Tr/Agent.104448,26 i EXP11-3544.CH-1 - logi

Prosze o sprawdzenie logów. Wczoraj wieczorem Avira alarmowała kilka razy,komp zwolnił na maxa,wydaje się wszystko wywaliłem do kwarantanny po skanie Avirą. Podaję logi z Aviry,Malwaresa OTL i Gmer:

1.Log Avira:
http://wklej.eu/index.php?id=8c75836793

2.log Malvaresbytes:
http://wklej.eu/index.php?id=129d128cf4

3.log OTL i OTL extras:
http://wklej.eu/index.php?id=ad72e3e42f
http://wklej.eu/index.php?id=7470b478d1

4.log gmer:
http://wklej.eu/index.php?id=f9ab8a4fcb

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"Shop for HP Supplies" = Shop for HP Supplies
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"AVG Secure Search" = AVG Security Toolbar
"Yahoo! Companion" = Yahoo! Toolbar

Odinstaluj to oprogramowanie.

Logi.

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod:

:OTL

IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&m=aspire_5742g&r=27360512i165l0474z125v4722236r
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&m=aspire_5742g&r=27360512i165l0474z125v4722236r
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&m=aspire_5742g&r=27360512i165l0474z125v4722236r
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&m=aspire_5742g&r=27360512i165l0474z125v4722236r
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&m=aspire_5742g&r=27360512i165l0474z125v4722236r
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={89293645-3819-4480-87A6-46942A7FC52D}&mid=37fe76c8184047af8d1687acb2003d52-334b1b905c8ae259c320f752ae893a61be1a217f&lang=pl&ds=ik011&pr=&d=2012-09-21 14:35:13&v=12.2.5.34&sap=hp
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_plGB482
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={89293645-3819-4480-87A6-46942A7FC52D}&mid=37fe76c8184047af8d1687acb2003d52-334b1b905c8ae259c320f752ae893a61be1a217f&lang=pl&ds=ik011&pr=&d=2012-09-21 14:35:13&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O15 - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..Trusted Domains: line6.net ([]* in Trusted sites)

:Files
C:\Program Files (x86)\Google\Update
C:\Users\yez.yez-Komputer\Desktop\AdobeReader(1).exe
C:\Users\yez.yez-Komputer\AppData\Local\AVG Secure Search
C:\ProgramData\AVG Secure Search
C:\Windows\SysNative\drivers\avgtpx64.sys
C:\Program Files (x86)\Common Files\AVG Secure Search
C:\Program Files (x86)\AVG Secure Search
C:\Windows\tasks\*.*
C:\Users\yez.yez-Komputer\AppData\LocalLow\Microsoft\Silverlight\is\dj0wwelp.zyd\tosqfda1.zud\1\l

:Reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

:Commands
[emptyflash]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podaj log z ADWCleaner (z opcji Delete) otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p139531 + log z TDSSKiller otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p120292 + nowe logi z OTL + log z Autoruns otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p138589.

Ok,wydaje mi się ,że wszytko zrobione.Oto logi:

1.OTL usuwanie:
http://wklej.eu/index.php?id=5c0a864148
2.ADWcleaner:
http://wklej.eu/index.php?id=a4596525db
3.TDSSKiller:
http://wklej.eu/index.php?id=6924919177
4.OTL:
http://wklej.eu/index.php?id=e3b9a5b1fa
5.Extras:
http://wklej.eu/index.php?id=94a89bfa2b
6.Autoruns:
http://www12.zippyshare.com/v/42233850/file.html

ADWCleaner.

Uninstall.

Autoruns.

W Autoruns odznacz, a następnie usuń (co się będzie dało):

HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms

rdpclip

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

mwlDaemon
PLFSetI
RtHDVCpl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

Adobe ARM
APSDaemon
BackupManagerTray
HP Software Update
hpqSRMon
IAStorIcon
iTunesHelper
LManager
QuickTime Task
ROC_ROC_NT
SuiteTray
SunJavaUpdateSched

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Wszystko.

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components

Wszystko.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components

Wszystko.

HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Wszystko.

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions

Wszystko.

Task Scheduler

Wszystko.

HKLM\System\CurrentControlSet\Services

AdobeARMservice
Apple Mobile Device
cvhsvc
DsiWMIService
FLEXnet Licensing Service
gupdate
gupdatem
hpqddsvc
IAStorDataMgrSvc
iPod Service
LMS
MWLService
NTI IScheduleSvc
nvsvc
ose
osppsvc
sftlist
sftvsa
SkypeUpdate
TurboBoost
UNS
Updater Service
WinDefend
WMPNetworkSvc

HKCU\Control Panel\Desktop\Scrnsave.exe

Wszystko.

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors

Wszystko.

Logi.

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod:

:OTL

IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&m=aspire_5742g&r=27360512i165l0474z125v4722236r
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&m=aspire_5742g&r=27360512i165l0474z125v4722236r
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found

:Files
C:\Program Files (x86)\AVG Secure Search
C:\Users\yez.yez-Komputer\Desktop\tdsskiller
C:\Users\yez.yez-Komputer\Desktop\tdsskiller.zip
C:\Users\yez.yez-Komputer\Desktop\AutoRuns.arn

:Commands
[emptyflash]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL.

Zrobione.no oprócz odinstalowania adw cleanera bo coś się buntuje i nie chce się odinstalować.
Oto logi:
1.Autoruns:
http://www38.zippyshare.com/v/55727538/file.html
2.OTL usuwanie:
http://www.wklej.eu/index.php?id=b249f8134d
3.OTL extras:
http://www.wklej.eu/index.php?id=412f57c3e1
4.OTL :
http://www.wklej.eu/index.php?id=54ee6bc2cb

W OTL wklej:

:OTL
O3 - HKU\S-1-5-21-2243994323-3355860092-2251006850-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

Klikasz Wykonaj skrypt, później Sprzątanie

Przeczyść dysk oraz rejestr CCleaner