Prośba o sprawdzenie logów

[Devorious88]

Witam, tak jak w temacie - proszę o sprawdzenie logów i ewentualnej pomocy w zwalczeniu infekcji.

Logi z OTL:
Otl.txt - http://wklej.eu/index.php?id=6e33bf1c90
Extras.txt - http://wklej.eu/index.php?id=ee52ca4347

[Devorious88]

Niestety nie dodałem logów z GMER ponieważ w trakcie ich robienia wyskoczył mi blue screen ... Co mogę w tej sytuacji zrobić?
Czekam na odpowiedź.

[mateo8898]

W takiej sytuacji odpuść sobie Gmera.

W logach czysto, kosmetyka.

Odinstaluj: AVG Security Toolbar, McAfee Security Scan Plus. Następnie:

W ustawieniach Chrome zmień sobie wyszukiwarkę oraz stronę startową na np. google.pl

Następnie:

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe -- (vToolbarUpdater14.2.0)
SRV - File not found [Auto | Stopped] -- c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe -- (McAfee SiteAdvisor Service)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RtsUCcid.sys -- (USBCCID)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Rts516xIR.sys -- (RtsUIR)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.delta-search.com/?affID=119816&babsrc=HP_ss&mntrId=02ca24df000000000000001f162e9224
IE - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.com/?publisher=QuickOB&dpid=QuickOB&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=ds&q={searchTerms}&installDate=01/01/1970
IE - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.com/?publisher=QuickOB&dpid=QuickOB&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=ds&q={searchTerms}&installDate=01/01/1970
IE - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.com/?publisher=QuickOB&dpid=QuickOB&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=hp&installDate=01/01/1970
IE - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.com/?publisher=QuickOB&dpid=QuickOB&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=ds&q={searchTerms}&installDate=01/01/1970
IE - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.com/?publisher=QuickOB&dpid=QuickOB&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=ds&q={searchTerms}&installDate=01/01/1970
IE - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.com/?publisher=QuickOB&dpid=QuickOB&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=ds&q={searchTerms}&installDate=01/01/1970
FF - prefs.js..keyword.URL: "http://feed.snapdo.com/?publisher=QuickOB&dpid=QuickOB&co=PL&userid=c6c9664f-c6e9-4f84-b676-824ffa34efe9&searchtype=ds&installDate=01/01/1970&q="
[2013-06-23 09:50:02 | 000,000,000 | ---D | M] ("QuickShare Widget") -- C:\Users\Lenovo\AppData\Roaming\mozilla\Firefox\Profiles\mc902r5d.default\extensions\{c6c9664f-c6e9-4f84-b676-824ffa34efe9}
[2013-10-06 09:06:45 | 000,022,906 | ---- | M] () -- C:\Users\Lenovo\AppData\Roaming\mozilla\firefox\profiles\mc902r5d.default\searchplugins\Web Search.xml
CHR - Extension: QuickShare Widget = C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0\
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O3 - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [snp2uvc] C:\windows\vsnp2uvc.exe File not found
O4 - HKU\S-1-5-21-2154421123-2383531889-1513571259-1003..\Run: [Pokki] C:\windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform File not found
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll File not found
[2013-02-08 15:59:34 | 000,000,000 | ---D | M] -- C:\Users\Lenovo\AppData\Roaming\Babylon
[2013-10-13 10:20:33 | 000,000,000 | ---D | M] -- C:\Users\Lenovo\AppData\Roaming\OpenCandy

:Files
C:\Users\Lenovo\AppData\Local\Temp*.html

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Podajesz log z usuwania + nowe logi z OTL.