Komputer taty strasznie zamulony

przez **ziomekk3214** » 19 Sie 2012, 12:37

witam prosze o sprawdzenie logów mojego taty ma strasznie zamulony komputer.
otl.txt: http://www.wklej.eu/index.php?id=046fe19ea3
extras.txt: http://www.wklej.eu/index.php?id=825cbde454
gemr: http://www.wklej.eu/index.php?id=c299057c43

przez **kominekl** » 19 Sie 2012, 21:59

O33 - MountPoints2\{3fc27a7a-63ff-11df-8674-00037ab6da38}\Shell\AutoRun\command - "" = H:\33r.exe
O33 - MountPoints2\{3fc27a7a-63ff-11df-8674-00037ab6da38}\Shell\open\Command - "" = H:\33r.exe

Z podłączonymi pamięciami przenośnymi użyj UsbFix otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p117012 z opcji Deletion i podaj utworzony log.

"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"UnityWebPlayer" = Unity Web Player

Odinstaluj to oprogramowanie za pomocą Revo Uninstaller`a

https://www.instalki.pl/download/programy/windows/narzedzia/narzedzia-systemowe/revo-uninstaller/ w trybie zaawansowanym (po wcześniejszym zaznaczeniu w Nim opcji

Pokazuj Elementy Systemowe).

Logi.

Uruchom OTL

w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko: :OTL SRV - File not found [Disabled | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - File not found [Disabled | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc -- (gupdatem) SRV - File not found [Disabled | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /svc -- (gupdate) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\TpChoice.sys -- (TpChoice) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (askl17fa) IE - HKLM\..\SearchScopes,DefaultScope = {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} IE - HKLM\..\SearchScopes\{496BF5E2-AC2D-4936-84EE-53B39E2A434D}: "URL" = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:*:IE-SearchBox&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7; IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7 IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/custom?domains=entretieneteds.to.md&q=&sitesearch=&client=pub-3439752189615153 IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.ask.com/?o=15161&l=dis [binary data] IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.hotspotshield.com/g/?c=h IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes,DefaultScope = {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=GLSV5&o=10168&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=GL&apn_dtid=YYYYYYYYPL&apn_uid=078995BA-20D1-4F56-A785-23033E6D6966&apn_sauid=A40828C2-BAF1-4E43-8B3B-89F0477FAD5A IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\{496BF5E2-AC2D-4936-84EE-53B39E2A434D}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA_en IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms} IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}: "URL" = http://search.hotspotshield.com/g/results.php?c=s&q={searchTerms} FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Hotspot Shield Private Search" FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.update: false FF - prefs.js..extensions.enabledItems: [email protected]:1.5.2 FF - prefs.js..extensions.enabledItems: [email protected]:1.0.0.736 FF - prefs.js..extensions.enabledItems: [email protected]:3.11.3.15590 FF - prefs.js..keyword.URL: "http://search.hotspotshield.com/g/results.php?c=s&q=" FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.53\npGoogleUpdate3.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.53\npGoogleUpdate3.dll File not found FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Wiesław\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) [2012-02-19 19:25:34 | 000,000,000 | ---D | M] (XfireXO Community Toolbar) -- C:\Users\Wiesław\AppData\Roaming\mozilla\Firefox\Profiles\nqxkrr74.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} [2011-05-23 17:34:19 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Wiesław\AppData\Roaming\mozilla\Firefox\Profiles\nqxkrr74.default\extensions\[email protected] [2010-12-10 20:48:36 | 000,002,569 | ---- | M] () -- C:\Users\Wiesław\AppData\Roaming\Mozilla\Firefox\Profiles\nqxkrr74.default\searchplugins\askcom.xml [2010-03-31 00:28:54 | 000,000,917 | ---- | M] () -- C:\Users\Wiesław\AppData\Roaming\Mozilla\Firefox\Profiles\nqxkrr74.default\searchplugins\conduit.xml [2010-07-21 17:29:14 | 000,002,059 | ---- | M] () -- C:\Users\Wiesław\AppData\Roaming\Mozilla\Firefox\Profiles\nqxkrr74.default\searchplugins\daemon-search.xml [2009-07-21 12:00:27 | 000,001,196 | ---- | M] () -- C:\Users\Wiesław\AppData\Roaming\Mozilla\Firefox\Profiles\nqxkrr74.default\searchplugins\winamp-search.xml O3 - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found O9 - Extra Button: eBay - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/4908-44618-9400-3/4 File not found O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found O9 - Extra Button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redirect-home?tag=Toshibaukbholink-21&site=home File not found O9 - Extra Button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL File not found O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) :Files C:\Program Files\Google\Update C:\Users\Wiesław\AppData\LocalLow\Unity C:\Users\Wiesław\Desktop\mbam-setup-1.62.0.1300.exe C:\Windows\tasks\*.* C:\Users\Wiesław\AppData\Local\Temp*.html C:\Users\Wiesław\AppData\Roaming\OpenCandy C:\Users\Wiesław\AppData\Roaming\Registry Mechanic C:\Users\Wiesław\AppData\Roaming\Unity :Reg [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptyflash] [clearallrestorepoints] [emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podaj log z ADWCleaner (z opcji Delete)

otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p139531 + log z TDSSKiller

otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p120292 + nowe logi z OTL + log z Autoruns

otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p138589.

przez **ziomekk3214** » 20 Sie 2012, 10:01

O33 - MountPoints2\{3fc27a7a-63ff-11df-8674-00037ab6da38}\Shell\AutoRun\command - "" = H:\33r.exe
O33 - MountPoints2\{3fc27a7a-63ff-11df-8674-00037ab6da38}\Shell\open\Command - "" = H:\33r.exe

co z tym mam zrobić

przez **bajbus** » 20 Sie 2012, 11:19

ziomekk3214 napisał(a):O33 - MountPoints2\{3fc27a7a-63ff-11df-8674-00037ab6da38}\Shell\AutoRun\command - "" = H:\33r.exe
O33 - MountPoints2\{3fc27a7a-63ff-11df-8674-00037ab6da38}\Shell\open\Command - "" = H:\33r.exe

co z tym mam zrobić

Z podlaczonymi pamieciami przenosnymi uzyj UsbFix otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p117012 podaj log z opcji deletion

przez **ziomekk3214** » 20 Sie 2012, 14:19

z usuwania: http://www.wklej.eu/index.php?id=9d6faf6812
otl.txt: http://www.wklej.eu/index.php?id=522b034655
extras.txt http://www.wklej.eu/index.php?id=0a4b1609a5
ADWCleaner: http://www.wklej.eu/index.php?id=dcafc756b4
TDSSKiller http://www.wklej.eu/index.php?id=ab25a8c380
Autoruns http://www30.zippyshare.com/v/56677264/file.html

przez **kominekl** » 20 Sie 2012, 17:45

Autoruns.

HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms

rdpclip

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

GrooveMonitor
IAAnotif
IgfxTray
KeNotify
Persistence
RtHDVCpl
Skytel
SVPWUTIL

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Bluetooth Manager.lnk

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components

Microsoft Windows Mail 7

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PC Suite Tray
TOSCDSPD

HKLM\SOFTWARE\Classes\Protocols\Handler

skype-ie-addon-data

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Wszystko.

Task Scheduler

Wszystko.

HKLM\System\CurrentControlSet\Services

IAANTMON RAID
IDriverT
Microsoft Office Groove Audit Service
odserv
ose
PnkBstrA
ServiceLayer
TNaviSrv
UleadBurningHelper
WinDefend
WMPNetworkSvc

HKLM\System\CurrentControlSet\Services

abdr2gk9
IpInIp
NwlnkFlt
NwlnkFwd

HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance

Orb RTSP Source Filter
RealAudio Decoder
RealMedia Source
RealMedia Splitter
RealVideo Decoder

USBFix.

Brak loga z użycia. Uzupełnij.

Logi.

Uruchom OTL

w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko: :OTL DRV - File not found [Kernel | On_Demand | Unknown] -- -- (abdr2gk9) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search bar = http://search.msn.com/spbasic.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/ IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\${searchCLSID}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe File not found O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\System32\winrnr.dll File not found :Files C:\UsbFix :Reg [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"=- [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"=- :Commands [emptyflash] [clearallrestorepoints] [emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL.

przez **ziomekk3214** » 20 Sie 2012, 17:49

usbfix: http://www.wklej.eu/index.php?id=a6293046be

przez **kominekl** » 20 Sie 2012, 18:02

ziomekk3214 napisał(a):usbfix: http://www.wklej.eu/index.php?id=a6293046be

OK. Wykonaj resztę instrukcji (w podanej wyżej kolejności).

przez **ziomekk3214** » 20 Sie 2012, 19:36

z usuwania http://www.wklej.eu/index.php?id=d396ca611f
otl.txt http://www.wklej.eu/index.php?id=e22ca505be
extras.txt http://www.wklej.eu/index.php?id=b525c5f99b

ps. nie działa mi klawiatura ani myszka wbudowane w laptopa

przez **kominekl** » 20 Sie 2012, 22:12

ps. nie działa mi klawiatura ani myszka wbudowane w laptopa

Masz jakieś sterowniki do tego? Bądź jakieś oprogramowanie?

Logi.

Uruchom OTL

w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko: :OTL DRV - File not found [Kernel | On_Demand | Unknown] -- -- (apg05aiv) IE - HKU\S-1-5-21-2307830453-1540185091-2890158083-1000\..\SearchScopes\${searchCLSID}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found. :Files C:\Users\Wiesław\Desktop\AutoRuns.arn :Commands [emptyflash] [clearallrestorepoints] [emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie w OTL

Sprzątanie.

Internet Explorer (Version = 8.0.6001.19298)

Zaktualizuj IE do najnowszej wersji (nawet, jeśli Go nie używasz)

.

"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 24

Odinstaluj i zainstaluj najnowszą wersję

http://www.instalki.pl/programy/downloa ... /Java.html.

"{AC76BA86-7AD7-1045-7B44-A70500000002}" = Adobe Reader 7.0.5 - Polish

Odinstaluj i zainstaluj najnowszą wersję

http://www.instalki.pl/programy/downloa ... eader.html.

"KLiteCodecPack_is1" = K-Lite Codec Pack 6.2.0 (Basic)

Odinstaluj i zainstaluj najnowszą wersję

https://www.instalki.pl/download/programy/windows/multimedia/kodeki/k-lite-codec-pack-full/.

"Mozilla Firefox 9.0.1 (x86 pl)" = Mozilla Firefox 9.0.1 (x86 pl)

Zaktualizuj Firefox`a do najnowszej wersji (Firefox

Pomoc

Sprawdź dostępność aktualizacji...).

Kroki Finalizujące.

Przeczyść dysk i rejestr CCleaner`em

https://www.instalki.pl/download/programy/windows/narzedzia/narzedzia-systemowe/ccleaner/.
Wykonaj pełne skanowanie Malwarebytes`em Anti-Malware (nie gódź się na wersję testową)

https://www.instalki.pl/download/programy/windows/bezpieczenstwo/antyspyware/malwarebytes/, jeśli coś znajdzie usuń i daj raport.

przez **ziomekk3214** » 20 Sie 2012, 22:17

nie mam nic

przez **ziomekk3214** » 21 Sie 2012, 11:40

z uswania http://www.wklej.eu/index.php?id=83ec8802fe
skan mbm nic nie wykazal

przez **mateo8898** » 21 Sie 2012, 12:02

Ten problem z klawiaturą był przed podaniem logów??

przez **ziomekk3214** » 21 Sie 2012, 12:09

nie po wkonaniu logów

przez **ziomekk3214** » 21 Sie 2012, 12:09

myszka wbudowana tez nie dziala

Komputer taty strasznie zamulony

Komputer taty strasznie zamulony

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Re: sprawdzenie logów

Kto jest na forum