Poszukiwanie keylogera

Cześć ,proszę o sprawdzenie logów , chcę się upewnić czy nie mam złośliwego oprogramowania:
Gmer: http://www.wklej.eu/index.php?id=0732423dba

Otl.txt http://www.wklej.eu/index.php?id=7b9c914b52
Extras.txt http://www.wklej.eu/index.php?id=dedb639c83

Jest infekcja.

Odinstaluj Browsers Protector. Następnie:

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
IE - HKU\S-1-5-21-920218767-2332886376-933549004-1000\..\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}: "URL" = http://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp
FF - prefs.js..browser.search.defaultenginename: "error"
FF - prefs.js..browser.search.order.1: "error"
FF - prefs.js..browser.search.selectedEngine: "error"
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found
FF - prefs.js..keyword.URL: "error"
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
O4 - HKLM..\RunOnce: [A-2049498538] C:\Users\Marcin\AppData\Roaming\A-2049498538.exe ()
O4 - HKU\S-1-5-21-920218767-2332886376-933549004-1000..\RunOnce: [A-2049498538] C:\Users\Marcin\AppData\Roaming\A-2049498538.exe ()
O4 - Startup: C:\Users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A-1274289992.exe ()
O4 - Startup: C:\Users\Marcin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A-2049498538.exe ()
O4 - Startup: C:\Users\Marcin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WTW.lnk = File not found
O4 - Startup: C:\Users\Tata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A-559831674.exe ()
O4 - Startup: C:\Users\Tomek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A-618373892.exe ()
[2013-01-25 06:42:47 | 000,471,343 | RHS- | M] () -- C:\DVEXT
[2012-11-09 18:00:41 | 083,023,306 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012-10-14 12:17:55 | 000,315,682 | ---- | C] () -- C:\Windows\SysWow64\slwc.exe
[2012-10-14 12:15:46 | 000,111,104 | ---- | C] () -- C:\Windows\SysWow64\Uharc.exe
[2012-10-14 12:15:46 | 000,008,636 | ---- | C] () -- C:\Windows\SysWow64\modifype.exe
[2012-07-22 19:30:40 | 000,000,051 | ---- | C] () -- C:\ProgramData\cgoowsqxnyyeeya
[2012-05-26 18:28:15 | 002,560,512 | ---- | C] () -- C:\Users\Marcin\AppData\Local\sox.exe
[2012-05-26 18:28:15 | 000,280,297 | ---- | C] () -- C:\Users\Marcin\AppData\Local\libgomp-1.dll
[2012-05-26 18:28:15 | 000,260,096 | ---- | C] () -- C:\Users\Marcin\AppData\Local\UnRAR.exe
[2012-05-26 18:28:15 | 000,094,208 | ---- | C] () -- C:\Users\Marcin\AppData\Local\zlib1.dll
[2012-05-26 18:28:15 | 000,078,336 | ---- | C] () -- C:\Users\Marcin\AppData\Local\Dec.exe

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Podajesz log z usuwania + nowe logi z OTL.

Po wykonaniu skrypta http://www.wklej.eu/index.php?id=eb84430ded
Nowe logi
otl.txt http://www.wklej.eu/index.php?id=90de2520b1
extras.txt http://www.wklej.eu/index.php?id=6dd66a59e6

Ładuj taki skrypt:

:OTL
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKCU\Software\MozillaPlugins\Firefox: File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
O4 - HKLM..\RunOnce: [A-2049498538] C:\Users\Marcin\AppData\Roaming\A-2049498538.exe ()
O4 - HKU\S-1-5-21-920218767-2332886376-933549004-1000..\RunOnce: [A-2049498538] C:\Users\Marcin\AppData\Roaming\A-2049498538.exe ()
O4 - Startup: C:\Users\Marcin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A-2049498538.exe ()

:Commands
[reboot]

Klikasz Wykonaj skrypt. Podajesz log z usuwania + nowe logi z OTL.