na to. Tym bardziej że to komputer mojej nowej dziewczyny na którym ma kupe zdjęć ( jest fotografem ) na których jej zależy, więc format nie wchodzi w gre ; c
Liczę na was Chłopaki

[wojtas]

po pierwsze odinstaluj wszystkie antywirusy jakie masz,

po drugie możesz odinstalować Spybot Search and Destroy , słabo aktualizowany , jest wiele lepszych skanerów...

po trzecie odinstaluj : Winamp Toolbar


zrób pełny skan Kaspersky Virus Removal Tool jeśli coś znajdzie daj raport na forum

wykonaj skan: Kaspersky TDSSKiller, jeśli coś znajdzie dajesz Skip

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
DRV - File not found [Kernel | On_Demand | Running] -- -- (PavTPK.sys)
DRV - File not found [Kernel | On_Demand | Running] -- -- (PavSRK.sys)
DRV - File not found [File_System | On_Demand | Running] -- -- (AvFlt)FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..keyword.URL: "http://search.avg.com/?d=4e0370c5&i=23&tp=ab&nt=1&q="
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
O3 - HKU\S-1-5-21-2544762179-3010288273-4227847216-1000\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [DisableS3S4] File not found
O4 - HKU\S-1-5-21-2544762179-3010288273-4227847216-1000..\Run: [EA Core] File not found
O4 - HKU\S-1-5-21-2544762179-3010288273-4227847216-1000..\Run: [Vlsksf] File not found
O33 - MountPoints2\{06b0417d-279c-11df-b8f5-002618974bd1}\Shell - "" = AutoRun
O33 - MountPoints2\{06b0417d-279c-11df-b8f5-002618974bd1}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Play.exe
O33 - MountPoints2\{1bed7c67-7158-11e0-9fc1-002618974bd1}\Shell - "" = AutoRun
O33 - MountPoints2\{1bed7c67-7158-11e0-9fc1-002618974bd1}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\{7d0ecefd-40cd-11df-b52e-002618974bd1}\Shell\AutoRun\command - "" = F:\SPRZICE//tisve.exe
O33 - MountPoints2\{7d0ecefd-40cd-11df-b52e-002618974bd1}\Shell\open\command - "" = F:\SPRZICE//tisve.exe
O33 - MountPoints2\{b7a3a61a-1a52-11df-bdc0-002618974bd1}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe
[2011-06-23 19:00:23 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Roaming\AVG10
[2011-06-23 18:55:33 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10


:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

daj nowy log , i napisz jaka obecnie sytuacja z kompem po czynnościach

[Dosfaq]

I nie mogę do końca usunąć Pandy pro 11 której licencja się skończyła i po próbie odinstalowania za nic nie da się zrobić z tym shitem. Próbowałem Dodaj Usuń i nic, co start systemu Panda wyłącza jakieś swoje procesy które przestają działać.
Wrzucam ten Twój log do OTL a on się ścina i nie działa, bynajmniej tak mi się wydaje bo nic sie nie dzieje a i piszę (brak odpowiedzi).
To chyba przez tą Pandę. Pomocy !

Tutaj raport z Kaspersky Virus Removal Tool

Automatyczne skanowanie: zakończono 18 min temu (zdarzeń: 10, obiektów: 521737, czas: 04:23:51)
2011-07-01 13:49:51 Zadanie zostało uruchomione
2011-07-01 14:17:03 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 14:18:22 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 14:59:56 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 15:00:10 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 17:31:38 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 17:31:53 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 17:48:44 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 17:48:47 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 18:13:42 Zadanie zostało zakończone

TDSSKiller nic nie wykrył.

Co dalej Stary ?

[wojtas]

daj nowego loga z OTL

[Okocza]

Próbowałem Dodaj Usuń i nic

Spróbuj usunąć ręcznie z dysku wszystko co jest Pandy a potem w np ccleanerze uruchom skaner rejestru.

[Dosfaq]

Poradziłem sobie Uninstallatorem Pandy 2010 i puściłem OTL'a ze skryptem Wojtasa, OTL wykonał go, zaakceptowałem Reboot i śle to co mi wyskoczyło po reboocie :

Kod: Zaznacz wszystko

All processes killed
========== OTL ==========
Error: Unable to stop service PavTPK.sys!
Service\Driver key PavTPK.sys not found.
Error: Unable to stop service PavSRK.sys!
Service\Driver key PavSRK.sys not found.
Error: Unable to stop service AvFlt!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvFlt deleted successfully.
Prefs.js: "AVG Secure Search" removed from browser.search.selectedEngine
Prefs.js: "http://search.avg.com/?d=4e0370c5&i=23&tp=ab&nt=1&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}\ not found.
Registry value HKEY_USERS\S-1-5-21-2544762179-3010288273-4227847216-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DisableS3S4 deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2544762179-3010288273-4227847216-1000\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2544762179-3010288273-4227847216-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Vlsksf deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06b0417d-279c-11df-b8f5-002618974bd1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06b0417d-279c-11df-b8f5-002618974bd1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{06b0417d-279c-11df-b8f5-002618974bd1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06b0417d-279c-11df-b8f5-002618974bd1}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Play.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1bed7c67-7158-11e0-9fc1-002618974bd1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1bed7c67-7158-11e0-9fc1-002618974bd1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1bed7c67-7158-11e0-9fc1-002618974bd1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1bed7c67-7158-11e0-9fc1-002618974bd1}\ not found.
File I:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d0ecefd-40cd-11df-b52e-002618974bd1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d0ecefd-40cd-11df-b52e-002618974bd1}\ not found.
File F:\SPRZICE//tisve.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d0ecefd-40cd-11df-b52e-002618974bd1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d0ecefd-40cd-11df-b52e-002618974bd1}\ not found.
File F:\SPRZICE//tisve.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b7a3a61a-1a52-11df-bdc0-002618974bd1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b7a3a61a-1a52-11df-bdc0-002618974bd1}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe not found.
C:\Users\Angela\AppData\Roaming\AVG10\cfgall folder moved successfully.
C:\Users\Angela\AppData\Roaming\AVG10 folder moved successfully.
C:\ProgramData\AVG10\Temp folder moved successfully.
C:\ProgramData\AVG10\scanlogs folder moved successfully.
C:\ProgramData\AVG10\log\IDP\log folder moved successfully.
C:\ProgramData\AVG10\log\IDP folder moved successfully.
C:\ProgramData\AVG10\log folder moved successfully.
C:\ProgramData\AVG10\cfgall folder moved successfully.
C:\ProgramData\AVG10\Cfg folder moved successfully.
C:\ProgramData\AVG10 folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Angela
->Temp folder emptied: 73712178 bytes
->Temporary Internet Files folder emptied: 564951174 bytes
->Java cache emptied: 19223841 bytes
->FireFox cache emptied: 93052286 bytes
->Google Chrome cache emptied: 364455221 bytes
->Flash cache emptied: 184669 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: Default User

User: Gość
->Temp folder emptied: 5602904 bytes
->Temporary Internet Files folder emptied: 135659062 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3937096 bytes
->Flash cache emptied: 3937 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2004400 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1 204,00 mb


[EMPTYFLASH]

User: All Users

User: Angela
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User

User: Gość
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.24.2 log created on 07012011_183640

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Tak wyglądają procesy : http://zapodaj.net/967224ea6dd6.jpg.html

Tutaj nowy skan z OTL'a :

Kod: Zaznacz wszystko

OTL logfile created on: 2011-07-03 15:04:53 - Run 3
OTL by OldTimer - Version 3.2.24.2     Folder = C:\Users\Angela\Desktop\biatch
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

3,00 Gb Total Physical Memory | 1,71 Gb Available Physical Memory | 57,04% Memory free
6,19 Gb Paging File | 4,99 Gb Available in Paging File | 80,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 62,02 Gb Free Space | 41,62% Space Free | Partition Type: NTFS
Drive D: | 137,33 Gb Total Space | 131,78 Gb Free Space | 95,96% Space Free | Partition Type: NTFS

Computer Name: ANGELA-PC | User Name: Angela | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2011-06-29 16:03:41 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\biatch\OTL.exe
PRC - [2010-01-14 00:44:52 | 000,037,888 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winampa.exe
PRC - [2009-10-01 14:55:56 | 000,330,256 | ---- | M] (Kaspersky Lab) -- C:\Users\Angela\Desktop\Virus Removal Tool\setup_9.0.0.722_01.07.2011_15-08\setup_9.0.0.722_01.07.2011_15-08.exe
PRC - [2009-04-11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009-04-07 19:04:36 | 000,070,880 | ---- | M] (SRS Labs, Inc.) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe
PRC - [2009-04-07 19:02:10 | 003,405,048 | ---- | M] (SRS Labs, Inc.) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe
PRC - [2009-04-07 18:34:26 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe
PRC - [2009-04-02 20:49:12 | 000,211,512 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe
PRC - [2009-03-21 05:37:18 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exe
PRC - [2009-03-04 19:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
PRC - [2009-02-07 01:13:16 | 001,593,344 | ---- | M] () -- C:\Program Files\ASUS\Wireless Console 3\wcourier.exe
PRC - [2008-12-23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\WDC.exe
PRC - [2008-12-10 00:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
PRC - [2008-10-01 08:02:48 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe
PRC - [2008-08-18 20:27:32 | 000,117,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
PRC - [2008-08-18 19:56:22 | 000,098,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
PRC - [2008-08-14 06:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe
PRC - [2008-08-14 05:59:52 | 000,100,920 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe
PRC - [2008-08-14 01:21:56 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
PRC - [2008-04-01 08:09:30 | 000,266,240 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
PRC - [2008-03-31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
PRC - [2008-01-21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007-11-30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe
PRC - [2007-08-08 09:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe
PRC - [2005-07-07 00:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe


[color=#E56717]========== Modules (SafeList) ==========[/color]

MOD - [2011-06-29 16:03:41 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\biatch\OTL.exe
MOD - [2010-08-31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-04-07 19:04:36 | 000,070,880 | ---- | M] (SRS Labs, Inc.) [Auto | Running] -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe -- (SRS_VolSync_Service)
SRV - [2008-08-14 05:59:52 | 000,100,920 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)
SRV - [2008-03-31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
SRV - [2008-01-21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007-08-08 09:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2011-06-29 16:06:38 | 000,135,032 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\system32\drivers\dwprot.sys -- (DwProt)
DRV - [2009-10-22 13:54:18 | 000,037,392 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\02192042.sys -- (02192042)
DRV - [2009-10-09 23:31:02 | 000,311,312 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\0219204.sys -- (setup_9.0.0.722_01.07.2011_15-08drv)
DRV - [2009-09-25 17:59:42 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\System32\drivers\02192041.sys -- (02192041)
DRV - [2009-07-31 23:00:14 | 000,030,264 | ---- | M] (ASUSTek Computer Inc) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm)
DRV - [2009-04-15 06:01:49 | 009,561,472 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009-04-01 23:12:48 | 000,233,128 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys -- (SRS_PremiumSound_Service)
DRV - [2009-02-18 05:01:34 | 001,093,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008-11-27 13:16:47 | 000,135,680 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008-11-13 03:02:17 | 000,146,464 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2008-11-03 09:03:27 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2008-08-25 12:22:51 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008-08-11 04:14:11 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008-04-07 08:00:45 | 000,006,656 | ---- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CRFILTER.sys -- (CRFILTER)
DRV - [2007-07-24 20:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2006-12-14 09:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006-11-02 09:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.startup.homepage: "http://www.astrona.pl/"
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.2.0185
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..keyword.enabled: true

FF - HKLM\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF

[2010-04-07 16:50:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Extensions
[2011-06-29 16:36:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Firefox\Profiles\g10eoe69.default\extensions
[2010-04-07 17:01:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Angela\AppData\Roaming\mozilla\Firefox\Profiles\g10eoe69.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010-05-04 14:22:13 | 000,002,059 | ---- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\g10eoe69.default\searchplugins\daemon-search.xml
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
File not found (No name found) -- C:\USERS\ANGELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G10EOE69.DEFAULT\EXTENSIONS\DTTOOLBAR@TOOLBARNET.COM

O1 HOSTS File: ([2006-09-18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Users\Angela\AppData\Roaming\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)
O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files\ASUS\Wireless Console 3\wcourier.exe ()
O4 - HKCU..\Run: [SRS Premium Sound] C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe (SRS Labs, Inc.)
O4 - Startup: C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_01.07.2011_15-08.lnk = C:\Users\Angela\Desktop\Virus Removal Tool\setup_9.0.0.722_01.07.2011_15-08\startup.exe ()
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Funkcja Google Sidewiki - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.211.0.18 195.211.0.19
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Angela\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg
O24 - Desktop BackupWallPaper: C:\Users\Angela\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2011-07-03 14:53:50 | 000,000,000 | ---D | C] -- C:\SMCLpav
[2011-07-03 14:24:19 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011-07-01 18:33:35 | 000,000,000 | ---D | C] -- C:\_OTL
[2011-07-01 13:49:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2011-07-01 13:48:14 | 000,311,312 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\0219204.sys
[2011-07-01 13:48:14 | 000,128,016 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\02192041.sys
[2011-07-01 13:48:14 | 000,037,392 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\02192042.sys
[2011-07-01 13:48:14 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\Virus Removal Tool
[2011-06-29 16:42:13 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011-06-29 16:28:01 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\biatch
[2011-06-27 15:33:14 | 000,000,000 | -H-D | C] -- C:\$AVG
[2011-06-23 18:58:29 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011-06-23 18:53:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2011-06-23 18:49:54 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011-06-22 16:32:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011-06-22 16:04:19 | 000,221,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2011-06-18 17:18:19 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2011-06-18 16:58:51 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011-06-18 16:58:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011-06-18 16:29:03 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2011-06-18 16:29:03 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2011-06-18 16:28:38 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011-06-18 16:26:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011-06-18 16:26:11 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011-06-18 16:26:10 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011-06-18 16:26:10 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011-06-18 16:26:10 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011-06-18 16:26:10 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011-06-18 16:26:10 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011-06-18 16:26:10 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011-06-18 16:26:10 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011-06-18 16:26:10 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011-06-18 16:26:10 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011-06-18 16:26:10 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011-06-18 16:26:10 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011-06-18 16:26:10 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011-06-18 16:26:10 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011-06-18 16:26:10 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011-06-18 16:26:10 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011-06-18 16:19:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011-06-18 16:19:05 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011-06-18 16:19:05 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011-06-18 16:19:05 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2008-11-03 09:03:27 | 000,013,880 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2011-07-03 15:08:14 | 002,097,152 | -HS- | M] () -- C:\Users\Angela\ntuser.dat
[2011-07-03 15:01:16 | 000,064,926 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011-07-03 14:59:36 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2011-07-03 14:59:32 | 000,064,926 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011-07-03 14:59:31 | 000,001,032 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011-07-03 14:59:17 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011-07-03 14:59:17 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011-07-03 14:59:13 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2011-07-03 14:59:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-07-03 14:59:03 | 3220,340,736 | -HS- | M] () -- C:\hiberfil.sys
[2011-07-03 14:58:32 | 000,524,288 | -HS- | M] () -- C:\Users\Angela\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2011-07-03 14:58:32 | 000,065,536 | -HS- | M] () -- C:\Users\Angela\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2011-07-03 14:54:33 | 003,573,962 | -H-- | M] () -- C:\Users\Angela\AppData\Local\IconCache.db
[2011-07-03 14:36:00 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011-07-03 14:26:55 | 000,064,600 | ---- | M] () -- C:\Users\Angela\Documents\cc_20110703_142642.reg
[2011-07-03 14:24:20 | 000,000,811 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011-07-03 14:15:00 | 000,001,062 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2544762179-3010288273-4227847216-1000UA.job
[2011-07-02 16:46:22 | 000,001,010 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2544762179-3010288273-4227847216-1000Core.job
[2011-07-02 16:41:57 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B4835840-B23D-4579-9BC4-3D3977C2BDE5}.job
[2011-07-02 09:38:28 | 000,001,356 | ---- | M] () -- C:\Users\Angela\AppData\Local\d3d9caps.dat
[2011-07-01 13:49:25 | 000,002,207 | ---- | M] () -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_01.07.2011_15-08.lnk
[2011-07-01 13:47:07 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011-07-01 13:46:50 | 000,672,140 | ---- | M] () -- C:\Windows\System32\perfh015.dat
[2011-07-01 13:46:50 | 000,130,516 | ---- | M] () -- C:\Windows\System32\perfc015.dat
[2011-07-01 13:46:49 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011-07-01 13:46:49 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011-06-29 17:05:37 | 000,374,040 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011-06-29 16:06:38 | 000,135,032 | ---- | M] () -- C:\Windows\System32\drivers\dwprot.sys
[2011-06-29 13:16:21 | 000,002,094 | ---- | M] () -- C:\Users\Angela\Desktop\Google Chrome.lnk
[2011-06-23 20:10:03 | 000,001,894 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011-06-22 16:05:55 | 001,523,260 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2011-06-19 23:38:23 | 000,099,853 | ---- | M] () -- C:\Users\Angela\Desktop\image201106190002.jpg
[2011-06-18 22:44:44 | 000,524,288 | -HS- | M] () -- C:\Users\Angela\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2011-06-18 17:18:56 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011-06-15 20:36:48 | 000,006,008 | ---- | M] () -- C:\ProgramData\bc87

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2011-07-03 14:26:46 | 000,064,600 | ---- | C] () -- C:\Users\Angela\Documents\cc_20110703_142642.reg
[2011-07-03 14:24:20 | 000,000,811 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011-07-01 13:49:25 | 000,002,207 | ---- | C] () -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup_9.0.0.722_01.07.2011_15-08.lnk
[2011-06-29 16:06:38 | 000,135,032 | ---- | C] () -- C:\Windows\System32\drivers\dwprot.sys
[2011-06-29 10:35:36 | 3220,340,736 | -HS- | C] () -- C:\hiberfil.sys
[2011-06-22 16:06:21 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011-06-19 23:38:52 | 000,099,853 | ---- | C] () -- C:\Users\Angela\Desktop\image201106190002.jpg
[2011-06-18 18:02:27 | 003,573,962 | -H-- | C] () -- C:\Users\Angela\AppData\Local\IconCache.db
[2011-06-15 20:36:48 | 000,006,008 | ---- | C] () -- C:\ProgramData\bc87
[2010-04-04 22:00:48 | 000,001,356 | ---- | C] () -- C:\Users\Angela\AppData\Local\d3d9caps.dat
[2010-01-26 16:25:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009-12-30 11:17:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009-12-30 11:17:00 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009-12-30 11:16:30 | 000,368,640 | ---- | C] () -- C:\Windows\System32\msjetoledb40.dll
[2009-12-29 17:07:57 | 000,018,944 | ---- | C] () -- C:\Users\Angela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-12-29 16:48:04 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009-12-29 15:07:35 | 000,100,432 | ---- | C] () -- C:\Users\Angela\AppData\Local\GDIPFONTCACHEV1.DAT
[2009-12-29 15:07:31 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2009-07-31 23:00:44 | 000,233,128 | ---- | C] () -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys
[2009-07-31 23:00:10 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe
[2009-07-31 22:53:03 | 000,064,926 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009-07-31 22:52:48 | 000,064,926 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009-07-31 22:49:14 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2009-07-31 22:39:26 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008-08-11 04:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008-05-12 05:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008-04-18 02:01:53 | 000,672,140 | ---- | C] () -- C:\Windows\System32\perfh015.dat
[2008-04-18 02:01:53 | 000,332,832 | ---- | C] () -- C:\Windows\System32\perfi015.dat
[2008-04-18 02:01:53 | 000,130,516 | ---- | C] () -- C:\Windows\System32\perfc015.dat
[2008-04-18 02:01:53 | 000,037,468 | ---- | C] () -- C:\Windows\System32\perfd015.dat
[2008-04-18 01:45:31 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2008-04-07 08:00:45 | 000,005,120 | ---- | C] () -- C:\Windows\System32\CRFILTER.dll
[2008-01-21 04:24:38 | 000,060,124 | ---- | C] () -- C:\Windows\System32\tcpmon.ini
[2006-11-02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006-11-02 14:47:37 | 000,374,040 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006-11-02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006-11-02 12:33:01 | 001,523,260 | ---- | C] () -- C:\Windows\System32\PerfStringBackup.INI
[2006-11-02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006-11-02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006-11-02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006-11-02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006-11-02 12:24:31 | 000,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini
[2006-11-02 12:23:31 | 000,000,276 | ---- | C] () -- C:\Windows\win.ini
[2006-11-02 12:23:31 | 000,000,219 | ---- | C] () -- C:\Windows\system.ini
[2006-11-02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006-11-02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006-11-02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006-11-02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006-11-02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006-11-02 09:10:37 | 000,053,536 | ---- | C] () -- C:\Windows\System32\dosx.exe
[2006-11-02 09:10:02 | 000,000,718 | ---- | C] () -- C:\Windows\System32\mscdexnt.exe
[2006-11-02 09:10:00 | 000,002,842 | ---- | C] () -- C:\Windows\System32\redir.exe
[2006-11-02 09:09:59 | 000,069,886 | ---- | C] () -- C:\Windows\System32\edit.com
[2006-11-02 09:09:59 | 000,019,694 | ---- | C] () -- C:\Windows\System32\GRAPHICS.COM
[2006-11-02 09:09:59 | 000,000,882 | ---- | C] () -- C:\Windows\System32\share.exe
[2006-11-02 09:09:59 | 000,000,882 | ---- | C] () -- C:\Windows\System32\fastopen.exe
[2006-11-02 09:09:57 | 000,014,710 | ---- | C] () -- C:\Windows\System32\KB16.COM
[2006-11-02 09:09:56 | 000,007,052 | ---- | C] () -- C:\Windows\System32\nlsfunc.exe
[2006-11-02 09:09:55 | 000,039,274 | ---- | C] () -- C:\Windows\System32\mem.exe
[2006-11-02 09:09:55 | 000,001,131 | ---- | C] () -- C:\Windows\System32\LOADFIX.COM
[2006-11-02 09:09:53 | 000,011,753 | ---- | C] () -- C:\Windows\System32\setver.exe
[2006-11-02 09:09:52 | 000,020,634 | ---- | C] () -- C:\Windows\System32\debug.exe
[2006-11-02 09:09:51 | 000,008,424 | ---- | C] () -- C:\Windows\System32\exe2bin.exe
[2006-11-02 09:09:50 | 000,012,642 | ---- | C] () -- C:\Windows\System32\edlin.exe
[2006-11-02 09:09:49 | 000,050,648 | ---- | C] () -- C:\Windows\System32\COMMAND.COM
[2006-11-02 09:09:49 | 000,012,498 | ---- | C] () -- C:\Windows\System32\append.exe
[2006-11-02 09:09:45 | 000,027,097 | ---- | C] () -- C:\Windows\System32\country.sys
[2006-11-02 09:09:44 | 000,042,809 | ---- | C] () -- C:\Windows\System32\KEY01.SYS
[2006-11-02 09:09:44 | 000,042,537 | ---- | C] () -- C:\Windows\System32\KEYBOARD.SYS
[2006-11-02 09:09:42 | 000,009,029 | ---- | C] () -- C:\Windows\System32\ANSI.SYS
[2006-11-02 09:09:41 | 000,004,768 | ---- | C] () -- C:\Windows\System32\HIMEM.SYS
[2006-11-02 09:09:40 | 000,029,274 | ---- | C] () -- C:\Windows\System32\NTDOS412.SYS
[2006-11-02 09:09:38 | 000,029,370 | ---- | C] () -- C:\Windows\System32\NTDOS411.SYS
[2006-11-02 09:09:35 | 000,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS404.SYS
[2006-11-02 09:09:31 | 000,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS804.SYS
[2006-11-02 09:09:29 | 000,027,866 | ---- | C] () -- C:\Windows\System32\NTDOS.SYS
[2006-11-02 09:09:26 | 000,035,536 | ---- | C] () -- C:\Windows\System32\NTIO412.SYS
[2006-11-02 09:09:24 | 000,035,776 | ---- | C] () -- C:\Windows\System32\NTIO411.SYS
[2006-11-02 09:09:23 | 000,034,672 | ---- | C] () -- C:\Windows\System32\NTIO404.SYS
[2006-11-02 09:09:22 | 000,034,672 | ---- | C] () -- C:\Windows\System32\NTIO804.SYS
[2006-11-02 09:09:20 | 000,033,952 | ---- | C] () -- C:\Windows\System32\NTIO.SYS
[2006-11-02 08:25:08 | 000,013,312 | ---- | C] () -- C:\Windows\System32\win87em.dll

[color=#E56717]========== LOP Check ==========[/color]

[2011-07-03 14:25:33 | 000,000,000 | ---D | M] -- C:\Users\Angela\AppData\Roaming\DAEMON Tools Lite
[2010-01-01 19:09:27 | 000,000,000 | ---D | M] -- C:\Users\Angela\AppData\Roaming\Gadu-Gadu 10
[2010-11-03 21:41:16 | 000,000,000 | ---D | M] -- C:\Users\Angela\AppData\Roaming\Nowe Gadu-Gadu
[2010-03-26 15:45:41 | 000,000,000 | ---D | M] -- C:\Users\Angela\AppData\Roaming\OpenFM
[2011-05-04 12:25:22 | 000,000,000 | ---D | M] -- C:\Users\Angela\AppData\Roaming\Panda Security
[2011-07-03 14:58:29 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011-07-02 16:41:57 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{B4835840-B23D-4579-9BC4-3D3977C2BDE5}.job

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 64 bytes -> C:\Users\Angela\Documents\Przerwana lekcja muzyki .avi:TOC.WMV
@Alternate Data Stream - 597 bytes -> C:\Users\Angela\Desktop\wiadomosc.eml:OECustomProperty
@Alternate Data Stream - 1417 bytes -> C:\Users\Angela\wiadomosc.eml:OECustomProperty

< End of report >


Prócz tego Kaspersky Virus Removal 2010 zawiadamia mnie o infekcjach, zrobić coś z tym czy nie ruszać ?

[wojtas]

procesy w normie . czy to są wszystkie ? jakie wirusy widzi Kasper ?

[Dosfaq]

Dokładnie te same które podawałem wcześniej:

Automatyczne skanowanie: zakończono 18 min temu (zdarzeń: 10, obiektów: 521737, czas: 04:23:51)
2011-07-01 13:49:51 Zadanie zostało uruchomione
2011-07-01 14:17:03 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 14:18:22 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 14:59:56 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 15:00:10 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 17:31:38 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 17:31:53 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 17:48:44 Zagrożenie: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE
2011-07-01 17:48:47 Nieprzetworzony: Backdoor.Win32.Ruskill.iz C:\Users\Angela\Ustawienia lokalne\Microsoft\Windows\WER\ReportArchive\Report13ae3561\Report.cab/{88E527B8-8E5D-8488-0AA9-3192C348BC0F}-Pmsksz.exe/PE-Crypt.XorPE Zapis nie jest obsługiwany
2011-07-01 18:13:42 Zadanie zostało zakończone

Tak więc co zrobić z tymi wirami?

Przeskanowałem Dr.Web Cureit! i nic nie znalazł.
Mam też pytanie jaki jest najlepszy darmowy antyvir z antyspyware i etc. który mógłbym wrzucić na tego kompa.

[wojtas]

spróbuj wyleczyć te pliki jeśli jest taka opcja.

proponuje z darmowych : Avast 6 + Malwarebytes i od czasu do czasu skan Malwarebytes i będzie ok