problem z win32zbot

[marecki041066]

wittam prosze o sprawdzenie loga http://www.wklej.eu/index.php?id=d26f171e51
http://www.wklej.eu/index.php?id=f5b65780ff

[mateo8898]

Dorzuć jeszcze brakujący log z TDSSKiller otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p120292
Brak także drugiego logu z OTL (Extras.txt), uzupełnij.

Odinstaluj Babylon Toolbar, Ask Toolbar. Następnie:

Uruchom OTL w oknie Własne opcje skanowania/skrypt (Custom Scans/Fixes) wklej:

Kod: Zaznacz wszystko

:OTL
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: \"URL\" = http://search.bearshare.com/web?src=ieb&q={searchTerms}
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://mystart.incredimail.com [binary data]
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No CLSID value found
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: \"URL\" = http://search.babylon.com/?q={searchTerms}&AF=108603&babsrc=SP_ss&mntrId=56e24bc0000000000000761a04d274c4
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{8B63A8D6-BBED-4341-8867-790E5F524C96}: \"URL\" = http://mystart.incredimail.com/?search={searchTerms}&loc=search_box_fs
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: \"URL\" = http://search.bearshare.com/web?src=ieb&q={searchTerms}
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: \"URL\" = http://mystart.incredimail.com/?search={searchTerms}&loc=search_box&a=6PPZ3O9A6k
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
[2011/10/06 23:46:34 | 000,000,000 | ---D | M] (\"Ask Toolbar\") -- C:\Users\MARECZEK I BEATKA\AppData\Roaming\Mozilla\Firefox\Profiles\ev049opd.default\extensions\[email protected]
[2011/11/26 18:49:33 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2010/04/12 14:01:54 | 000,002,476 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\BearShareWebSearch.xml
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\ProgramData\Gadu-Gadu 10\_userdata\ggbho.2.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
[2012/03/28 15:59:06 | 000,000,000 | ---D | C] -- C:\Users\MARECZEK I BEATKA\AppData\Local\qfsxsuae
[2012/03/30 19:23:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/03/30 19:14:17 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/03/30 18:57:00 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ApnUpdater"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALLUpdate"=-
"Odkurzacz-MCD"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt (Run Fix). Dajesz log z usuwania + nowe logi z OTL.

[marecki041066]

http://www.wklej.eu/index.php?id=c198a160c0
http://www.wklej.eu/index.php?id=7c6d71a18d

[marecki041066]

http://www.wklej.eu/index.php?id=156ad593c9
http://www.wklej.eu/index.php?id=8e1d1e963a
sorki ale po zrobieniu skryptu zrestartowalem komp i log (Extras.txt) po prostu zostal usuniety z kosza
z gory dzieki za szybka odpowiedz

[kominekl]

Odinstaluj Bing Bar, Google Toolbar, IncrediMail, HiJackThis, Ask Toolbar, Babylon toolbar, MediaBar, Yahoo! Detect i MSN Toolbar.

Następnie uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko

:OTL

IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5732z&r=27360510f245l0414z155t44m2d948
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5732z&r=27360510f245l0414z155t44m2d948
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5732z&r=27360510f245l0414z155t44m2d948
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5732z&r=27360510f245l0414z155t44m2d948
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5732z&r=27360510f245l0414z155t44m2d948
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_en
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={39E5F38A-A580-4554-9E6C-8004CEBCC780}&mid=bed1c9d4825147d19490a113f0f93ccf-d38d83c438357d626fa90faa5ba5f5e565cdb30d&lang=pl&ds=AVG&pr=fr&d=2011-11-08 17:01:18&v=10.0.0.7&sap=dsp&q={searchTerms}
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll File not found
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)

:Files
C:\Program Files (x86)\Google\Update
C:\ProgramData\TEMP
C:\Users\MARECZEK I BEATKA\AppData\Local\setup.exe
C:\Users\MARECZEK I BEATKA\Desktop\HiJackThis.lnk
C:\Windows\tasks\*.job

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL + log z Autoruns otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p138589.

[marecki041066]

http://www.wklej.eu/index.php?id=464f528da6

http://www.wklej.eu/index.php?id=662d3cc597
http://www.wklej.eu/index.php?id=ae1ff06958

http://www64.zippyshare.com/v/74886232/file.html

[kominekl]

W Autoruns odznacz, a następnie usuń (co się będzie dało) kolejno wpisy rdpclip, IAAnotif, IgfxTray, mwlDaemon, Persistence, RtHDVCpl, ArcadeDeluxeAgent, EgisTecLiveUpdate, LManager, PlayMovie, Microsoft Windows, Microsoft Windows, DAEMON Tools Lite, TomTomHOME.exe, WinRAR32, WinRAR32, WinRAR32, WinRAR32, WinRAR32, Windows Live ID Sign-in Helper, Java(tm) Plug-In 2 SSV Helper, Skype Browser Helper, Windows Live ID Sign-in Helper, wszystko z zakładki Task Scheduler, Greg_Service, SkypeUpdate, Updater Service, WinDefend, GEARAspiWDM, StarOpen i wszystki File Not Found z zakładki HKLM\Software\Wow6432Node\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance.

Następnie uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko

:OTL

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll File not found
O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files (x86)\BearShare Applications\MediaBar\DataMngr\IEBHO.dll File not found
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKU\S-1-5-21-4057924615-176739315-2172617089-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL.