Atak wirusów ramnit h

Dla specjalistów Bezpieczeństwo
#1

Witam wogóle nie znam się na komputerach ,tydzień temu mialam zmasowany atak wirusów i od tej pory caly czas atakują , nie mogę wlączyć internetu prze IE i nie można wybrać punktu przywracania systemu, a przez google chrome tak Pozwole sobie dolączyć log z otl na czym też się nie znam i nie wiem co to wogóle jest. Pozdrawiam i prosze o pomoc

OTL logfile created on: 2011-04-07 20:50:14 - Run 2

OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Właściciel\Moje dokumenty\Downloads

Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1 014,00 Mb Total Physical Memory | 481,00 Mb Available Physical Memory | 47,00% Memory free

2,00 Gb Paging File | 2,00 Gb Available in Paging File | 87,00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 17,73 Gb Total Space | 5,15 Gb Free Space | 29,06% Space Free | Partition Type: NTFS

Drive D: | 19,52 Gb Total Space | 18,72 Gb Free Space | 95,91% Space Free | Partition Type: NTFS

Computer Name: W-DDBFDAE8524A4 | User Name: Właściciel | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011-04-07 20:49:06 | 000,580,608 | ---- | M] (OldTimer Tools) – C:\Documents and Settings\Właściciel\Moje dokumenty\Downloads\OTL (2).exe

PRC - [2011-03-23 19:49:21 | 001,004,088 | ---- | M] (Google Inc.) – C:\Program Files\Google\Chrome\Application\chrome.exe

PRC - [2011-01-12 16:41:42 | 000,810,144 | ---- | M] (ESET) – C:\Program Files\ESET\ESET Smart Security\ekrn.exe

PRC - [2011-01-12 16:41:24 | 002,219,184 | ---- | M] (ESET) – C:\Program Files\ESET\ESET Smart Security\egui.exe

PRC - [2008-04-14 21:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe

PRC - [2007-02-25 22:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

PRC - [2004-03-04 17:46:24 | 000,172,032 | ---- | M] (HP) – C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

PRC - [2004-02-18 19:55:28 | 000,049,152 | ---- | M] (Hewlett-Packard Company) – C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe

PRC - [2002-08-29 10:38:00 | 000,353,792 | ---- | M] (FUJITSU LIMITED) – C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe

PRC - [2002-08-27 12:01:06 | 000,061,440 | ---- | M] (FUJITSU LIMITED) – C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe

========== Modules (SafeList) ==========

MOD - [2011-04-07 20:49:06 | 000,580,608 | ---- | M] (OldTimer Tools) – C:\Documents and Settings\Właściciel\Moje dokumenty\Downloads\OTL (2).exe

MOD - [2010-08-23 18:12:53 | 001,054,208 | ---- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011-01-12 16:44:02 | 000,033,584 | ---- | M] (ESET) [On_Demand | Stopped] – C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe – (EhttpSrv)

SRV - [2011-01-12 16:41:42 | 000,810,144 | ---- | M] (ESET) [Auto | Running] – C:\Program Files\ESET\ESET Smart Security\ekrn.exe – (ekrn)

SRV - [2007-02-25 22:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe – (TOSHIBA Bluetooth Service)

========== Driver Services (SafeList) ==========

DRV - [2010-12-21 15:04:06 | 000,141,264 | ---- | M] (ESET) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\eamon.sys – (eamon)

DRV - [2010-12-21 15:04:06 | 000,115,008 | ---- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\ehdrv.sys – (ehdrv)

DRV - [2010-12-21 13:47:38 | 000,134,000 | ---- | M] (ESET) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\epfw.sys – (epfw)

DRV - [2010-12-21 13:47:38 | 000,033,120 | ---- | M] (ESET) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\epfwndis.sys – (Epfwndis)

DRV - [2010-08-03 12:28:36 | 000,055,256 | ---- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\epfwtdi.sys – (epfwtdi)

DRV - [2008-04-13 23:26:08 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkipx.sys – (NwlnkIpx)

DRV - [2008-04-13 23:23:10 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nmnt.sys – (nm)

DRV - [2007-06-11 15:25:28 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tosrfusb.sys – (tosrfusb)

DRV - [2007-05-24 15:27:30 | 000,064,000 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tosrfcom.sys – (Tosrfcom)

DRV - [2007-04-24 14:20:06 | 000,113,920 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tosrfbd.sys – (tosrfbd)

DRV - [2007-03-01 17:53:10 | 000,073,728 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Tosrfhid.sys – (Tosrfhid)

DRV - [2007-01-22 11:43:26 | 000,053,376 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\TosRfSnd.sys – (TosRfSnd)

DRV - [2006-11-20 18:55:16 | 000,036,480 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tosrfbnp.sys – (tosrfbnp)

DRV - [2006-10-10 20:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tosporte.sys – (tosporte)

DRV - [2006-06-26 00:00:00 | 002,206,720 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\w29n51.sys – (w29n51) Sterownik karty Intel®

DRV - [2005-01-07 06:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tosrfnds.sys – (tosrfnds)

DRV - [2004-10-18 15:08:00 | 000,005,632 | ---- | M] (Fujitsu Limited) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\FUJ02E1.sys – (FUJ02E1)

DRV - [2004-08-05 00:00:00 | 000,121,344 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\b57xp32.sys – (b57w2k)

DRV - [2004-08-04 13:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnknb.sys – (NwlnkNb)

DRV - [2004-08-04 13:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkspx.sys – (NwlnkSpx)

DRV - [2004-07-06 00:00:00 | 001,267,724 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)

DRV - [2004-01-06 00:00:00 | 000,256,688 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\stac97.sys – (STAC97) Audio Driver (WDM)

DRV - [2003-10-08 10:11:30 | 000,011,831 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\A302.sys – ({E6759E0C-470B-44DC-A4A1-627E68BB3A85})

DRV - [2002-08-28 10:45:32 | 000,018,688 | ---- | M] (FUJITSU LIMITED) [Kernel | Auto | Running] – C:\Program Files\Fujitsu\BtnHnd\BtnHnd.sys – (BtnHnd)

DRV - [2001-10-26 19:07:38 | 000,036,425 | ---- | M] (SMC) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\smcirda.sys – (SMCIRDA)

DRV - [2001-08-01 21:00:22 | 000,005,248 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\fuj02b1.sys – (FUJ02B1)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyEnable” = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyEnable” = 0

IE - HKU\S-1-5-21-1708537768-1383384898-1202660629-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

IE - HKU\S-1-5-21-1708537768-1383384898-1202660629-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyEnable” = 0

========== FireFox ==========

FF - HKLM\software\mozilla\Thunderbird\Extensions\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2011-04-01 18:14:24 | 000,000,000 | —D | M]

[2011-03-28 17:41:56 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\rvvs6e5n.default\extensions

[2011-03-28 17:41:56 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\rvvs6e5n.default\extensions{20a82645-c095-46ed-80e3-08825760534b}

File not found (No name found) – C:\DOCUMENTS AND SETTINGS\WĹ‚AĹ›CICIEL\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\RVVS6E5N.DEFAULT\EXTENSIONS{20A82645-C095-46ED-80E3-08825760534B}

[2010-11-04 19:47:00 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2004-08-04 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)

O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found.

O4 - HKLM…\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)

O4 - HKLM…\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Company)

O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe (HP)

O4 - HKLM…\Run: [KernelFaultCheck] File not found

O4 - HKLM…\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED)

O4 - HKLM…\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED)

O4 - HKLM…\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)

O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O7 - HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1708537768-1383384898-1202660629-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc … tor/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microso … 6218519985 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s … wflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\cetihpz - No CLSID value found

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - File not found

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - File not found

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - File not found

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - File not found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - File not found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - File not found

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Program Files\cppofwya\kvhbpwiq.exe) - File not found

O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)

O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009-12-14 14:36:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT – [NTFS]

O32 - AutoRun File - [2011-04-02 08:59:08 | 000,000,000 | —D | M] - C:\Autorun.inf – [NTFS]

O32 - AutoRun File - [2011-04-02 08:59:08 | 000,000,000 | —D | M] - D:\Autorun.inf – [NTFS]

O33 - MountPoints2{2797dd90-e146-11df-8669-000b5d62011b}\Shell - “” = AutoRun

O33 - MountPoints2{2797dd90-e146-11df-8669-000b5d62011b}\Shell\AutoRun\command - “” = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (MACHINE BootExecut) - File not found

O35 - HKLM…comfile [open] – “%1” %*

O35 - HKLM…exefile [open] – “%1” %*

O37 - HKLM…com [@ = comfile] – “%1” %*

O37 - HKLM…exe [@ = exefile] – “%1” %*

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^desktop.ini - - File not found

MsConfig - State: “system.ini” - 0

MsConfig - State: “win.ini” - 0

MsConfig - State: “bootini” - 0

MsConfig - State: “services” - 0

MsConfig - State: “startup” - 2

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: nm - C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)

SafeBootNet: nm.sys - C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

========== Files/Folders - Created Within 30 Days ==========

[2011-04-05 23:02:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\DoctorWeb

[2011-04-05 00:09:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Dane aplikacji\Malwarebytes

[2011-04-05 00:09:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2011-04-05 00:09:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Menu Start\Programy\Malwarebytes’ Anti-Malware

[2011-04-05 00:09:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes

[2011-04-05 00:08:59 | 000,020,952 | ---- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys

[2011-04-05 00:08:59 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes’ Anti-Malware

[2011-04-04 19:02:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Dane aplikacji\ArcaBit

[2011-04-04 16:51:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Dane aplikacji\ArcaVirMicroScan

[2011-04-02 08:59:08 | 000,000,000 | —D | C] – C:\Autorun.inf

[2011-04-02 08:58:43 | 001,081,616 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSCOMCTL.OCX

[2011-04-02 08:58:41 | 000,000,000 | —D | C] – C:\Program Files\WormBlaster Software ™

[2011-04-01 23:28:34 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt

[2011-04-01 18:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\ESET

[2011-04-01 18:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Dane aplikacji\ESET

[2011-04-01 18:15:54 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET

[2011-04-01 18:14:20 | 000,000,000 | —D | C] – C:\Program Files\ESET

[2011-04-01 18:14:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Menu Start\Programy\ESET

[2011-04-01 18:14:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dane aplikacji\ESET

[2011-04-01 16:19:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Pulpit\Nowy folder

[2011-03-29 22:37:43 | 000,000,000 | —D | C] – C:\WINDOWS\pss

[2011-03-29 22:27:04 | 000,000,000 | —D | C] – C:\WINDOWS\System32\GroupPolicy

[2011-03-28 18:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dane aplikacji\Backup

[2011-03-28 18:14:39 | 000,000,000 | —D | C] – C:\Program Files\a-squared Free

[2011-03-28 17:40:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Mozilla

[2011-03-28 17:40:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla

[2011-03-28 16:50:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\Help

[2011-03-28 16:50:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Dane aplikacji\Help

[2011-03-28 15:38:05 | 000,000,000 | —D | C] – C:\Documents and Settings\Właściciel\Pulpit\Nieużywane skróty pulpitu

[2011-03-28 14:23:16 | 000,000,000 | —D | C] – C:\Program Files\cppofwya

[3 C:\WINDOWS*.tmp files -> C:\WINDOWS*.tmp ->]

[1 C:\WINDOWS\System32*.tmp files -> C:\WINDOWS\System32*.tmp ->]

========== Files - Modified Within 30 Days ==========

[2011-04-07 20:24:02 | 000,001,044 | ---- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2011-04-06 11:41:05 | 000,013,646 | ---- | M] () – C:\WINDOWS\System32\wpa.dbl

[2011-04-06 11:40:43 | 000,001,040 | ---- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2011-04-06 11:40:37 | 000,002,048 | ---- | M] () – C:\WINDOWS\bootstat.dat

[2011-04-05 09:53:33 | 000,000,211 | ---- | M] () – C:\boot.ini

[2011-04-05 07:28:57 | 000,096,664 | ---- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT

[2011-04-05 00:09:05 | 000,000,784 | ---- | M] () – C:\Documents and Settings\All Users\Pulpit\Malwarebytes’ Anti-Malware.lnk

[2011-04-02 17:59:25 | 000,000,075 | ---- | M] () – C:\Documents and Settings\Właściciel\default.pls

[2011-04-02 17:59:00 | 000,000,069 | ---- | M] () – C:\WINDOWS\NeroDigital.ini

[2011-04-01 23:28:36 | 000,500,540 | ---- | M] () – C:\WINDOWS\System32\perfh015.dat

[2011-04-01 23:28:36 | 000,441,458 | ---- | M] () – C:\WINDOWS\System32\perfh009.dat

[2011-04-01 23:28:36 | 000,089,036 | ---- | M] () – C:\WINDOWS\System32\perfc015.dat

[2011-04-01 23:28:36 | 000,071,394 | ---- | M] () – C:\WINDOWS\System32\perfc009.dat

[2011-04-01 17:05:46 | 000,001,729 | ---- | M] () – C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk

[2011-03-29 11:51:13 | 000,001,843 | ---- | M] () – C:\WINDOWS\System32\AUTOEXEC.NT

[2011-03-28 18:28:54 | 000,002,596 | ---- | M] () – C:\WINDOWS\System32\CONFIG.NT

[2011-03-09 15:09:19 | 000,001,355 | ---- | M] () – C:\WINDOWS\imsins.BAK

[3 C:\WINDOWS*.tmp files -> C:\WINDOWS*.tmp ->]

[1 C:\WINDOWS\System32*.tmp files -> C:\WINDOWS\System32*.tmp ->]

========== Files Created - No Company Name ==========

[2011-04-05 00:09:05 | 000,000,784 | ---- | C] () – C:\Documents and Settings\All Users\Pulpit\Malwarebytes’ Anti-Malware.lnk

[2011-04-01 17:05:46 | 000,001,729 | ---- | C] () – C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk

[2011-02-15 15:08:59 | 000,000,097 | ---- | C] () – C:\WINDOWS\WirelessFTP.INI

[2010-12-19 19:12:49 | 000,000,025 | ---- | C] () – C:\WINDOWS\winroc.ini

[2010-10-26 14:01:37 | 000,000,069 | ---- | C] () – C:\WINDOWS\NeroDigital.ini

[2010-10-20 15:49:32 | 000,010,754 | ---- | C] () – C:\WINDOWS\hpdj3740.ini

[2010-10-10 07:40:39 | 000,029,696 | ---- | C] () – C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010-10-05 14:52:46 | 000,165,376 | ---- | C] () – C:\WINDOWS\System32\unrar.dll

[2009-12-14 17:47:01 | 000,000,135 | ---- | C] () – C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\fusioncache.dat

[2009-12-14 16:47:15 | 000,000,000 | ---- | C] () – C:\WINDOWS\tosOBEX.INI

[2009-12-14 16:18:07 | 000,004,293 | ---- | C] () – C:\WINDOWS\ODBCINST.INI

[2009-12-14 16:16:46 | 000,096,664 | ---- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

[2009-12-14 14:40:01 | 000,002,048 | ---- | C] () – C:\WINDOWS\bootstat.dat

[2009-12-14 14:33:22 | 000,021,856 | ---- | C] () – C:\WINDOWS\System32\emptyregdb.dat

[2008-04-14 22:16:20 | 000,001,804 | ---- | C] () – C:\WINDOWS\System32\Dcache.bin

[2007-06-21 11:49:24 | 000,118,784 | ---- | C] () – C:\WINDOWS\System32\TosBtAcc.dll

[2006-12-31 06:57:08 | 000,004,569 | ---- | C] () – C:\WINDOWS\System32\secupd.dat

[2005-07-22 22:30:18 | 000,065,536 | ---- | C] () – C:\WINDOWS\System32\TosCommAPI.dll

[2004-08-04 13:00:00 | 013,107,200 | ---- | C] () – C:\WINDOWS\System32\oembios.bin

[2004-08-04 13:00:00 | 000,673,088 | ---- | C] () – C:\WINDOWS\System32\mlang.dat

[2004-08-04 13:00:00 | 000,500,540 | ---- | C] () – C:\WINDOWS\System32\perfh015.dat

[2004-08-04 13:00:00 | 000,441,458 | ---- | C] () – C:\WINDOWS\System32\perfh009.dat

[2004-08-04 13:00:00 | 000,313,828 | ---- | C] () – C:\WINDOWS\System32\perfi015.dat

[2004-08-04 13:00:00 | 000,272,128 | ---- | C] () – C:\WINDOWS\System32\perfi009.dat

[2004-08-04 13:00:00 | 000,218,003 | ---- | C] () – C:\WINDOWS\System32\dssec.dat

[2004-08-04 13:00:00 | 000,089,036 | ---- | C] () – C:\WINDOWS\System32\perfc015.dat

[2004-08-04 13:00:00 | 000,071,394 | ---- | C] () – C:\WINDOWS\System32\perfc009.dat

[2004-08-04 13:00:00 | 000,046,258 | ---- | C] () – C:\WINDOWS\System32\mib.bin

[2004-08-04 13:00:00 | 000,034,990 | ---- | C] () – C:\WINDOWS\System32\perfd015.dat

[2004-08-04 13:00:00 | 000,028,626 | ---- | C] () – C:\WINDOWS\System32\perfd009.dat

[2004-08-04 13:00:00 | 000,004,461 | ---- | C] () – C:\WINDOWS\System32\oembios.dat

[2004-08-04 13:00:00 | 000,000,741 | ---- | C] () – C:\WINDOWS\System32\noise.dat

[2004-03-17 15:12:48 | 000,000,362 | ---- | C] () – C:\WINDOWS\hpfins_s04_main.dat

[2004-03-17 15:11:51 | 000,005,428 | ---- | C] () – C:\WINDOWS\hpfmdl_s04_main.dat

========== LOP Check ==========

[2010-12-15 19:25:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dane aplikacji\Alwil Software

[2011-03-28 18:37:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dane aplikacji\Backup

[2011-04-01 18:14:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dane aplikacji\ESET

[2011-04-04 19:02:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Właściciel\Dane aplikacji\ArcaBit

[2011-04-04 19:16:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Właściciel\Dane aplikacji\ArcaVirMicroScan

[2011-04-01 18:17:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Właściciel\Dane aplikacji\ESET

[2010-12-01 23:03:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Właściciel\Dane aplikacji\OpenRocket

[2011-03-04 16:55:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Właściciel\Dane aplikacji\PhotoScape

========== Purity Check ==========

========== Custom Scans ==========

< %systemdrive%*.* >

[2009-12-14 14:36:47 | 000,000,000 | ---- | M] () – C:\AUTOEXEC.BAT

[2011-04-05 09:53:33 | 000,000,211 | ---- | M] () – C:\boot.ini

[2004-08-04 13:00:00 | 000,004,952 | ---- | M] () – C:\Bootfont.bin

[2009-12-14 14:36:47 | 000,000,000 | ---- | M] () – C:\CONFIG.SYS

[2011-03-02 08:46:15 | 000,007,218 | ---- | M] () – C:\hpfr3740.log

[2009-12-14 14:36:47 | 000,000,000 | ---- | M] () – C:\IO.SYS

[2009-12-14 14:36:47 | 000,000,000 | ---- | M] () – C:\MSDOS.SYS

[2008-04-13 21:13:04 | 000,047,564 | ---- | M] () – C:\NTDETECT.COM

[2008-04-13 23:02:00 | 000,251,152 | ---- | M] () – C:\ntldr

[2011-04-06 11:40:35 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys

< MD5 for: AGP440.SYS >

[2008-04-14 22:09:56 | 020,110,420 | ---- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:agp440.sys

< MD5 for: ATAPI.SYS >

[2008-04-14 22:09:56 | 020,110,420 | ---- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008-04-14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\dllcache\atapi.sys

[2008-04-14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys

[2008-04-14 02:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys

< MD5 for: BEEP.SYS >

[2004-08-04 13:00:00 | 000,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 – C:\WINDOWS\system32\dllcache\beep.sys

[2004-08-04 13:00:00 | 000,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 – C:\WINDOWS\system32\drivers\beep.sys

< MD5 for: CDROM.SYS >

[2008-04-14 22:09:56 | 020,110,420 | ---- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys

[2008-04-13 23:10:48 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE – C:\WINDOWS\system32\drivers\cdrom.sys

< MD5 for: NDIS.SYS >

[2008-04-13 23:50:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D – C:\WINDOWS\system32\dllcache\ndis.sys

[2008-04-13 23:50:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D – C:\WINDOWS\system32\drivers\ndis.sys

< MD5 for: USERINIT.EXE >

[2008-04-14 21:51:46 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=2A5B37D520508BE6570A3EA79695F5B5 – C:\WINDOWS\system32\dllcache\userinit.exe

[2008-04-14 21:51:46 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=2A5B37D520508BE6570A3EA79695F5B5 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >

[2008-04-14 21:51:50 | 000,510,464 | ---- | M] (Microsoft Corporation) MD5=51FD2E13D723857B9CA239AE77150F48 – C:\WINDOWS\system32\dllcache\winlogon.exe

[2008-04-14 21:51:50 | 000,510,464 | ---- | M] (Microsoft Corporation) MD5=51FD2E13D723857B9CA239AE77150F48 – C:\WINDOWS\system32\winlogon.exe

< End of report >

#2

Witam.

  1. Pobrać za pomocą niezainfekowanego PC - Dr. Web Anti-virus. Do pobrania z http://www.dobreprogramy.pl/Dr.WEB-Cure … 12976.html, lub z http://www.freedrweb.com/cureit/?lng=en. Skanowanie wykonać przy odłączonym dostępie do internetu.

  2. Zainstalować Comodo Personal Firewall - http://www.dobreprogramy.pl/Comodo-Pers … 20399.html

  3. Wykonać ponowną instalację NOD32.

  1. http://www.dobreprogramy.pl/Comodo-Inte … 12952.html - przed instalacją odinstalować, usunąć NOD32.
#3

Z wirusem ramnit poradził sobie u mnie Kaspersky Virus Removal Tool. Do pobrania z DP.

#4

nie wiem czy dobrze wklejam te logi jeżeli coś nie tak to sorki

http://wklej.org/id/508800/

http://wklej.org/id/508807/

#5

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

potem nowy log OTL robiony opcją Run Scan (Skanuj)

:slight_smile:

#6

W przypadki infekcji wirusami ramnit skanowanie najlepiej wykonać za pomocą Kaspersky Rescude Disk. Obraz ISO na CD do pobrania z http://support.kaspersky.com/pl/faq/?qid=208282170. Wykonywać pełny skan tak długo, aż nic nie wykryje. Przygotować drugą płytę z Dr.Web LiveCD - http://www.vista.pl/download/1820_dr_we … 5_0_0.html. Powtórzyć skanowanie całego dysku, leczenie wszystkiego co możliwe, reszta do usunięcia. Skanować tak długo, aż nic nie znajdzie.

PS. Można też skorzystać ze skanerów:

  1. Dr.WEB do pobrania z http://www.dobreprogramy.pl/Dr.WEB-Cure … 12976.html

  2. Kaspersky-Virus-Removal do pobrania z http://www.dobreprogramy.pl/Kaspersky-V … 12768.html

#7

Witam nie wiem czy dobrze dostosowuje się do instrukcji dolączam nowe logi

raport z usuwania http://wklej.org/id/509725/

log otl http://wklej.org/id/509729/

Dziękuje za pomoc pozdrawiam

#8

proszę powtórzyć usuwanie

w tekście skryptu musi być dwukropek przed OTL (:OTL)

:slight_smile:

#9

Witam teraz chyba poprawnie zrobione usuwanie proszę o wyrozumialość ale jestem początkującą osobą

http://wklej.org/id/510158/

#10

Teraz dobrze.Nowe logi z OTL.

#11

Jeszcze raz podaje usuwanie http://wklej.org/id/510474/

nowe logi http://wklej.org/id/510477/

http://wklej.org/id/510478/

Pozdrawiam

#12

W porządku.W OTL użyj opcji Sprzątanie.Wyłącz i włącz przywracanie systemu na wszystkich dyskach:http://support.microsoft.com/kb/310405/pl

http://www.vista.pl/artykuly/11250_przy … vista.html

#13

Rozumiem że przed sprzątaniem wylączyć przywracanie systemu a po sprzątaniu wlączyć. Czy po tych czynnościach wszystko będzie w porządku , czy coś jeszcze potem będę musiala zrobić. Dziękuje i pozdrawiam

#14

Najpierw Sprzątanie a następnie wyłączyć i włączyć przywracanie systemu.

#15

Witam, zrobilam to wszystko, czy coś jeszcze należy zrobić. Pozdrawiam