Zablokowany komp przez wirus udający policję

przez **mm13** » 09 Maj 2012, 16:02

proszę o pomoc mam zablakowanego kompa przez virusa (niby policja)co ztym zrobić

przez **kominekl** » 09 Maj 2012, 16:14

Podaj logi z OTL

otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967.html#p107754 i TDSSKiller

otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p120292.

przez **mm13** » 09 Maj 2012, 16:16

Tak to wyglada

Kod: Zaznacz wszystko: OTL logfile created on: 5/9/2012 4:36:52 PM - Run OTLPE by OldTimer - Version 3.1.30.1 Folder = X:\Programs\OTLPE Microsoft Windows XP Dodatek Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free 2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 97.65 Gb Total Space | 3.49 Gb Free Space | 3.57% Space Free | Partition Type: NTFS Drive D: | 368.10 Gb Total Space | 1.72 Gb Free Space | 0.47% Space Free | Partition Type: NTFS Drive E: | 7.46 Gb Total Space | 7.46 Gb Free Space | 100.00% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive X: | 276.79 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO Current User Name: SYSTEM Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard Using ControlSet: ControlSet001 [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2012/05/05 03:47:17 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/04/24 05:58:00 | 000,116,648 | ---- | M] (Google Inc.) [On_Demand] -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdatem) Usługa Google Update (gupdatem) SRV - [2012/04/24 05:58:00 | 000,116,648 | ---- | M] (Google Inc.) [Auto] -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate) Usługa Google Update (gupdate) SRV - [2012/04/18 05:17:29 | 001,790,016 | ---- | M] () [Auto] -- C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe -- (Guard.Mail.ru) SRV - [2011/11/10 00:54:30 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2011/09/28 04:45:12 | 000,885,160 | ---- | M] () [On_Demand] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\LiveTunerService.exe -- (WO_LiveService) SRV - [2011/09/06 16:45:28 | 000,044,768 | ---- | M] (AVAST Software) [Auto] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2011/04/22 08:21:10 | 000,092,592 | ---- | M] (TomTom) [Auto] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService) SRV - [2009/08/24 17:16:36 | 000,406,016 | ---- | M] (mst software GmbH, Germany) [Auto] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\DfsdkS.exe -- (DfSdkS) SRV - [2009/03/12 13:15:14 | 000,085,096 | ---- | M] (Autodesk) [On_Demand] -- C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service) SRV - [2009/03/03 18:23:04 | 000,602,112 | ---- | M] (ATI Technologies Inc.) [Auto] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2008/05/06 05:55:56 | 002,155,896 | ---- | M] (RealVNC Ltd.) [Auto] -- C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4) SRV - [2008/04/14 18:50:34 | 000,028,672 | ---- | M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\system32\irmon.dll -- (Irmon) SRV - [2008/04/08 04:56:30 | 000,800,040 | ---- | M] (Nero AG) [On_Demand] -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService) SRV - [2008/01/22 06:13:26 | 000,275,752 | ---- | M] (Nero AG) [On_Demand] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2007/06/28 12:43:00 | 000,155,716 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc) SRV - [2006/12/19 05:30:26 | 000,081,920 | ---- | M] (Prolific Technology Inc.) [Auto] -- C:\WINDOWS\system32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service) SRV - [2006/07/13 11:59:48 | 000,131,131 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp) SRV - [2006/07/13 11:59:32 | 000,065,599 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog) SRV - [2006/04/03 13:04:02 | 000,020,543 | ---- | M] (Apache Software Foundation) [Auto] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface) SRV - [2005/04/01 20:51:48 | 000,217,600 | ---- | M] (Rocket Division Software) [Auto] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- (StarWindService) SRV - [1999/02/13 16:01:46 | 000,005,904 | ---- | M] () [Auto] -- C:\WINDOWS\system32\Autoexnt.exe -- (AutoExNT) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | On_Demand] -- -- (GenericMount) DRV - File not found [Kernel | System] -- -- (Changer) DRV - File not found [Kernel | System] -- -- (AmdK8) DRV - [2012/01/30 20:15:42 | 000,020,032 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dgderdrv.sys -- (dgderdrv) DRV - [2011/12/08 00:22:34 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2011/12/08 00:22:34 | 000,100,224 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ss_bserd.sys -- (ss_bserd) DRV - [2011/12/08 00:22:34 | 000,098,432 | ---- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM) DRV - [2011/12/08 00:22:34 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) DRV - [2011/09/06 16:38:05 | 000,442,200 | ---- | M] (AVAST Software) [File_System | System] -- C:\WINDOWS\system32\drivers\aswSnx.sys -- (aswSnx) DRV - [2011/09/06 16:37:53 | 000,320,856 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2011/09/06 16:36:38 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2011/09/06 16:36:36 | 000,052,568 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi) DRV - [2011/09/06 16:36:23 | 000,110,552 | ---- | M] (AVAST Software) [File_System | Auto] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2011/09/06 16:36:12 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2011/09/06 16:33:11 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2011/03/08 01:01:06 | 000,012,696 | ---- | M] () [Kernel | Auto] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\LiveTunerProcessMonitor32.sys -- (LiveTunerPM) DRV - [2010/11/25 00:59:16 | 000,606,056 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RTL8192su.sys -- (RTL8192su) DRV - [2010/01/21 09:33:59 | 000,824,832 | ---- | M] (AfaTech ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AF9035HB.sys -- (AF9035HB) DRV - [2010/01/04 23:31:32 | 001,714,176 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\athuw.sys -- (AR9271) DRV - [2009/03/03 20:49:58 | 003,565,568 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2009/02/03 05:22:00 | 005,030,912 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008/09/25 09:51:42 | 000,115,328 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2008/08/05 08:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt) DRV - [2008/05/06 04:43:34 | 000,004,608 | ---- | M] (RealVNC Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vncmirror.sys -- (vncmirror) DRV - [2008/04/13 19:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE) DRV - [2008/04/13 16:09:18 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2008/04/13 16:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008/04/13 16:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2008/01/25 15:01:06 | 000,132,096 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts) DRV - [2007/12/17 05:14:06 | 000,012,400 | R--- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO) DRV - [2007/06/28 12:43:00 | 006,807,328 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2007/04/16 10:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2006/11/06 13:04:56 | 000,028,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wceusbsh.sys -- (wceusbsh) DRV - [2006/07/11 16:38:30 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006/07/11 16:38:28 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006/01/04 03:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt) DRV - [2005/04/25 05:43:58 | 000,159,616 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Vax347b.sys -- (Vax347b) DRV - [2004/08/15 04:00:00 | 000,005,810 | R--- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2004/04/30 04:33:00 | 000,005,248 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Vax347s.sys -- (Vax347s) DRV - [2001/08/17 19:49:56 | 000,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2001/08/17 19:49:38 | 000,007,936 | ---- | M] (Microsoft Corporation) [Recognizer | System] -- C:\WINDOWS\system32\drivers\fs_rec.sys -- (Fs_Rec) DRV - [2001/08/17 19:36:46 | 000,002,864 | ---- | M] (Microsoft Corporation) [Adapter | On_Demand] -- C:\WINDOWS\system32\winsock.dll -- (Winsock) DRV - [2001/08/17 17:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\ddd_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\ddd_ON_C\..\URLSearchHook: {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) IE - HKU\ddd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\ddd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.10.0.1:3128 IE - HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ FF - HKLM\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/23 11:40:28 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/13 04:24:41 | 000,000,000 | ---D | M] [2012/04/23 11:40:40 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2012/04/23 11:40:27 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll [2011/11/10 00:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2012/04/23 11:40:24 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2012/04/23 11:40:24 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010/12/13 08:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchddr.xml [2012/04/23 11:40:24 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2012/04/23 11:40:24 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2012/04/23 11:40:24 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2012/04/23 11:40:24 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2010/08/09 09:24:35 | 000,000,992 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 111.90.139.103 odnoklassniki.ru O1 - Hosts: 111.90.139.103 http://www.odnoklassniki.ru O1 - Hosts: 111.90.139.103 vkontakte.ru O1 - Hosts: 111.90.139.103 http://www.vkontakte.ru O1 - Hosts: 111.90.139.103 vk.com O1 - Hosts: 111.90.139.103 http://www.vk.com O1 - Hosts: 111.90.139.103 login.vk.com O1 - Hosts: 111.90.139.103 http://www.login.vk.com O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.3\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (MailRuBHO Class) - {8984B388-A5BB-4DF7-B274-77B879E179DB} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (Спутник@Mail.Ru) - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll (facemoods.com) O3 - HKU\ddd_ON_C\..\Toolbar\WebBrowser: (Спутник@Mail.Ru) - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) O3 - HKU\ddd_ON_C\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.3\facemoodssrv.exe (facemoods.com) O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe () O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [Six Engine] C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe () O4 - HKLM..\Run: [Smart File Advisor] C:\Program Files\Smart File Advisor\sfa.exe (Filefacts.net) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKU\ddd_ON_C..\Run: [A423B81A] C:\WINDOWS\system32\EC7D84EAA423B81AB220.exe () O4 - HKU\ddd_ON_C..\Run: [arsv] C:\DOCUME~1\ddd\USTAWI~1\Temp\arsv.exe File not found O4 - HKU\ddd_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\ddd_ON_C..\Run: [Download Master] C:\Program Files\Download Master\dmaster.exe File not found O4 - HKU\ddd_ON_C..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\Wcescomm.exe (Microsoft Corporation) O4 - HKU\ddd_ON_C..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKU\ddd_ON_C..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKU\ddd_ON_C..\Run: [PID] C:\DOCUME~1\ddd\USTAWI~1\Temp\of02qorh.exe File not found O4 - HKU\ddd_ON_C..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - HKU\Administrator_ON_C..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe (Nero AG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\ddd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\ddd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O7 - HKU\ddd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF [binary data] O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EditLevel = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogOff = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCommonGroups = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoColorChoice = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoSizeChoice = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoVisualStyleChoice = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SetVisualStyle = %SystemRoot%\Resources\Themes\Luna.theme () O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control) O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} http://mapa.lodz.pl/VIEWERS/mgaxctrl.cab (Autodesk MapGuide ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\EC7D84EAA423B81AB220.exe) - C:\WINDOWS\system32\EC7D84EAA423B81AB220.exe () O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/12/19 09:10:10 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{16449583-cde5-11dd-8f75-00196680468f}\Shell - "" = AutoRun O33 - MountPoints2\{16449583-cde5-11dd-8f75-00196680468f}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O33 - MountPoints2\{6d3ae555-010a-11df-aac3-00248cd6db46}\Shell\AutoRun\command - "" = I:\APPInst.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (aswBoot.exe /M:1d43bb6041) - C:\WINDOWS\System32\aswBoot.exe (AVAST Software) O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012/05/09 16:27:53 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft [2012/05/09 16:26:48 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Local Settings\Application Data\Temp [2012/05/09 16:26:47 | 000,000,000 | --SD | C] -- B:\Documents and Settings\Default User\Cookies [2012/05/09 16:26:47 | 000,000,000 | R--D | C] -- B:\Documents and Settings\Default User\Recent [2012/05/09 16:26:47 | 000,000,000 | R--D | C] -- B:\Documents and Settings\Default User\My Documents\My Pictures [2012/05/09 16:26:47 | 000,000,000 | R--D | C] -- B:\Documents and Settings\Default User\My Documents\My Music [2012/05/09 16:26:47 | 000,000,000 | R--D | C] -- B:\Documents and Settings\Default User\My Documents [2012/05/09 16:26:47 | 000,000,000 | R--D | C] -- B:\Documents and Settings\Default User\Favorites [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Templates [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Start Menu [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\SendTo [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\PrintHood [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\NetHood [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\My Documents\My Videos [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Application Data\Microsoft [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Local Settings [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Desktop [2012/05/09 16:26:47 | 000,000,000 | ---D | C] -- B:\Documents and Settings\Default User\Application Data [2012/05/07 12:48:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ddd\Dane aplikacji\Llsso [2012/05/07 10:49:35 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\ddd\Recent [2012/04/24 06:26:26 | 000,000,000 | ---D | C] -- C:\Program Files\e-Deklaracje [2012/04/24 05:59:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ddd\Dane aplikacji\Google [2012/04/24 05:58:03 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2012/04/24 05:58:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ddd\Ustawienia lokalne\Dane aplikacji\Google [2012/04/19 09:00:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ddd\Moje dokumenty\rejestrator Jurkowska [2012/04/14 05:49:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\Media Player Classic [2009/01/21 13:13:04 | 000,159,616 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347b.sys [2009/01/21 13:13:04 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347s.sys [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012/05/09 16:34:36 | 015,466,496 | -H-- | M] () -- C:\Documents and Settings\ddd\NTUSER.DAT [2012/05/09 16:32:02 | 000,001,332 | ---- | M] () -- B:\Documents and Settings\Default User\Desktop\OTLPE.lnk [2012/05/09 07:32:08 | 000,262,144 | -H-- | M] () -- C:\Documents and Settings\LocalService\NTUSER.DAT [2012/05/09 07:32:08 | 000,241,664 | -H-- | M] () -- C:\Documents and Settings\NetworkService\NTUSER.DAT [2012/05/09 07:32:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012/05/09 07:31:57 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2012/05/09 07:30:21 | 000,001,026 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012/05/08 13:47:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012/05/08 13:45:24 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2012/05/08 05:45:38 | 000,002,228 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012/05/08 05:44:08 | 000,575,080 | ---- | M] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2012/05/08 05:44:04 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\ddd\ntuser.ini [2012/05/08 05:36:18 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2012/05/08 05:03:00 | 000,001,030 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012/05/08 04:42:10 | 000,002,226 | ---- | M] () -- C:\WINDOWS\wincmd.ini [2012/05/07 12:48:08 | 000,135,168 | -H-- | M] () -- C:\WINDOWS\System32\EC7D84EAA423B81AB220.exe [2012/05/05 04:45:46 | 000,000,347 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini [2012/05/05 03:47:16 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2012/05/05 03:47:16 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2012/04/11 21:06:49 | 001,071,412 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2012/04/11 21:06:49 | 000,500,290 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2012/04/11 21:06:49 | 000,441,256 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012/04/11 21:06:49 | 000,089,472 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2012/04/11 21:06:49 | 000,071,574 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012/04/11 21:01:25 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012/05/09 16:26:48 | 000,001,547 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\MSKeyViewer Plus.lnk [2012/05/09 16:26:48 | 000,001,535 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\RegistryEditorPE.lnk [2012/05/09 16:26:48 | 000,001,483 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\HandyRecovery 1.lnk [2012/05/09 16:26:48 | 000,001,479 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\Undelete Plus.lnk [2012/05/09 16:26:48 | 000,001,475 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\Magical Jelly Bean Keyfinder.lnk [2012/05/09 16:26:48 | 000,001,469 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\DiskPartitioner.lnk [2012/05/09 16:26:48 | 000,001,465 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\Agent Ransack.lnk [2012/05/09 16:26:48 | 000,001,437 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\notepad++.lnk [2012/05/09 16:26:48 | 000,001,427 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\2xExplorer.lnk [2012/05/09 16:26:48 | 000,001,371 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\ImgBurn.lnk [2012/05/09 16:26:48 | 000,001,353 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\DriveImage XML.lnk [2012/05/09 16:26:48 | 000,001,347 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\A43 File Management Utility.lnk [2012/05/09 16:26:48 | 000,001,347 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\7-Zip File Manager.lnk [2012/05/09 16:26:48 | 000,001,343 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\Windows Registry Recovery.lnk [2012/05/09 16:26:48 | 000,001,332 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\OTLPE.lnk [2012/05/09 16:26:48 | 000,001,313 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\Disk Investigator.lnk [2012/05/09 16:26:48 | 000,001,261 | ---- | C] () -- B:\Documents and Settings\Default User\Desktop\Internet Explorer.lnk [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh324 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh323 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh322 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh321 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh320 [2012/05/07 12:48:08 | 000,135,168 | -H-- | C] () -- C:\WINDOWS\System32\EC7D84EAA423B81AB220.exe [2012/04/24 05:58:08 | 000,001,030 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012/04/24 05:58:07 | 000,001,026 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012/02/15 08:33:21 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011/12/10 08:09:05 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\ddd\Dane aplikacji\winscp.rnd [2011/12/09 13:39:11 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD-Start.INI [2011/11/25 10:10:20 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI [2011/05/26 07:25:16 | 000,000,026 | R--- | C] () -- C:\WINDOWS\System32\system32.DLL [2011/05/26 07:24:39 | 000,000,024 | ---- | C] () -- C:\WINDOWS\System32\sysdate.ini [2011/05/11 06:33:51 | 000,575,080 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2011/04/27 08:19:30 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll [2011/04/27 08:19:30 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll [2011/04/27 08:19:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll [2011/04/27 08:19:30 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll [2011/02/03 13:30:29 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll [2011/02/03 13:30:29 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\AVEQT.dll [2010/10/25 08:30:36 | 000,000,046 | ---- | C] () -- C:\WINDOWS\FxLoader.INI [2010/07/01 11:53:35 | 000,000,069 | ---- | C] () -- C:\WINDOWS\sysstr32.ini [2010/04/30 10:02:58 | 000,692,744 | ---- | C] () -- C:\Documents and Settings\ddd\Ustawienia lokalne\Dane aplikacji\unins000.exe [2010/04/30 10:02:58 | 000,001,838 | ---- | C] () -- C:\Documents and Settings\ddd\Ustawienia lokalne\Dane aplikacji\unins000.dat [2010/02/01 14:40:34 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2010/01/21 09:34:10 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll [2009/09/22 07:55:03 | 000,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll [2009/09/22 07:55:03 | 000,012,400 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys [2009/09/22 07:55:01 | 000,011,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys [2009/09/22 07:55:01 | 000,010,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys [2009/09/22 07:43:04 | 000,001,746 | ---- | C] () -- C:\WINDOWS\Language_trs.ini [2009/09/22 07:42:37 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2009/09/22 07:42:31 | 000,036,429 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009/09/22 07:42:31 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2009/06/04 11:15:55 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\ddd\Ustawienia lokalne\Dane aplikacji\fusioncache.dat [2009/03/26 05:07:57 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\ddd\Ustawienia lokalne\Dane aplikacji\PUTTY.RND [2009/03/23 08:47:50 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\LocalService\Dane aplikacji\$_hpcst$.hpc [2009/02/17 04:52:22 | 000,000,347 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini [2009/01/23 12:30:12 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\ddd\Dane aplikacji\$_hpcst$.hpc [2009/01/21 13:14:25 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2009/01/20 12:25:01 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009/01/08 12:13:54 | 000,002,226 | ---- | C] () -- C:\WINDOWS\wincmd.ini [2009/01/05 10:29:49 | 000,163,328 | ---- | C] () -- C:\Documents and Settings\ddd\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/12/19 11:50:15 | 000,002,320 | ---- | C] () -- C:\WINDOWS\System32\Servmess.dll [2006/10/31 09:35:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006/10/31 09:35:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006/10/31 09:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006/10/31 09:35:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006/10/31 09:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006/10/31 09:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006/02/09 09:30:32 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\VSHP1020.DLL [color=#E56717]========== LOP Check ==========[/color] [2009/05/04 07:00:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\.BitTornado [2009/03/18 05:11:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Autodesk [2011/11/14 11:45:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Azureus [2011/09/29 06:06:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Boilsoft [2011/02/03 05:23:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\cs [2009/07/08 18:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Dane aplikacji [2010/08/31 05:36:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\download [2011/03/31 12:30:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Download Master [2010/08/31 05:34:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\download2 [2010/04/30 10:04:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1 [2012/02/28 09:50:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\facemoods.com [2011/11/25 08:03:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\GetRightToGo [2012/05/07 12:48:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Llsso [2009/02/03 11:49:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Mikrotik [2010/02/08 11:01:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\OpenOffice.org [2009/03/28 05:19:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\OpenOffice.ux.pl [2011/12/23 04:15:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\PriceGong [2012/03/24 09:08:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Samsung [2011/11/24 11:45:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\SkyMonk [2012/03/26 04:45:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Temp [2011/07/04 13:51:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\TomTom [2011/08/12 12:08:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\uTorrent [2009/10/09 10:44:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\VitySoft [2011/12/19 07:31:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\Xilisoft [2012/03/21 07:34:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\{DCD48218-E972-4d0c-9E5F-43462BC13E3B} [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Files - Unicode (All) ==========[/color] [2012/03/21 07:34:26 | 000,000,211 | ---- | M] ()(C:\Documents and Settings\ddd\Pulpit\?????? ? ?????????.url) -- C:\Documents and Settings\ddd\Pulpit\Искать в Интернете.url [2012/02/02 12:02:32 | 000,000,211 | ---- | C] ()(C:\Documents and Settings\ddd\Pulpit\?????? ? ?????????.url) -- C:\Documents and Settings\ddd\Pulpit\Искать в Интернете.url < End of report >

przez **mateo8898** » 09 Maj 2012, 16:31

Nie podałeś drugiego logu z OTL (Extras.txt) oraz logu z TDSSKiller.

przez **mm13** » 09 Maj 2012, 16:56

Extras jest a kasperski nic nie pokazuje
http://wklej.eu/index.php?id=c37f95d013&view=nl

przez **mateo8898** » 09 Maj 2012, 17:10

1. Uruchom OTL

w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko: :OTL IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 IE - HKU\ddd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.10.0.1:3128 [2010/12/13 08:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchddr.xml O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKU\ddd_ON_C..\Run: [arsv] C:\DOCUME~1\ddd\USTAWI~1\Temp\arsv.exe File not found O4 - HKU\ddd_ON_C..\Run: [Download Master] C:\Program Files\Download Master\dmaster.exe File not found O4 - HKU\ddd_ON_C..\Run: [PID] C:\DOCUME~1\ddd\USTAWI~1\Temp\of02qorh.exe File not found O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found [2012/05/07 12:48:08 | 000,135,168 | -H-- | M] () -- C:\WINDOWS\System32\EC7D84EAA423B81AB220.exe [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh324 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh323 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh322 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh321 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh320 [2012/04/24 05:58:08 | 000,001,030 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012/04/24 05:58:07 | 000,001,026 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job :Services NMIndexingService :Reg [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\APPRO TECH\Viewer Software\APODVR3016.exe"=- "C:\Documents and Settings\ddd\Ustawienia lokalne\Temp\2045220.exe"=- "C:\Documents and Settings\ddd\Dane aplikacji\download2\svcnost.exe"=- "C:\Documents and Settings\ddd\Ustawienia lokalne\Temp\Nero Web\SetupXu.exe"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"=- "Adobe Reader Speed Launcher"=- "Alcmtr"=- "Guard.Mail.ru.gui"=- "NeroFilterCheck"=- "NvMediaCenter"=- "nwiz"=- "RTHDCPL"=- "SunJavaUpdateSched"=- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=- :Commands [resethosts] [clearallrestorepoints] [emptytemp]

Klikasz Wykonaj skrypt. Zatwierdź restart. Pojawi się log z usuwania.

2. Odinstaluj: Conduit Engine, facemoods, Guard.Mail.ru.
3. Podaj log z usuwania i nowe logi z OTL.
Kolejność jak podałem.

przez **mm13** » 09 Maj 2012, 17:38

wykonałem skrypt zatwierdziłem restart .Czy log z usuwania pojawia się w katalogu -OTL i czy to ma być restart kompa?
a to log z tego katalogu

Kod: Zaznacz wszystko: :OTL IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 IE - HKU\ddd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.10.0.1:3128 [2010/12/13 08:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchddr.xml O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKU\ddd_ON_C..\Run: [arsv] C:\DOCUME~1\ddd\USTAWI~1\Temp\arsv.exe File not found O4 - HKU\ddd_ON_C..\Run: [Download Master] C:\Program Files\Download Master\dmaster.exe File not found O4 - HKU\ddd_ON_C..\Run: [PID] C:\DOCUME~1\ddd\USTAWI~1\Temp\of02qorh.exe File not found O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found [2012/05/07 12:48:08 | 000,135,168 | -H-- | M] () -- C:\WINDOWS\System32\EC7D84EAA423B81AB220.exe [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh324 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh323 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh322 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh321 [2012/05/07 12:48:32 | 000,960,056 | ---- | C] () -- C:\WINDOWS\System32\winsh320 [2012/04/24 05:58:08 | 000,001,030 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012/04/24 05:58:07 | 000,001,026 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job :Services NMIndexingService :Reg [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\APPRO TECH\Viewer Software\APODVR3016.exe"=- "C:\Documents and Settings\ddd\Ustawienia lokalne\Temp\2045220.exe"=- "C:\Documents and Settings\ddd\Dane aplikacji\download2\svcnost.exe"=- "C:\Documents and Settings\ddd\Ustawienia lokalne\Temp\Nero Web\SetupXu.exe"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"=- "Adobe Reader Speed Launcher"=- "Alcmtr"=- "Guard.Mail.ru.gui"=- "NeroFilterCheck"=- "NvMediaCenter"=- "nwiz"=- "RTHDCPL"=- "SunJavaUpdateSched"=- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=- :Commands [resethosts] [clearallrestorepoints] [emptytemp]

przez **mateo8898** » 09 Maj 2012, 18:23

Ma być log, który pojawi się po restarcie komputera i nowe logi robione opcją Skanuj. Ty mi tu wkleiłeś skrypt, który podałem wyżej...

przez **mm13** » 09 Maj 2012, 18:24

ok działa wielkie dzięki czym go teraz najlepiej sprawdzic?

przez **mm13** » 09 Maj 2012, 18:33

http://wklej.eu/index.php?id=f5fb786397&view=nl
http://wklej.eu/index.php?id=8081d34164&view=nl

przez **mateo8898** » 09 Maj 2012, 19:03

Logi wklejaj na http://wklej.eu/, a w poście podaj tylko link.

Odinstaluj jeszcze Mail.Ru. Następnie:

W OTL wklej:

Kod: Zaznacz wszystko: :OTL IE - HKU\ddd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.10.0.1:3128 O4 - HKU\ddd_ON_C..\Run: [A423B81A] C:\WINDOWS\System32\EC7D84EAA423B81AB220.exe File not found [2012/02/28 09:50:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ddd\Dane aplikacji\facemoods.com O3 - HKLM\..\Toolbar: (Спутник@Mail.Ru) - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) O3 - HKU\ddd_ON_C\..\Toolbar\WebBrowser: (Спутник@Mail.Ru) - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru) IE - HKU\ddd_ON_C\..\URLSearchHook: {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll (@Mail.Ru)

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

przez **mm13** » 09 Maj 2012, 20:05

http://www.wklej.eu/index.php?id=2018c6f44d
http://wklej.eu/index.php?id=eb87a5a0af
http://wklej.eu/index.php?id=f85707c03f
Ok podaję jak napisałeś

przez **mateo8898** » 09 Maj 2012, 20:25

Wyłącz proxy w IE.

W OTL wklej:

Kod: Zaznacz wszystko: :OTL O3 - HKU\ddd_ON_C\..\Toolbar\WebBrowser: (no name) - {09900DE8-1DCA-443F-9243-26FF581438AF} - No CLSID value found. O3 - HKU\ddd_ON_C\..\Toolbar\WebBrowser: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3C} - No CLSID value found. O3 - HKU\ddd_ON_C\..\Toolbar\WebBrowser: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No CLSID value found. O4 - HKU\ddd_ON_C..\Run: [A423B81A] C:\WINDOWS\System32\EC7D84EAA423B81AB220.exe File not found O2 - BHO: (no name) - {8984B388-A5BB-4DF7-B274-77B879E179DB} - No CLSID value found. :Reg [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-

Klikasz Wykonaj skrypt, później Sprzątanie

Przeczyść dysk oraz rejestr CCleaner

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport (po uruchomieniu odrzuć okres testowy)

Odinstaluj starą wersję czytnika .PDF:

Adobe Reader 9.5.1 - Polish

i zainstaluj najnowszą

http://www.instalki.pl/programy/downloa ... eader.html

przez **mm13** » 09 Maj 2012, 20:42

srypt wykonany
http://www.wklej.eu/index.php?id=0922e20c8d
zaraz zacznę sprzątać ielkie dzięk

przez **kominekl** » 09 Maj 2012, 20:43

Nie zapomnij tylko o Malwarebytes.

Zablokowany komp przez wirus udający policję

Zablokowany komp przez wirus udający policję

Re: zablokowany komp przez virus

Re: Zablokowany komp przez virus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Re: Zablokowany komp przez wirus udający policję

Kto jest na forum