Pasożyt win32:rootkit-gen [rtk] w programie avast

**Posty:** 31 · przez **motylek1570** 14 Sie 2010, 22:43

Witam

Podczas skanowania kompa Avast wykrył poasożyta Win32:Rootkit-gen [Rtk]. Nie mogę poddać go kwarantannie, wyskakuje okno: "serwer kwarantanny nie pracuje. Komunikacja RPC nie powiodła się." I jeszcze informaca o tym, że zainfekowanego pliku nie można przetworzyć. Nie bardzo wiem co mam z tym zrobić.. I jeszcze dodam, że jeśli znajdzie się ktoś, kto zechce mi pomóc, to będzie musiał wykazać się ogromną cierpliwością, bo ja jestem w tym temacie po prostu ciemna :oops:

**Posty:** 14516 · przez **ToServeAndProtect** 14 Sie 2010, 23:18

obowiazkowe-zasady-wstawiania-logow-wazne-vt117887.html
- wstaw odpowiednie 3 logi
- umieśc w tagach lub na www.wklej.org

**Posty:** 31 · przez **motylek1570** 15 Sie 2010, 13:52

już podaję:

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-08-15 13:33:57 Windows 5.1.2600 Dodatek Service Pack 2 Running: 8b3r53z2.exe; Driver: C:\DOCUME~1\ania\USTAWI~1\Temp\pwpoqfog.sys ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\system32\services.exe[616] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003C0002 IAT C:\WINDOWS\system32\services.exe[616] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003C0000 ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) ---- Files - GMER 1.0.15 ---- File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0000\adoc.bx-j 353 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0000\md.dat-j 8698 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0000\url.axx-j 1320 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0000\wb.vx-j 14267 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0001\adoc.bx-j 41 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0001\md.dat-j 42 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0001\url.axx-j 102 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0001\w.axx-j 102 bytes File C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Opera\Opera\vps\0001\wb.vx-j 41 bytes ---- EOF - GMER 1.0.15 ----

Dodano Dzisiaj, 13:53:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-08-15 13:38:20 - Run 2 OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\ania\Pulpit\OTL Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 114,00 Mb Available Physical Memory | 45,00% Memory free 806,00 Mb Paging File | 243,00 Mb Available in Paging File | 30,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 15,13 Gb Free Space | 77,46% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,08 Gb Free Space | 84,40% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 2,38 Gb Free Space | 8,62% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-08-15 12:55:05 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\ania\Pulpit\8b3r53z2.exe PRC - [2010-08-14 21:54:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\OTL\OTL.exe PRC - [2010-06-14 11:47:02 | 000,836,464 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-11-25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2006-11-21 19:38:22 | 000,035,328 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2006-10-27 15:23:04 | 000,347,432 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\WINWORD.EXE PRC - [2005-05-09 20:45:00 | 002,678,784 | ---- | M] () -- C:\Program Files\PLANET WL-8310\WLANPRO.exe PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\acs.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-08-15 11:56:55 | 000,077,312 | RHS- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Temp\dsoqq0.dll MOD - [2010-08-14 21:54:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\OTL\OTL.exe MOD - [2004-08-04 00:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-11-25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2009-11-25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-11-25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-11-25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2005-01-21 11:19:28 | 000,411,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2004-08-04 01:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2004-08-04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2004-08-04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2004-06-04 02:18:52 | 000,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-790525478-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2001-10-26 19:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [Cmaudio] File not found O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - HKU\S-1-5-21-790525478-1450960922-725345543-1003..\Run: [dso32] C:\Documents and Settings\ania\Ustawienia lokalne\Temp\dsoqq.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\PLANET WL-8310 Configuration Utility.lnk = C:\Program Files\PLANET WL-8310\WLANPRO.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reg.lnk = C:\Program Files\PLANET WL-8310\Reg.exe () O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004-06-04 01:36:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-08-15 13:38:21 | 000,000,057 | RHS- | M] () - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-08-15 13:38:21 | 000,000,057 | RHS- | M] () - D:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-08-15 13:38:21 | 000,000,057 | RHS- | M] () - E:\autorun.inf -- [ NTFS ] O33 - MountPoints2\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = F:\09lf.exe -- File not found O33 - MountPoints2\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = F:\09lf.exe -- File not found O33 - MountPoints2\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = G:\09lf.exe -- File not found O33 - MountPoints2\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = G:\09lf.exe -- File not found O33 - MountPoints2\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = H:\09lf.exe -- File not found O33 - MountPoints2\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = H:\09lf.exe -- File not found O33 - MountPoints2\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = I:\09lf.exe -- File not found O33 - MountPoints2\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = I:\09lf.exe -- File not found O33 - MountPoints2\{59c67e30-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = J:\09lf.exe -- File not found O33 - MountPoints2\{59c67e30-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = J:\09lf.exe -- File not found O33 - MountPoints2\{59c67e31-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = K:\09lf.exe -- File not found O33 - MountPoints2\{59c67e31-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = K:\09lf.exe -- File not found O33 - MountPoints2\{59c67e32-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = L:\09lf.exe -- File not found O33 - MountPoints2\{59c67e32-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = L:\09lf.exe -- File not found O33 - MountPoints2\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\Shell\AutoRun\command - "" = G:\i8ikdjwt.exe -- File not found O33 - MountPoints2\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\Shell\open\Command - "" = G:\i8ikdjwt.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-08-14 21:54:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\OTL [2010-08-08 16:47:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-08-08 16:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\Nowe Gadu-Gadu [2010-07-29 22:43:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-07-29 22:42:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun [2010-07-29 22:42:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010-07-29 22:42:12 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-29 22:42:12 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:12 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2010-07-29 22:36:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Sun [2010-07-22 22:07:07 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\ania\Pulpit\.picasaoriginals [2010-07-20 14:23:56 | 000,023,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spupdsvc.exe [2010-07-20 14:23:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Google [2010-07-20 14:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2010-07-20 14:17:36 | 012,387,832 | ---- | C] (Google Inc.) -- C:\Documents and Settings\ania\Pulpit\picasa36-setup.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-08-15 13:42:57 | 000,000,057 | RHS- | M] () -- C:\autorun.inf [2010-08-15 12:55:05 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\ania\Pulpit\8b3r53z2.exe [2010-08-15 11:57:42 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-08-15 11:56:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-08-15 11:56:03 | 267,964,416 | -HS- | M] () -- C:\hiberfil.sys [2010-08-14 23:08:51 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\ania\NTUSER.DAT [2010-08-14 23:08:51 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\ania\ntuser.ini [2010-08-14 23:08:30 | 005,852,812 | -H-- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-08-14 19:32:56 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-08-11 17:09:13 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010-08-09 14:54:27 | 000,000,369 | -H-- | M] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-08-08 16:47:01 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk [2010-08-01 12:33:10 | 000,000,468 | ---- | M] () -- C:\Documents and Settings\ania\Moje dokumenty\spider.sav [2010-07-29 22:42:02 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:02 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:42:01 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-20 14:24:32 | 000,000,527 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk [2010-07-20 14:22:06 | 012,387,832 | ---- | M] (Google Inc.) -- C:\Documents and Settings\ania\Pulpit\picasa36-setup.exe [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-08-15 12:55:00 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\ania\Pulpit\8b3r53z2.exe [2010-08-15 12:31:46 | 000,117,248 | RHS- | C] () -- C:\eyruu.exe [2010-08-08 16:47:01 | 000,000,688 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk [2010-07-22 22:30:18 | 000,000,369 | -H-- | C] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-07-20 14:24:32 | 000,000,527 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk [2004-10-12 07:40:58 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2004-10-12 07:39:48 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2004-10-12 07:39:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2004-10-09 07:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2004-10-05 09:16:08 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 00:44:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-06-04 02:18:49 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar52119x.sys [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar5211.sys [2004-06-04 02:18:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2004-06-04 02:00:53 | 000,000,736 | ---- | C] () -- C:\WINDOWS\setup.ini [2004-06-04 02:00:52 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2004-06-04 02:00:52 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2004-06-04 02:00:49 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2004-06-04 02:00:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2004-06-04 02:00:48 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [color=#E56717]========== LOP Check ==========[/color] [2004-06-04 02:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Panda Security [2010-08-08 16:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-06-24 18:31:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Opera [color=#E56717]========== Purity Check ==========[/color] < End of report >

Dodano Dzisiaj, 13:54:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-08-15 13:38:20 - Run 2 OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\ania\Pulpit\OTL Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 114,00 Mb Available Physical Memory | 45,00% Memory free 806,00 Mb Paging File | 243,00 Mb Available in Paging File | 30,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 15,13 Gb Free Space | 77,46% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,08 Gb Free Space | 84,40% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 2,38 Gb Free Space | 8,62% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = Opera.HTML] -- C:\Program Files\Opera\opera.exe (Opera Software) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0FE76E17-23F0-457C-9126-DE043402FE1F}" = Opera 10.60 "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12 "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007 "{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007 "{94E4FBD6-540C-4DB6-A469-B1FA248DA33E}" = PLANET WL-8310 "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ALLPlayer V3.0_is1" = ALLPlayer V3.X "avast!" = avast! Antivirus "C-Media Audio" = C-Media 3D Audio "ENTERPRISE" = Microsoft Office Enterprise 2007 "EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.00 "Foxit Reader" = Foxit Reader "IrfanView" = IrfanView (remove only) "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "NVIDIA Drivers" = NVIDIA Drivers "Picasa 3" = Picasa 3 "Winamp" = Winamp (remove only) "WinRAR archiver" = Archiwizator WinRAR "XP Codec Pack" = XP Codec Pack [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Antivirus Events ] Error - 2010-08-14 15:38:30 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 15:38:48 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 15:45:01 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:33:49 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:36:14 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:36:41 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:58:36 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 17:00:48 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. [ Application Events ] Error - 2010-07-29 16:47:44 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd flash.ocx, wersja 6.0.79.0, adres błędu 0x0001cfd3. Error - 2010-07-29 16:51:06 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd mshtml.dll, wersja 6.0.2900.2180, adres błędu 0x0007f463. [ System Events ] Error - 2010-08-13 16:03:27 | Computer Name = ANIU-E111050434 | Source = ipnathlp | ID = 32003 Description = Translator adresów sieciowych (NAT) nie może zażądać wykonania operacji przez moduł tłumaczący, pracujący w trybie jądra. Może to wskazywać na błąd konfiguracji, niewystarczające zasoby lub na błąd wewnętrzny. Dane zawierają kod błędu. Error - 2010-08-14 10:09:28 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Antivirus. Error - 2010-08-14 10:09:28 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Antivirus z powodu następującego błędu: %%1053 Error - 2010-08-14 13:09:00 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Antivirus. Error - 2010-08-14 13:09:00 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Antivirus z powodu następującego błędu: %%1053 Error - 2010-08-14 14:22:30 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Antivirus. Error - 2010-08-14 14:22:30 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Antivirus z powodu następującego błędu: %%1053 Error - 2010-08-15 05:59:36 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-15 05:59:36 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-15 06:02:10 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7034 Description = Usługa avast! Web Scanner niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. < End of report >

Dodano Dzisiaj, 13:57:
mam nadzieję, że nic nie pokręciłam.. tylko że wyłączyłam avasta i nie wiem, czy to nie problem?

**Posty:** 2183 · przez **NieWiem** 15 Sie 2010, 14:41

motylek1570, pobierz UsbFix
stąd albo stąd

Wybierz opcję [ Deletion ] i przeklej raport

**Posty:** 31 · przez **motylek1570** 15 Sie 2010, 19:05

pobrałam z pierwszego linka i avast znalazł w tym pliku trojana.. fajnie

**Posty:** 584 · przez **Andziorka** 15 Sie 2010, 19:25

bo antyrirus może widzieć to jak trojana, ale nie jest tak w rzeczywistości. pobierz to i wykonaj powyższą poradę

**Posty:** 31 · przez **motylek1570** 16 Sie 2010, 14:00

postaram się ale nie wiem czy cokolwiek z tego wyjdzie, bo od wczorajszego popołudnie mój komputer ledwo się włącza, tak strasznie muli, że otwarcie samej opery zajmuje prawie minutę... nie wiem co się dzieje

**Posty:** 18165 · przez **wojtas** 16 Sie 2010, 14:12

Uruchom OTL i w sekcji własne opcje skanowania / skrypt (Custom Scans/Fixes) wklej:

:OTL
O4 - HKLM..\Run: [Cmaudio] File not found
O4 - HKU\S-1-5-21-790525478-1450960922-725345543-1003..\Run: [dso32] C:\Documents and Settings\ania\Ustawienia lokalne\Temp\dsoqq.exe ()
O32 - AutoRun File - [2010-08-15 13:38:21 | 000,000,057 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-08-15 13:38:21 | 000,000,057 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-08-15 13:38:21 | 000,000,057 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = F:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = F:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = G:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = G:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = H:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = H:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = I:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = I:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e30-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = J:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e30-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = J:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e31-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = K:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e31-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = K:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e32-b5b9-11d8-bc63-806d6172696f}\Shell\AutoRun\command - "" = L:\09lf.exe -- File not found
O33 - MountPoints2\{59c67e32-b5b9-11d8-bc63-806d6172696f}\Shell\open\Command - "" = L:\09lf.exe -- File not found
O33 - MountPoints2\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\Shell\AutoRun\command - "" = G:\i8ikdjwt.exe -- File not found
O33 - MountPoints2\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\Shell\open\Command - "" = G:\i8ikdjwt.exe -- File not found

:Files
C:\Documents and Settings\ania\Ustawienia lokalne\Temp\dsoqq0.dll
autorun.inf /alldrives
eyruu.exe /alldrives

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt (Run Fix). I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia i Przy podpiętym urządzeniu przenośnym (pendrive itp) , uruchom USBFIX z opcji Listing i pokaż raport na forum.

**Posty:** 31 · przez **motylek1570** 16 Sie 2010, 14:48

Już mam:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-08-16 14:35:21 - Run 3 OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\ania\Pulpit\Nowy folder2 Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 123,00 Mb Available Physical Memory | 48,00% Memory free 618,00 Mb Paging File | 369,00 Mb Available in Paging File | 60,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 15,74 Gb Free Space | 80,59% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,12 Gb Free Space | 84,53% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 2,42 Gb Free Space | 8,74% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-08-16 13:54:30 | 002,752,560 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\Setup\avast.setup PRC - [2010-08-14 21:54:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe PRC - [2009-11-25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2006-11-21 19:38:22 | 000,035,328 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2005-05-09 20:45:00 | 002,678,784 | ---- | M] () -- C:\Program Files\PLANET WL-8310\WLANPRO.exe PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\acs.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-08-14 21:54:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe MOD - [2004-08-04 00:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-11-25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2009-11-25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-11-25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-11-25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2005-01-21 11:19:28 | 000,411,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2004-08-04 01:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2004-08-04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2004-08-04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2004-06-04 02:18:52 | 000,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-790525478-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2001-10-26 19:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\PLANET WL-8310 Configuration Utility.lnk = C:\Program Files\PLANET WL-8310\WLANPRO.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reg.lnk = C:\Program Files\PLANET WL-8310\Reg.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004-06-04 01:36:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-08-16 14:26:37 | 000,000,000 | ---D | C] -- C:\_OTL [2010-08-16 14:23:21 | 001,207,838 | ---- | C] (C_XX & El Desaparecido) -- C:\Documents and Settings\ania\Pulpit\UsbFix.exe [2010-08-14 21:54:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\Nowy folder2 [2010-08-08 16:47:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-08-08 16:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\Nowe Gadu-Gadu [2010-07-29 22:43:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-07-29 22:42:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun [2010-07-29 22:42:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010-07-29 22:42:12 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-29 22:42:12 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:12 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2010-07-29 22:36:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Sun [2010-07-22 22:07:07 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\ania\Pulpit\.picasaoriginals [2010-07-20 14:23:56 | 000,023,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spupdsvc.exe [2010-07-20 14:23:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Google [2010-07-20 14:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2010-07-20 14:17:36 | 012,387,832 | ---- | C] (Google Inc.) -- C:\Documents and Settings\ania\Pulpit\picasa36-setup.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-08-16 14:31:32 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-08-16 14:30:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-08-16 14:29:50 | 267,964,416 | -HS- | M] () -- C:\hiberfil.sys [2010-08-16 14:23:36 | 001,207,838 | ---- | M] (C_XX & El Desaparecido) -- C:\Documents and Settings\ania\Pulpit\UsbFix.exe [2010-08-15 19:43:17 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\ania\NTUSER.DAT [2010-08-15 19:43:17 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\ania\ntuser.ini [2010-08-14 23:08:30 | 005,852,812 | -H-- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-08-14 19:32:56 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-08-11 17:09:13 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010-08-09 14:54:27 | 000,000,369 | -H-- | M] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-08-08 16:47:01 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk [2010-08-01 12:33:10 | 000,000,468 | ---- | M] () -- C:\Documents and Settings\ania\Moje dokumenty\spider.sav [2010-07-29 22:42:02 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:02 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:42:01 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-20 14:24:32 | 000,000,527 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk [2010-07-20 14:22:06 | 012,387,832 | ---- | M] (Google Inc.) -- C:\Documents and Settings\ania\Pulpit\picasa36-setup.exe [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-08-08 16:47:01 | 000,000,688 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk [2010-07-22 22:30:18 | 000,000,369 | -H-- | C] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-07-20 14:24:32 | 000,000,527 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk [2004-10-12 07:40:58 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2004-10-12 07:39:48 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2004-10-12 07:39:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2004-10-09 07:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2004-10-05 09:16:08 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 00:44:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-06-04 02:18:49 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar52119x.sys [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar5211.sys [2004-06-04 02:18:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2004-06-04 02:00:53 | 000,000,736 | ---- | C] () -- C:\WINDOWS\setup.ini [2004-06-04 02:00:52 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2004-06-04 02:00:52 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2004-06-04 02:00:49 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2004-06-04 02:00:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2004-06-04 02:00:48 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [color=#E56717]========== LOP Check ==========[/color] [2004-06-04 02:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Panda Security [2010-08-08 16:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-06-24 18:31:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Opera [color=#E56717]========== Purity Check ==========[/color] < End of report >

Dodano Dzisiaj, 14:48:

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Cmaudio deleted successfully. Registry value HKEY_USERS\S-1-5-21-790525478-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\dso32 deleted successfully. C:\Documents and Settings\ania\Ustawienia lokalne\Temp\dsoqq.exe moved successfully. C:\autorun.inf moved successfully. D:\autorun.inf moved successfully. E:\autorun.inf moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\ not found. File F:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2c-b5b9-11d8-bc63-806d6172696f}\ not found. File F:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\ not found. File G:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2d-b5b9-11d8-bc63-806d6172696f}\ not found. File G:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\ not found. File H:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2e-b5b9-11d8-bc63-806d6172696f}\ not found. File H:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\ not found. File I:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e2f-b5b9-11d8-bc63-806d6172696f}\ not found. File I:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e30-b5b9-11d8-bc63-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e30-b5b9-11d8-bc63-806d6172696f}\ not found. File J:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e30-b5b9-11d8-bc63-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e30-b5b9-11d8-bc63-806d6172696f}\ not found. File J:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e31-b5b9-11d8-bc63-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e31-b5b9-11d8-bc63-806d6172696f}\ not found. File K:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e31-b5b9-11d8-bc63-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e31-b5b9-11d8-bc63-806d6172696f}\ not found. File K:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e32-b5b9-11d8-bc63-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e32-b5b9-11d8-bc63-806d6172696f}\ not found. File L:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59c67e32-b5b9-11d8-bc63-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59c67e32-b5b9-11d8-bc63-806d6172696f}\ not found. File L:\09lf.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\ not found. File G:\i8ikdjwt.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b339b5d6-b5bc-11d8-bc64-000b6a909d9e}\ not found. File G:\i8ikdjwt.exe not found. ========== FILES ========== C:\Documents and Settings\ania\Ustawienia lokalne\Temp\dsoqq0.dll moved successfully. autorun.inf not found in C:\ autorun.inf not found in D:\ autorun.inf not found in E:\ C:\eyruu.exe moved successfully. D:\eyruu.exe moved successfully. E:\eyruu.exe moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: ania ->Temp folder emptied: 149448669 bytes ->Temporary Internet Files folder emptied: 3863532 bytes ->Java cache emptied: 2414616 bytes ->Opera cache emptied: 23388330 bytes ->Flash cache emptied: 21283 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2114584 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 245760 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 173,00 mb [EMPTYFLASH] User: All Users User: ania ->Flash cache emptied: 0 bytes User: Default User User: LocalService User: NetworkService Total Flash Files Cleaned = 0,00 mb Restore points cleared and new OTL Restore Point set! OTL by OldTimer - Version 3.2.9.1 log created on 08162010_142637 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Dodano Dzisiaj, 14:49:

Kod: Zaznacz wszystko: ############################## | UsbFix 7.020 | [Listing] User: ania (Administrator) # ANIU-E111050434 [ ] Updated 12/08/10 by El Desaparecido / C_XX Started at 14:44:06 | 16/08/2010 Website: http://pagesperso-orange.fr/NosTools/index.html Contact: FindyKill.Contact@gmail.com CPU: Intel(R) Celeron(R) CPU 2.40GHz Microsoft Windows XP Professional (5.1.2600 32-Bit) # Dodatek Service Pack 2 Internet Explorer 6.0.2900.2180 Windows Firewall: Enabled Antivirus: avast! antivirus 4.8.1368 [VPS 100815-0] 4.8.1368 [(!) Disabled | Updated] RAM -> 255 Mb C:\ (%systemdrive%) -> Fixed drive # 20 Gb (16 Mb free - 81%) [] # NTFS D:\ -> Fixed drive # 27 Gb (23 Mb free - 85%) [] # NTFS E:\ -> Fixed drive # 28 Gb (2 Mb free - 9%) [] # NTFS F:\ -> CD-ROM G:\ -> Removable drive # 2 Gb (984 Mb free - 52%) [] # FAT ################## | Listing | [19/06/2010 - 22:25:28 | RASH | 116736] C:\09lf.exe [04/06/2004 - 01:36:41 | A | 0] C:\AUTOEXEC.BAT [04/06/2004 - 01:30:39 | SH | 211] C:\boot.ini [22/07/2001 - 02:13:54 | RASH | 4952] C:\Bootfont.bin [04/06/2004 - 01:36:41 | A | 0] C:\CONFIG.SYS [04/06/2004 - 01:48:13 | D ] C:\Documents and Settings [16/08/2010 - 14:29:50 | ASH | 267964416] C:\hiberfil.sys [04/06/2004 - 02:33:30 | D ] C:\Intel [04/06/2004 - 01:36:41 | RASH | 0] C:\IO.SYS [04/06/2004 - 01:36:41 | RASH | 0] C:\MSDOS.SYS [04/06/2004 - 02:04:00 | RHD ] C:\MSOCache [03/08/2004 - 22:38:34 | RASH | 47564] C:\NTDETECT.COM [03/08/2004 - 22:59:54 | RASH | 250624] C:\ntldr [04/06/2004 - 02:32:32 | D ] C:\NVIDIA [16/08/2010 - 14:29:44 | ASH | 402653184] C:\pagefile.sys [08/08/2010 - 16:46:24 | RD ] C:\Program Files [15/08/2010 - 18:56:18 | SHD ] C:\RECYCLER [16/08/2010 - 14:27:39 | SHD ] C:\System Volume Information [16/08/2010 - 14:43:46 | D ] C:\UsbFix [16/08/2010 - 14:44:06 | A | 1827] C:\UsbFix.txt [16/08/2010 - 14:27:13 | D ] C:\WINDOWS [26/06/2010 - 17:26:14 | D ] C:\XCore [16/08/2010 - 14:26:37 | D ] C:\_OTL [19/06/2010 - 22:25:28 | RSH | 116736] D:\09lf.exe [11/02/2009 - 20:01:26 | D ] D:\EA Games [31/01/2009 - 21:31:49 | A | 812344] D:\HJTInstall.exe [11/02/2009 - 20:06:48 | RD ] D:\Moja muzyka [20/03/2009 - 22:12:38 | RD ] D:\Moje obrazy [13/11/2009 - 20:29:43 | RD ] D:\Moje wideo [25/09/2007 - 19:37:22 | RHD ] D:\MSOCache [23/10/2008 - 16:43:44 | D ] D:\Nowy folder [20/07/2010 - 14:23:24 | D ] D:\Picasa [15/08/2010 - 18:57:26 | SHD ] D:\RECYCLER [11/02/2009 - 19:58:08 | D ] D:\SIMS2 [11/02/2009 - 20:39:20 | SHD ] D:\System Volume Information [19/06/2010 - 22:25:28 | RSH | 116736] E:\09lf.exe [26/05/2010 - 12:30:51 | D ] E:\Filmy [14/05/2009 - 20:20:11 | D ] E:\Gry [20/01/2010 - 17:16:07 | D ] E:\Kraków [14/08/2010 - 21:35:03 | D ] E:\Książki [30/07/2010 - 15:03:11 | D ] E:\Nowy folder [24/07/2010 - 18:20:36 | D ] E:\ONZ [15/08/2010 - 18:57:27 | SHD ] E:\RECYCLER [04/06/2004 - 01:13:44 | D ] E:\stary pulpit [11/02/2009 - 20:39:21 | SHD ] E:\System Volume Information [04/06/2004 - 01:49:18 | D ] E:\Szkoła [10/08/2010 - 00:19:11 | D ] E:\Tapety [04/06/2004 - 01:49:45 | ASH | 13824] E:\Thumbs.db [13/11/2009 - 20:24:26 | D ] E:\Zakopane [29/04/2008 - 16:26:56 | AH | 162] E:\~$polski.rtf [30/07/2008 - 20:53:17 | AH | 162] E:\~$tła.rtf [06/01/1980 - 18:01:22 | D ] G:\Images [06/01/1980 - 18:01:22 | D ] G:\Videos [06/01/1980 - 18:01:22 | D ] G:\Sounds [27/04/2010 - 15:05:22 | D ] G:\Zdjecia [04/06/2010 - 16:24:52 | N | 480472] G:\SThumbDB.tdb [12/08/2010 - 20:07:54 | A | 1462] G:\BOOTEX.LOG [24/06/2010 - 17:55:30 | RSH | 117248] G:\eyruu.exe [14/08/2010 - 23:07:54 | A | 57] G:\autorun.inf ################## | E.O.F |

Dodano Dzisiaj, 16:52:
nie wiem czy wszystko zrobiłam ok? Przejrzałam pliki w telefonie i znalazłam trzy dziwne, które nie są obsługiwane przez telefon. Jeden z nich wykrywał mi wcześniej avast, poznałam po nazwie. Usunęłam je z komórki, ale nie wiem czy to wystarczy. A po resecie na pulpicie pokazały mi się dwa pliki i jeden folder, których wcześniej nie było. Mają niewyraźne ikonki, jak po opcji "wytnij". Wiem, że nieudolnie tłumaczę

i nie wiem czy to w ogóle istotne.

**Posty:** 18165 · przez **wojtas** 17 Sie 2010, 09:58

no jak masz telefony , pendrivy to pewnie wszystko zainfekowane ... więc podlącz co możliwe i daj dopiero loga z USB, chyba że tylko masz telefon to przejdz niżej:

Uruchom OTL i w sekcji własne opcje skanowania / skrypt (Custom Scans/Fixes) wklej:

:OTL

:Files
C:\09lf.exe
G:\eyruu.exe

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt (Run Fix). I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia

**Posty:** 31 · przez **motylek1570** 17 Sie 2010, 13:15

tylko telefon.

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== ========== FILES ========== C:\09lf.exe moved successfully. File\Folder G:\eyruu.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: ania ->Temp folder emptied: 5482 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->Opera cache emptied: 194400 bytes ->Flash cache emptied: 923 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 163840 bytes RecycleBin emptied: 146125 bytes Total Files Cleaned = 1,00 mb [EMPTYFLASH] User: All Users User: ania ->Flash cache emptied: 0 bytes User: Default User User: LocalService User: NetworkService Total Flash Files Cleaned = 0,00 mb Restore points cleared and new OTL Restore Point set! OTL by OldTimer - Version 3.2.9.1 log created on 08172010_125642 Files\Folders moved on Reboot... File\Folder C:\WINDOWS\temp\_av_proI.tm~a03188\setup.lok not found! File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found! C:\WINDOWS\temp\Perflib_Perfdata_594.dat moved successfully. Registry entries deleted on Reboot...

Dodano Dzisiaj, 13:30:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-08-17 13:07:52 - Run 4 OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\ania\Pulpit\Nowy folder2 Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 28,00 Mb Available Physical Memory | 11,00% Memory free 618,00 Mb Paging File | 231,00 Mb Available in Paging File | 37,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 15,71 Gb Free Space | 80,44% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,12 Gb Free Space | 84,53% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 2,42 Gb Free Space | 8,74% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-08-16 13:54:30 | 002,752,560 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\Setup\avast.setup PRC - [2010-08-14 21:54:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe PRC - [2010-06-14 11:47:02 | 000,836,464 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-11-25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2006-11-21 19:38:22 | 000,035,328 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2005-05-09 20:45:00 | 002,678,784 | ---- | M] () -- C:\Program Files\PLANET WL-8310\WLANPRO.exe PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\acs.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-08-14 21:54:21 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe MOD - [2004-08-04 00:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Start_Pending] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-11-25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2009-11-25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-11-25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-11-25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2005-01-21 11:19:28 | 000,411,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2004-08-04 01:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2004-08-04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2004-08-04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2004-06-04 02:18:52 | 000,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-790525478-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2001-10-26 19:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\PLANET WL-8310 Configuration Utility.lnk = C:\Program Files\PLANET WL-8310\WLANPRO.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reg.lnk = C:\Program Files\PLANET WL-8310\Reg.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.137.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004-06-04 01:36:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-08-16 14:43:46 | 000,000,000 | ---D | C] -- C:\UsbFix [2010-08-16 14:26:37 | 000,000,000 | ---D | C] -- C:\_OTL [2010-08-16 14:23:21 | 001,207,838 | ---- | C] (C_XX & El Desaparecido) -- C:\Documents and Settings\ania\Pulpit\UsbFix.exe [2010-08-14 21:54:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\Nowy folder2 [2010-08-08 16:47:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-08-08 16:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\Nowe Gadu-Gadu [2010-07-29 22:43:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-07-29 22:42:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun [2010-07-29 22:42:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010-07-29 22:42:12 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-29 22:42:12 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:12 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2010-07-29 22:36:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Sun [2010-07-22 22:07:07 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\ania\Pulpit\.picasaoriginals [2010-07-20 14:23:56 | 000,023,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spupdsvc.exe [2010-07-20 14:23:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Google [2010-07-20 14:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2010-07-20 14:17:36 | 012,387,832 | ---- | C] (Google Inc.) -- C:\Documents and Settings\ania\Pulpit\picasa36-setup.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-08-17 13:03:46 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-08-17 13:02:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-08-17 13:01:55 | 267,964,416 | -HS- | M] () -- C:\hiberfil.sys [2010-08-17 13:00:45 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\ania\NTUSER.DAT [2010-08-17 13:00:45 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\ania\ntuser.ini [2010-08-16 20:29:42 | 005,853,812 | -H-- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-08-16 18:49:54 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-08-16 14:23:36 | 001,207,838 | ---- | M] (C_XX & El Desaparecido) -- C:\Documents and Settings\ania\Pulpit\UsbFix.exe [2010-08-11 17:09:13 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010-08-09 14:54:27 | 000,000,369 | -H-- | M] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-08-08 16:47:01 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk [2010-08-01 12:33:10 | 000,000,468 | ---- | M] () -- C:\Documents and Settings\ania\Moje dokumenty\spider.sav [2010-07-29 22:42:02 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:02 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:42:01 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-20 14:24:32 | 000,000,527 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk [2010-07-20 14:22:06 | 012,387,832 | ---- | M] (Google Inc.) -- C:\Documents and Settings\ania\Pulpit\picasa36-setup.exe [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-08-08 16:47:01 | 000,000,688 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Nowe Gadu-Gadu.lnk [2010-07-22 22:30:18 | 000,000,369 | -H-- | C] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-07-20 14:24:32 | 000,000,527 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk [2004-10-12 07:40:58 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2004-10-12 07:39:48 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2004-10-12 07:39:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2004-10-09 07:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2004-10-05 09:16:08 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 00:44:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-06-04 02:18:49 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar52119x.sys [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar5211.sys [2004-06-04 02:18:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2004-06-04 02:00:53 | 000,000,736 | ---- | C] () -- C:\WINDOWS\setup.ini [2004-06-04 02:00:52 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2004-06-04 02:00:52 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2004-06-04 02:00:49 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2004-06-04 02:00:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2004-06-04 02:00:48 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [color=#E56717]========== LOP Check ==========[/color] [2004-06-04 02:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Panda Security [2010-08-08 16:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-06-24 18:31:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Opera [color=#E56717]========== Purity Check ==========[/color] < End of report >

**Posty:** 18165 · przez **wojtas** 17 Sie 2010, 17:07

Wykonaj czynności końcowe :

1.Uruchom OTL z opcji sprzątanie.
2. wykonaj optymalizację Windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )

Zaktualizuj zabezpieczenia:
>>> Internet Explorer 8
>>> Service Pack 3

**Posty:** 31 · przez **motylek1570** 17 Sie 2010, 20:02

Punkt 1. zrobiłam, ale przy punkcie 2. mój zasób inteligencji się wyczerpał

mam zaznaczone uruchamianie normalne i wiem czy powinnam zmienić na selektywne? W zakładce uruchamianie mam niewiele i nie wiem czy powinnam coś odznaczyć?
http://w796.wrzuta.pl/obraz/2nfE6VuBxTG/bez_tytulu

Dodano Dzisiaj, 20:09:
I jeszcze jedno pytanie.. czy mogę podpiąć telefon do komputera? czy to znowu może grozić jakimiś problemami?

**Posty:** 18165 · przez **wojtas** 18 Sie 2010, 01:25

nie odznacz w uruchamianu : 2 ,4,5 pozycje.

możesz podpiąć

zabezpiecz kompa i telefon przed infekcją :

http://research.pandasecurity.com/Panda-USB-and-AutoRun-Vaccine/

oczywiscie robisz kolejne punkty...

**Posty:** 31 · przez **motylek1570** 19 Sie 2010, 18:11

zrobiłam wszystko

oprócz punktów o zaktualizowaniu zabezpieczeń IE8, bo nie używam, i Service Pack3, bo ponoć w przypadku radiówki są później problemy z połączeniem. Chyba że to konieczne? a w ogóle to komputer trochę odżył

choć miałam jeszcze mały problem, bo zrobiłam szybki skan przez Malwarebytes' Anti-Malware i znaleziono 1 zainfekowany klucz rejestru, więc go usunęłam. Ale zrobiłam jeszcze pełne skanowanie i pojawiły się trojany w system volume information, choć wcześniej wyłączyłam i włączyłam przywracanie systemu. Więc je też usunęłam. Mam nadzieję, że teraz już wszystko będzie ok. Chciałam bardzo bardzo bardzo serdecznie podziękować za pomoc, głównie Wojtasowi

za cierpliwość i poświęcony czas

mam nadzieję, że już więcej nie będzie problemów i nie będę zawracać głowy.

**Posty:** 18165 · przez **wojtas** 19 Sie 2010, 18:31

zaktualizuj jeszcze IE8 i SP3

nic się nie stanie. pozdro

**Posty:** 31 · przez **motylek1570** 20 Sie 2010, 17:07

No i niestety wróciłam szybciej niż myślałam..

Komputer nadal strasznie muli, zwłaszcza przez jakieś pierwsze pół godziny od włączenia.. a avast dalej mi jęczy, że mam robaki i trojany, tym razem na dysku D.. co do SP3 to nadal nie mam, bo mój internet ostatnio człapie, a nie chodzi. Zaczęłam ściągać, ale zeszło by mi to chyba do gwiazki, więc zrezygnowałam. Nie wiem co mam robić, dlatego pozwolę sobie jeszcze raz wkleić logi:

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-08-20 15:10:45 Windows 5.1.2600 Dodatek Service Pack 2 Running: 8b3r53z2.exe; Driver: C:\DOCUME~1\ania\USTAWI~1\Temp\pwpoqfog.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xF61566B8] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xF6156574] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xF6156A52] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xF615614C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xF615664E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xF615608C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xF61560F0] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xF615676E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xF615672E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xF61568AE] ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\system32\services.exe[612] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003C0002 IAT C:\WINDOWS\system32\services.exe[612] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003C0000 ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) ---- EOF - GMER 1.0.15 ----

Dodano Dzisiaj, 17:09:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-08-20 15:13:03 - Run 1 OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\ania\Pulpit\Nowy folder2 Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 33,00 Mb Available Physical Memory | 13,00% Memory free 618,00 Mb Paging File | 235,00 Mb Available in Paging File | 38,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 14,39 Gb Free Space | 73,67% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,08 Gb Free Space | 84,39% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 2,42 Gb Free Space | 8,75% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-08-20 14:25:51 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe PRC - [2010-06-14 11:47:02 | 000,836,464 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-11-25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2006-11-21 19:38:22 | 000,035,328 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2005-05-09 20:45:00 | 002,678,784 | ---- | M] () -- C:\Program Files\PLANET WL-8310\WLANPRO.exe PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\acs.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-08-20 14:25:51 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ania\Pulpit\Nowy folder2\OTL.exe MOD - [2004-08-04 00:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2004-07-12 21:06:00 | 000,036,864 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-11-25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2009-11-25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-11-25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-11-25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2005-01-21 11:19:28 | 000,411,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2004-08-04 01:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2004-08-04 00:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2004-08-04 00:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2004-06-04 02:18:52 | 000,015,781 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-790525478-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2001-10-26 19:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\PLANET WL-8310 Configuration Utility.lnk = C:\Program Files\PLANET WL-8310\WLANPRO.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reg.lnk = C:\Program Files\PLANET WL-8310\Reg.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-21-790525478-1450960922-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1282296148218 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.137.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004-06-04 01:36:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-08-20 14:26:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak [2010-08-20 11:43:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2010-08-20 11:33:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall [2010-08-20 11:32:58 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$ [2010-08-20 11:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$MSI31Uninstall_KB893803v2$ [2010-08-20 11:24:25 | 000,044,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wups2.dll [2010-08-20 11:24:25 | 000,023,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll.mui [2010-08-20 11:24:25 | 000,018,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng.dll.mui [2010-08-20 11:24:23 | 000,016,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaucpl.cpl.mui [2010-08-20 11:24:21 | 000,015,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui [2010-08-20 11:24:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution [2010-08-19 19:16:14 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\ania\IECompatCache [2010-08-19 19:12:38 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\ania\PrivacIE [2010-08-19 19:02:57 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\ania\IETldCache [2010-08-19 18:58:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM [2010-08-19 18:57:10 | 000,018,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll [2010-08-19 18:55:48 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2010-08-19 18:55:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pl-PL [2010-08-18 19:46:22 | 000,848,856 | ---- | C] (Panda Security ) -- C:\Documents and Settings\ania\Pulpit\USBVaccineSetup.exe [2010-08-18 19:00:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Malwarebytes [2010-08-18 18:59:49 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010-08-18 18:59:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2010-08-18 18:59:42 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010-08-18 18:59:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010-08-18 18:55:40 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\ania\Pulpit\mbam-setup-1.46_[www.programosy.pl].exe [2010-08-18 18:06:46 | 000,000,000 | ---D | C] -- C:\Program Files\Odkurzacz [2010-08-18 18:03:29 | 006,986,501 | ---- | C] (Franmo Software ) -- C:\Documents and Settings\ania\Pulpit\odk12.4.0.30setup_[www.programosy.pl].exe [2010-08-18 18:00:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\Nieużywane skróty pulpitu [2010-08-17 19:09:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2010-08-14 21:54:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Pulpit\Nowy folder2 [2010-08-08 16:47:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-08-08 16:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\Nowe Gadu-Gadu [2010-07-29 22:43:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-07-29 22:42:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun [2010-07-29 22:42:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010-07-29 22:42:12 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010-07-29 22:42:12 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:12 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2010-07-29 22:36:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ania\Dane aplikacji\Sun [2010-07-22 22:07:07 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\ania\Pulpit\.picasaoriginals [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-08-20 11:36:52 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-08-20 11:35:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-08-20 11:34:02 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\ania\ntuser.ini [2010-08-20 11:34:01 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\ania\NTUSER.DAT [2010-08-20 11:32:27 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010-08-19 19:47:52 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-08-18 19:46:53 | 000,848,856 | ---- | M] (Panda Security ) -- C:\Documents and Settings\ania\Pulpit\USBVaccineSetup.exe [2010-08-18 18:59:54 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-08-18 18:57:52 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\ania\Pulpit\mbam-setup-1.46_[www.programosy.pl].exe [2010-08-18 18:09:01 | 000,068,456 | ---- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2010-08-18 18:07:15 | 000,000,856 | ---- | M] () -- C:\Documents and Settings\ania\Pulpit\Szybkie Czyszczenie Dysku.lnk [2010-08-18 18:07:15 | 000,000,760 | ---- | M] () -- C:\Documents and Settings\ania\Pulpit\Odkurzacz.lnk [2010-08-18 18:05:31 | 006,986,501 | ---- | M] (Franmo Software ) -- C:\Documents and Settings\ania\Pulpit\odk12.4.0.30setup_[www.programosy.pl].exe [2010-08-18 14:40:56 | 005,854,052 | -H-- | M] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-08-18 13:20:50 | 000,000,552 | ---- | M] () -- C:\WINDOWS\win.ini [2010-08-18 13:20:50 | 000,000,239 | ---- | M] () -- C:\WINDOWS\system.ini [2010-08-18 13:20:50 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2010-08-17 18:57:19 | 000,266,208 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-08-11 17:09:13 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010-08-09 14:54:27 | 000,000,369 | -H-- | M] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2010-08-01 12:33:10 | 000,000,468 | ---- | M] () -- C:\Documents and Settings\ania\Moje dokumenty\spider.sav [2010-07-29 22:42:02 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010-07-29 22:42:02 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010-07-29 22:42:02 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010-07-29 22:42:01 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-08-18 18:59:54 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-08-18 18:07:15 | 000,000,856 | ---- | C] () -- C:\Documents and Settings\ania\Pulpit\Szybkie Czyszczenie Dysku.lnk [2010-08-18 18:07:15 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\ania\Pulpit\Odkurzacz.lnk [2010-07-22 22:30:18 | 000,000,369 | -H-- | C] () -- C:\Documents and Settings\ania\Pulpit\.picasa.ini [2004-10-12 07:40:58 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2004-10-12 07:39:48 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2004-10-12 07:39:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2004-10-09 07:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2004-10-05 09:16:08 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-07-17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-06-04 02:18:49 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar52119x.sys [2004-06-04 02:18:49 | 000,411,680 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar5211.sys [2004-06-04 02:18:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2004-06-04 02:06:30 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\ania\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2004-06-04 02:00:52 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2004-06-04 02:00:52 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2004-06-04 02:00:49 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2004-06-04 02:00:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2004-06-04 02:00:48 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [color=#E56717]========== LOP Check ==========[/color] [2004-06-04 02:30:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Panda Security [2010-08-08 16:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Nowe Gadu-Gadu [2010-06-24 18:31:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ania\Dane aplikacji\Opera [color=#E56717]========== Purity Check ==========[/color] < End of report >

Dodano Dzisiaj, 17:10:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-08-20 15:13:03 - Run 1 OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\ania\Pulpit\Nowy folder2 Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 255,00 Mb Total Physical Memory | 33,00 Mb Available Physical Memory | 13,00% Memory free 618,00 Mb Paging File | 235,00 Mb Available in Paging File | 38,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 14,39 Gb Free Space | 73,67% Space Free | Partition Type: NTFS Drive D: | 27,35 Gb Total Space | 23,08 Gb Free Space | 84,39% Space Free | Partition Type: NTFS Drive E: | 27,65 Gb Total Space | 2,42 Gb Free Space | 8,75% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ANIU-E111050434 Current User Name: ania Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = Opera.HTML] -- C:\Program Files\Opera\opera.exe (Opera Software) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files\Opera\opera.exe" "%1" (Opera Software) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation) "C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0FE76E17-23F0-457C-9126-DE043402FE1F}" = Opera 10.60 "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12 "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007 "{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007 "{94E4FBD6-540C-4DB6-A469-B1FA248DA33E}" = PLANET WL-8310 "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ALLPlayer V3.0_is1" = ALLPlayer V3.X "avast!" = avast! Antivirus "C-Media Audio" = C-Media 3D Audio "ENTERPRISE" = Microsoft Office Enterprise 2007 "EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.00 "Foxit Reader" = Foxit Reader "ie8" = Windows Internet Explorer 8 "IrfanView" = IrfanView (remove only) "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "NVIDIA Drivers" = NVIDIA Drivers "Odkurzacz 12.4_is1" = Odkurzacz 12.4 "Picasa 3" = Picasa 3 "Winamp" = Winamp (remove only) "WinRAR archiver" = Archiwizator WinRAR "XP Codec Pack" = XP Codec Pack [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Antivirus Events ] Error - 2010-08-14 15:38:30 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 15:38:48 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 15:45:01 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:33:49 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:36:14 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:36:41 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 16:58:36 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-14 17:00:48 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = Error in aswChestC: chestAddFile Error 1753. Error - 2010-08-15 12:18:20 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = AAVM - initialization error: Unhandled exception in AavmProviderStop [Inner], MAIL. Error - 2010-08-16 07:44:39 | Computer Name = ANIU-E111050434 | Source = avast! | ID = 33554522 Description = AAVM - initialization error: Unhandled exception in AavmProviderStop [Inner], MAIL. [ Application Events ] Error - 2010-07-29 16:47:44 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd flash.ocx, wersja 6.0.79.0, adres błędu 0x0001cfd3. Error - 2010-07-29 16:51:06 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd mshtml.dll, wersja 6.0.2900.2180, adres błędu 0x0007f463. Error - 2010-08-15 10:19:42 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ashWebSv.exe, wersja 4.8.1367.0, moduł powodujący błąd aswCmnB.dll, wersja 4.8.1367.0, adres błędu 0x0000893c. Error - 2010-08-15 10:52:51 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ashWebSv.exe, wersja 4.8.1367.0, moduł powodujący błąd aswCmnB.dll, wersja 4.8.1367.0, adres błędu 0x0000893c. Error - 2010-08-15 12:47:03 | Computer Name = ANIU-E111050434 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd ashWebSv.exe, wersja 4.8.1367.0, moduł powodujący błąd aswCmnB.dll, wersja 4.8.1367.0, adres błędu 0x0000893c. [ System Events ] Error - 2010-08-19 07:34:14 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7034 Description = Usługa avast! Web Scanner niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2010-08-19 07:52:52 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7026 Description = Nie można załadować następujących sterowników startu rozruchowego lub systemowego: PCIIde Error - 2010-08-19 08:38:57 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7026 Description = Nie można załadować następujących sterowników startu rozruchowego lub systemowego: PCIIde Error - 2010-08-19 13:06:02 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-19 13:06:02 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-19 13:06:47 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-19 13:06:47 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-19 13:07:27 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą avast! Web Scanner. Error - 2010-08-19 13:07:27 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi avast! Web Scanner z powodu następującego błędu: %%1053 Error - 2010-08-19 13:12:15 | Computer Name = ANIU-E111050434 | Source = Service Control Manager | ID = 7034 Description = Usługa avast! Web Scanner niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. < End of report >

**Posty:** 584 · przez **Andziorka** 20 Sie 2010, 17:25

W jakiej lokalizacji wykrywa trojany?
Przeskanuj komputer programem: FixIEDef : http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html i wklej powstałego loga.
+ wykonaj skan: http://www.programosy.pl/program,malwarebytes-anti-malware.html usuń co znajdzie i daj powstałego loga.

**Posty:** 31 · przez **motylek1570** 20 Sie 2010, 17:29

dalej w system volume information, mimo tego że wczoraj skanowałam przez Malwarebytes' Anti-Malware i usunęłam to co było. a dziś avast znalazł od nowa.. zaraz wykonam Twoje polecenia.

Dodano Dzisiaj, 17:35:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7525 * * * ******************************************************************************** Created at 17:31:06 on Friday, August 20, 2010 Time Zone : Logged On User : ania Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Celeron(R) CPU 2.40GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 14.01 GB Total Physical Memory: 255 MB Free Physical Memory : 95 MB Total Page File : 255 MB Free Page File : 334 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1957 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\drv2.dll C:\WINDOWS\system32\drv1.dll C:\WINDOWS\system32\drv2.dll C:\WINDOWS\system32\drvc.dll -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 584 · przez **Andziorka** 20 Sie 2010, 17:37

dalej w system volume information

to w plikach z przywracania systemu, aby się tego pozbyć wykonaj: http://support.microsoft.com/kb/310405/pl

Kto jest na forum