Dziwne wysyłanie maili

Witam,
Jakiś czas temu miałam wirusa, który wysyłał na facebooku wiadomości do znajomych z zawirusowanym linkiem. Myślalam, że się pozbyłam tego wirusa, ale teraz mam podobny problem tyle, że z pocztą. Wirus wysłał maile do znajomych z kolejnym linkiem. Zauważyłam też, że zmienia się mi wyszukiwarka na yahoo. Za każdym razem zmieniam na google ale to nic nie daje. Próbowałam zeskanować kompa, ale otl i gmer zawieszają się.
Co mam zrobić?? mam windows 7

Podaj logi z OTL z trybu awaryjnego otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967.html#p107754

otl: http://www.wklej.eu/index.php?id=5deaaabcf0
extras: http://www.wklej.eu/index.php?id=377e89aa5d

Odinstaluj PC Tools Spyware Doctor i YouTube Downloader Toolbar.

Następnie uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod:

:OTL

IE - HKU\S-1-5-21-757109552-409895395-3633954361-1001\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKU\S-1-5-21-757109552-409895395-3633954361-1001\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Esterka\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Esterka\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\Firefox\ [2011-11-03 18:07:56 | 000,000,000 | ---D | M]
CHR - default_search_provider: Yahoo! (Enabled)
CHR - default_search_provider: search_url = http://search.yahoo.com/search?fr=chr-greentree_gc&ei=utf-8&ilc=12&type=937811&p={searchTerms}
CHR - plugin: Google Update (Enabled) = C:\Users\Esterka\AppData\Local\Google\Update\1.3.21.71\npGoogleUpdate3.dll
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
@Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:430C6D84

:Files
C:\Program Files (x86)\Google\Update
C:\Users\Esterka\AppData\Local\Google\Update
C:\Program Files (x86)\Common Files\Spigot
C:\ProgramData\Norton
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-757109552-409895395-3633954361-1001UA.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-757109552-409895395-3633954361-1001Core.job

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DATAMNGR"=-
"PWRISOVM.EXE"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

log z usuwania: http://wklej.eu/index.php?id=09f55645ac
otl: http://wklej.eu/index.php?id=3462c37804
extras: http://wklej.eu/index.php?id=1c04f289b1

Uruchom OTL w oknie Własne opcje skanowania/ skrypt wklej:

:OTL

O3 - HKU\S-1-5-21-757109552-409895395-3633954361-1001\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O4 - HKU\S-1-5-21-757109552-409895395-3633954361-1001..\Run: [Google Update] "C:\Users\Esterka\AppData\Local\Google\Update\GoogleUpdate.exe" /c File not found
O18 - Protocol\Handler\ms-help - No CLSID value found
O20 - AppInit_DLLs: (c:\progra~2\wi3c8a~1\datamngr\datamngr.dll) -c:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (c:\progra~2\wi3c8a~1\datamngr\iebho.dll) -c:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
@Alternate Data Stream - 127 bytes C:\ProgramData\Temp:430C6D84
@Alternate Data Stream - 109 bytes C:\ProgramData\Temp:DFC5A2B2

:Files
C:\Users\Esterka\AppData\Local\Google
C:\Users\Esterka\AppData\Local\Threat Expert
C:\Program Files (x86)\PC Tools
C:\Program Files (x86)\Common Files\PC Tools
C:\ProgramData\PC Tools
C:\Users\Esterka\AppData\Roaming\AVG10

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

log z usuwania: http://wklej.eu/index.php?id=4e9d0c643a
otl: http://wklej.eu/index.php?id=0c5d0971f3
extras: http://wklej.eu/index.php?id=639bc48275

C:\Users\Esterka\AppData\Local\Google\CrashReports folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL\_locales\en folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL\_locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL\plugin folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL\content_scripts folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL\browser_action folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL\background folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188\CRX_INSTALL folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_29188 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_27419\CRX_INSTALL\_locales\en folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_27419\CRX_INSTALL\_locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_27419\CRX_INSTALL\plugin folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_27419\CRX_INSTALL\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_27419\CRX_INSTALL\background folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_27419\CRX_INSTALL folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_27419 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_25437\CRX_INSTALL folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_25437 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264\CRX_INSTALL\_locales\en folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264\CRX_INSTALL\_locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264\CRX_INSTALL\plugin folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264\CRX_INSTALL\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264\CRX_INSTALL\content_scripts folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264\CRX_INSTALL\background folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264\CRX_INSTALL folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp\scoped_dir_13264 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Temp folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\PepperFlash folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\User StyleSheets folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Plugin Data\Google Gears folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Plugin Data folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Media Cache folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Local Storage folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsOld folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\JumpListIcons folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\_locales\en folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\_locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\background folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\_locales\en folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\_locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\plugin folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\content_scripts folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\browser_action folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\background folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\zh folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\tr folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\ru folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\pt folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\it folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\fr folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\es folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\en folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\de folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales\ar folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\_locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\plugin folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\content_scripts folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\background folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\_locales\en folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\_locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\jquery\js folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\jquery\css\south-street\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\jquery\css\south-street folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\jquery\css folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\jquery folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0\images folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla\1.0.16_0 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Extensions folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\databases\http_www.filmweb.pl_0 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ajpgkpeckebdhofmmjfgcjjiiejpodla_0 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\databases folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default\Cache folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data\Default folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\User Data folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\plugins folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\Dictionaries folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\15.0.874.106\Locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\15.0.874.106\Installer folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\15.0.874.106\Extensions folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\15.0.874.106 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\14.0.835.202\Locales folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\14.0.835.202\Installer folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\14.0.835.202\Extensions folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application\14.0.835.202 folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome\Application folder moved successfully.
C:\Users\Esterka\AppData\Local\Google\Chrome folder moved successfully.
C:\Users\Esterka\AppData\Local\Google folder moved successfully.

Ajć. Tego nie chciałem usuwać... . Pomyliłem się w pisaniu skryptu. Wyjmij z C:\_OTL te wszystkie pliki i przywróć je tam gdzie były. Następnie podaj nowe logi. Przepraszam raz jeszcze za błąd.

ok co masz na myśli wyciągnąć i przywrócić tam gdzie były? co mam dokładnie zrobić? mam ten plik txt ale nie wiem jak je przywrócić...

Wchodzisz do folderu C:\_OTL i tam powinien znajdować się folder Google, przenieś go do C:\Users\Esterka\AppData\Local

zrobione
nowe logi
otl: http://wklej.eu/index.php?id=f7ded22e46
extras: http://wklej.eu/index.php?id=b1a0445473

W OTL Sprzątanie.
Zaktualizuj Internet Explorer do najnowszej wersji (nawet, jeśli Go nie używasz) http://www.instalki.pl/programy/downloa ... rer_9.html.
Przeczyść dysk i rejestr CCleaner`em https://www.instalki.pl/download/programy/windows/narzedzia/narzedzia-systemowe/ccleaner/.
Wykonaj pełne skanowanie Malwarebytes`em Anti-Malware https://www.instalki.pl/download/programy/windows/bezpieczenstwo/antyspyware/malwarebytes/, jeśli coś znajdzie usuń i daj raport.
Odinstaluj starą wersję programu do odczytu .PDF Adobe Reader 9.0.1 - Polish i zainstaluj najnowszą http://www.instalki.pl/programy/downloa ... eader.html.
Odinstaluj starą wersję Java`y Java(TM) 6 Update 29 i zainstaluj najnowszą http://www.instalki.pl/programy/downloa ... %29_6.html.

Anti-Malware nic nie wykrył. Wielkie dzięki! pozdrawiam

Witam ponownie, mój problem niestety nie zniknął dziś znowu poczta rozsyłała mi maile do wszystkich. Da się coś z tym zrobic? skoro ostatnie czyszczenie nie pomogło

Wyjątkowo zastosuj Combofix `a otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967.html#p73687