Proszę o sprawdzenie logów

[Devorious88]

Witam, chciałbym prosić o sprawdzenie moich logów oraz o ewentualną pomoc w zwalczeniu infekcji, tutaj daje wpisy z OTL i TDSSKiller

OTL: http://wklej.eu/index.php?id=e338c8f36b
Extras.txt : http://wklej.eu/index.php?id=b0f0f29dfc

oraz
TDSSKiller: http://wklej.eu/index.php?id=4874efcb90

poniewaz posiadam win 7 - 64bit

Z góry dziekuje

[mateo8898]

Infekcja faktycznie jest.
1. Odinstaluj: SweetIM for Messenger 3.6, SweetPacks Toolbar for Internet Explorer 4.5, Ask Toolbar, AVG Security Toolbar, Babylon toolbar on IE, Browsers Protector, DAEMON Tools Toolbar, Incredibar Toolbar on IE, McAfee Security Scan Plus, SFT_Polska Toolbar, StartSearch Toolbar 1.3, uTorrentBar Toolbar, vShare.tv plugin 1.3, V9 HomeTool
2. Użyj AdwCleaner http://forum.instalki.pl/otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p139531 z opcji Delete i podaj log.
3. Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = pl.v9.com/idg/idg_1334773908_391695
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=27f2fd28-231d-11e1-ad64-002522a78a1c
IE - HKLM\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=27f2fd28-231d-11e1-ad64-002522a78a1c&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817
IE - HKLM\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=27f2fd28-231d-11e1-ad64-002522a78a1c&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10005’
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = pl.v9.com/idg/idg_1334773908_391695
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=27f2fd28-231d-11e1-ad64-002522a78a1c
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{511D4DF4-F43A-494C-96CA-7C7DA51EEB4D}: "URL" = http://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6OyO6IbNTI&i=26
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={D6C06ACA-54C1-47B1-8C66-6CE24D9CFC0D}&mid=10edf94031f447d088ccd16c644363ef-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=pl&ds=ac011&pr=sa&d=2012-09-16 13:01:03&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{AB601A28-C50C-409F-9352-FEDBB0BA02FC}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=PV&apn_dtid=YYYYYYYYPL&apn_uid=5539D4E9-E612-4E40-9CE2-690BB443F6CC&apn_sauid=EBB8D74F-0B5E-4C74-AC4F-94DF5E6CA88A&
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search?q={searchTerms}
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=27f2fd28-231d-11e1-ad64-002522a78a1c&q={searchTerms}
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{D312DBFF-11AA-4688-AB4A-D18E5A4BAD23}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18790
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10005’
FF - prefs.js..browser.search.defaultengine: "Web Search"
FF - prefs.js..browser.search.defaultenginename: "error"
FF - prefs.js..browser.search.order.1: "error"
FF - prefs.js..browser.search.selectedEngine: "error"
FF - prefs.js..browser.startup.homepage: "error"
FF - prefs.js..extensions.enabledAddons: [email protected]:1.5.0
FF - prefs.js..keyword.URL: "error"
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
[2012-08-21 22:08:35 | 000,000,000 | ---D | M] (SFT_Polska Community Toolbar) -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\Firefox\Profiles\jlkkekm6.default\extensions\{5c5b9468-d672-4eb7-b52f-b5afabf28c5b}
[2012-08-27 20:47:07 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\Firefox\Profiles\jlkkekm6.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2012-02-04 12:51:24 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\Firefox\Profiles\jlkkekm6.default\extensions\[email protected]
[2011-09-22 10:18:05 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\Firefox\Profiles\jlkkekm6.default\extensions\[email protected]
[2012-09-14 17:34:16 | 000,000,000 | ---D | M] (incredibar.com) -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\Firefox\Profiles\jlkkekm6.default\extensions\[email protected]
[2011-11-10 17:50:16 | 000,000,000 | ---D | M] ("Ask Toolbar") -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\Firefox\Profiles\jlkkekm6.default\extensions\[email protected]
[2011-11-21 20:46:47 | 000,010,043 | ---- | M] () (No name found) -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\firefox\profiles\jlkkekm6.default\extensions\[email protected]
[2011-11-28 11:37:07 | 000,002,573 | ---- | M] () -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\firefox\profiles\jlkkekm6.default\searchplugins\askcom.xml
[2011-08-02 14:56:16 | 000,000,863 | ---- | M] () -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\firefox\profiles\jlkkekm6.default\searchplugins\conduit.xml
[2011-07-29 21:48:39 | 000,002,055 | ---- | M] () -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\firefox\profiles\jlkkekm6.default\searchplugins\daemon-search.xml
[2012-09-14 17:34:10 | 000,002,203 | ---- | M] () -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\firefox\profiles\jlkkekm6.default\searchplugins\MyStart Search.xml
[2012-09-15 18:02:50 | 000,000,792 | ---- | M] () -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\firefox\profiles\jlkkekm6.default\searchplugins\startsear.xml
[2012-05-08 14:26:31 | 000,003,940 | ---- | M] () -- C:\Users\Lupa Jan\AppData\Roaming\mozilla\firefox\profiles\jlkkekm6.default\searchplugins\sweetim.xml
[2012-09-15 18:02:58 | 000,000,000 | ---D | M] (z) -- C:\Program Files (x86)\mozilla firefox\extensions\{ba0a5605-33d3-003f-0545-6e8592bf0ba9}
[2012-09-16 13:00:59 | 000,003,752 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2011-09-22 10:18:02 | 000,002,226 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012-04-18 20:31:48 | 000,002,415 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\v9.xml
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-3723663294-3655808551-748276165-1000..\Run: [ASRockXTU] File not found
O4 - HKU\S-1-5-21-3723663294-3655808551-748276165-1000..\Run: [zASRockInstantBoot] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Lupa Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe (Microsoft)
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
[2012-07-29 16:08:06 | 000,075,045 | ---- | C] () -- C:\Windows\SysWow64\2b9be934.exe
[2012-07-29 16:08:03 | 001,915,904 | ---- | C] () -- C:\Windows\SysWow64\bb39d767.dll
[2012-05-28 18:18:52 | 000,382,464 | ---- | C] () -- C:\Users\Lupa Jan\AppData\Local\wqcidraold.exe
[2011-11-17 09:14:10 | 000,002,048 | -HS- | M] () -- C:\Users\Lupa Jan\AppData\Local\{a5e61e29-521c-6a8a-ff49-f7e201ba8505}\@

:Files
C:\Users\Lupa Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Continue otshot Installation.lnk
C:\Users\Lupa Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CloneCDTray"=-
"CTSyncService"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALLUpdate"=-
"Pando Media Booster"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

Kolejność jak podałem.

[Devorious88]

log AdwCleaner - http://wklej.eu/index.php?id=069bb8d766
log OTL z usuwania - http://wklej.eu/index.php?id=5891f5e5c7
log OTL nowy - http://wklej.eu/index.php?id=13dde0e5c9

[kominekl]

Logi.

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko

:OTL

IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\URLSearchHook: {0F3DC9E0-C459-4a40-BCF8-747BD9322E10} - C:\Program Files (x86)\DeviceVM\SmartView\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\SearchScopes\{80F9232E-47F2-4476-B1FD-8BF1A05F6A9A}: "URL" = http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5480255188&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=pl&q={searchTerms}
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
@Alternate Data Stream - 24 bytes -> C:\Windows:2A6EAE5FEA8B53A0

:Files
C:\Program Files (x86)\Google\Update
C:\Windows\SysNative\d3d10level9.dll
C:\Users\Lupa Jan\AppData\Roaming\Windows Update.exe
C:\Users\Lupa Jan\AppData\Roaming\NIS-MAK-18-0-0-42.exe
C:\Users\Lupa Jan\AppData\Local\setup.exe
C:\Windows\tasks\*.*
C:\Windows\bnetunin.exe
C:\Windows\diabunin.exe
C:\Users\Lupa Jan\AppData\Local\{BF20E11E-DBDA-4DD0-A460-A30AF591FF10}
C:\Users\Lupa Jan\AppData\Local\{C7B7B206-6148-4485-BF11-A27A53EDF6D7}
C:\Users\Lupa Jan\AppData\Local\{9550DCA1-0641-4649-9354-A59422F7925D}
C:\Users\Lupa Jan\AppData\Local\{F9674D57-134F-45DD-916B-712484096534}
C:\Users\Lupa Jan\AppData\Roaming\Ogihuhi

:Commands
[emptyflash]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL + log z Autoruns otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p138589.

[mateo8898]

:Files
C:\Windows\SysNative\d3d10level9.dll
C:\Windows\bnetunin.exe
C:\Windows\diabunin.exe

Te pliki są prawidłowe.

Wklej w OTL:

:OTL
IE - HKU\S-1-5-21-3723663294-3655808551-748276165-1000\..\URLSearchHook: {0F3DC9E0-C459-4a40-BCF8-747BD9322E10} - C:\Program Files (x86)\DeviceVM\SmartView\AddressBarSearch.dll (DeviceVM, Inc.)
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found

:Files
C:\Users\Lupa Jan\AppData\Roaming\Windows Update.exe
C:\Users\Lupa Jan\AppData\Roaming\NIS-MAK-18-0-0-42.exe
C:\Users\Lupa Jan\AppData\Local\setup.exe
C:\Users\Lupa Jan\AppData\Roaming\Ogihuhi

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

[Devorious88]

logi z usuwania - http://wklej.eu/index.php?id=d128ae1368

Nowe logi z OTL :
OTL.txt - http://wklej.eu/index.php?id=4c3625c5a4
Extras.txt - http://wklej.eu/index.php?id=73a9699bf3

[mateo8898]

Widzę, że zastosowałeś się do instrukcji poprzednika i prawidłowe pliki zostały usunięte. Przywróć je na swoje miejsce z kwarantanny OTL (folder C:\_OTL).

Wklej w OTL:

:OTL
O2 - BHO: (extrafind) - {cba728b7-0fdc-cd02-7fd7-18ad98a9052e} - C:\Windows\SysWow64\bb39d767.dll File not found

Klikasz Wykonaj skrypt, później Sprzątanie

Przeczyść dysk oraz rejestr CCleaner

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport (po uruchomieniu odrzuć okres testowy)

Zainstaluj SP1 http://www.instalki.pl/programy/downloa ... ack_1.html

Odinstaluj starą wersję Javy:

Java(TM) 6 Update 30

i zainstaluj najnowszą http://www.instalki.pl/programy/download/Windows/biblioteki/Java.html