Dosyc wolna praca komputera

[kolorowy0706]

prosze o sprawdzenie logow
skany tds killer http://www.wklej.eu/index.php?id=79910cad11
skany z otl
extras http://www.wklej.eu/index.php?id=1dc67bea6a
otl http://www.wklej.eu/index.php?id=1f7f74af53

[mateo8898]

Mamy tu infekcję.

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=60483ad3-8277-11e1-8ed2-b870f45d5e67
IE - HKLM\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=60483ad3-8277-11e1-8ed2-b870f45d5e67&q={searchTerms}
IE - HKU\S-1-5-21-2591103998-1093498974-2332618709-1001\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = http://search.babylon.com/?affID=114733&tt=270912_ctrl2_3912_2&babsrc=HP_ss&mntrId=f003b75f000000000000b870f45d5e67
IE - HKU\S-1-5-21-2591103998-1093498974-2332618709-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=60483ad3-8277-11e1-8ed2-b870f45d5e67
IE - HKU\S-1-5-21-2591103998-1093498974-2332618709-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=60483ad3-8277-11e1-8ed2-b870f45d5e67&q={searchTerms}
IE - HKU\S-1-5-21-2591103998-1093498974-2332618709-1001\..\SearchScopes\{C02CFA6D-66C4-45E8-B139-3E05D260EC09}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=114733&tt=270912_ctrl2_3912_2&babsrc=SP_ss&mntrId=f003b75f000000000000b870f45d5e67
FF - prefs.js..browser.search.defaultengine: "Web Search"
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..keyword.URL: "http://startsear.ch/?aff=1&src=sp&cf=60483ad3-8277-11e1-8ed2-b870f45d5e67&q="
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00:  File not found
[2012/09/29 13:37:15 | 000,002,362 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O4 - HKU\S-1-5-21-2591103998-1093498974-2332618709-1001..\Run: [AdobeUpdate] C:\Users\Sebastian\AppData\Roaming\Adobe32\invis.vbs ()
O4 - HKU\S-1-5-21-2591103998-1093498974-2332618709-1001..\Run: [stplpfhevfcucfammws] C:\Users\Sebastian\AppData\Roaming\stplpfhevfcucfammws.exe (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - Reg Error: Key error. File not found
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - Reg Error: Key error. File not found
[2012/10/28 20:02:12 | 000,000,330 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL + log z Autoruns otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p138589

[kolorowy0706]

log z usuwania http://www.wklej.eu/index.php?id=be1464a862
skany z otl
otl http://www.wklej.eu/index.php?id=4650cfb9f1
extras http://www.wklej.eu/index.php?id=1cdfb39909
autoruns
http://www32.zippyshare.com/v/95676999/file.html

[mateo8898]

W Autoruns odznacz i usuń:
zakładka Logon:

rdpclip
RtHDVBg
RtHDVCpl
TCrdMain
Toshiba TEMPRO
Adobe ARM
Microsoft Windows
Microsoft Windows

zakładka Scheduled Tasks:

wszystko

zakładka Services (tylko odznacz):

AdobeARMservice
odserv
ose
WinDefend
WMPNetworkSvc

W OTL kliknij Sprzątanie

Przeczyść dysk oraz rejestr CCleaner

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport