windows seciurity alert

[k4m]

witam
mam problem jak w temacie wyskakuje mi problem z hdd i odrazu wlancza sie program HDD rescue ...
i po jakims czasie restartuje mi kompa
tu sa logi
OTL - http://www.wklej.eu/index.php?id=ff5abc1d6b
a GMER nie moge wlaczyc alert ..
dzieki za pomoc
pozdro

[mateo8898]

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
PRC - [2010-02-03 19:46:47 | 000,032,838 | ---- | M] (MyWebSearch.com) -- C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
PRC - [2010-02-03 19:46:47 | 000,028,762 | ---- | M] (MyWebSearch.com) -- C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE
PRC - [2010-02-03 19:46:47 | 000,024,688 | ---- | M] (MyWebSearch.com) -- C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={E1FA610A-E135-5B1D-B061-647D6ACBB22D}&q="
FF - prefs.js..extensions.enabledItems: [email protected]:1.1
[2009-11-15 10:08:52 | 000,005,413 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\FireFox\Profiles\d10f6801.default\searchplugins\fast-browser-search.xml
[2010-03-15 15:51:13 | 000,009,985 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\FireFox\Profiles\d10f6801.default\searchplugins\mywebsearch.xml
[2009-07-24 10:19:17 | 000,001,201 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\FireFox\Profiles\d10f6801.default\searchplugins\winamp-search.xml
[2009-07-25 09:50:54 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\d10f6801.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
O3 - HKCU\..\Toolbar\WebBrowser: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (MyWebSearch.com)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKCU..\Run: [1033335] C:\Users\user\AppData\Local\Temp\1033335.exe File not found
O4 - HKCU..\Run: [154706] C:\Users\user\AppData\Local\Temp\154706.exe (Defrag Corporation)
O4 - HKCU..\Run: [41378375] C:\Users\user\AppData\Local\Temp\41378375.exe File not found
O4 - HKCU..\Run: [AOL Dialer] C:\Program Files\Common Files\AOL\ACS\AOlDial.exe File not found
O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\MSN Messenger\MsnMsgr.Exe File not found
O4 - HKCU..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKCU..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk = C:\Users\user\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe File not found
O33 - MountPoints2\{211e4db1-08d8-11df-bf36-00247e5653e6}\Shell\AutoRun\command - "" = G:\dhrhyje.bat -- File not found
O33 - MountPoints2\{211e4db1-08d8-11df-bf36-00247e5653e6}\Shell\open\Command - "" = G:\dhrhyje.bat -- File not found
O33 - MountPoints2\{3f74e136-62f4-11de-b529-00247e5653e6}\Shell\AutoRun\command - "" = F:\
O33 - MountPoints2\{3f74e136-62f4-11de-b529-00247e5653e6}\Shell\open\Command - "" = rundll32.exe .\desktop.dll,InstallM
O33 - MountPoints2\{a270f7f9-a224-11de-8292-00247e5653e6}\Shell - "" = AutoRun
O33 - MountPoints2\{a270f7f9-a224-11de-8292-00247e5653e6}\Shell\AutoRun\command - "" = F:\Autorun.exe -- File not found
O33 - MountPoints2\{b42bf39f-6231-11de-8e29-00247e5653e6}\Shell\AutoRun\command - "" = F:\
O33 - MountPoints2\{b42bf39f-6231-11de-8e29-00247e5653e6}\Shell\open\Command - "" = rundll32.exe .\desktop.dll,InstallM
O33 - MountPoints2\{e8d0eb27-f6f4-11de-93f3-00247e5653e6}\Shell - "" = AutoRun
[2010-12-11 10:46:25 | 000,000,758 | ---- | C] () -- C:\Users\user\Desktop\HDD Rescue.lnk

:Files
C:\Users\user\AppData\Local\Temp*.html
C:\Program Files\MyWebSearch

:Commands
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL (tylko wykonaj je wg tej instrukcji viewtopic.php?f=22&t=13967#p107754 i podaj obydwa logi z OTL).

[k4m]

OTL sie zawiesil ... wylaczyc go czy sie odwieci ?

[mateo8898]

Wyłącz i spróbuj ponownie w trybie awaryjnym.

[k4m]

http://www.wklej.eu/index.php?id=d8b0236a9f
http://www.wklej.eu/index.php?id=12dddc926d
dzieki za pomoc

[mateo8898]

Nie podałeś drugiego logu z OTL (Extras). Uzupełnij to.

[k4m]

http://www.wklej.eu/index.php?id=7e592da8cc

[mateo8898]

Odinstaluj: Google Toolbar, DAEMON Tools Toolbar, Search Guard Plus, Search Guard Plus Updater, Fast Browser Search, Winamp Toolbar, Zynga Toolbar, McAfee Security Scan

Następnie w OTL wklej:

:OTL
SRV - File not found [Auto | Stopped] -- C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe -- (MyWebSearchService)
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\MyWebSearch\bar\1.bin File not found
O2 - BHO: (MyWebSearch Search Assistant BHO) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL File not found
O2 - BHO: (mwsBar BHO) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL File not found
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\ProgramData\Gadu-Gadu 10\_userdata\ggbho.2.dll File not found
O4 - HKU\S-1-5-21-1985691364-2989655083-2128092292-1000..\Run: [kDWvbFVvJG.exe] C:\Users\user\AppData\Local\Temp\kDWvbFVvJG.exe File not found
O4 - HKU\S-1-5-21-1985691364-2989655083-2128092292-1000..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDAgent"=-
"FBSSA"=-
"TkBellExe"=-
"UpdateLBPShortCut"=-
"UpdateP2GoShortCut"=-
"UpdatePDIRShortCut"=-
"UpdatePSTShortCut"=-
"WinampAgent"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALLUpdate"=-
"swg"=-

:Commands
[clearallrestorepoints]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

[k4m]

http://www.wklej.eu/index.php?id=92e3db731b
http://www.wklej.eu/index.php?id=7285db22e9

http://www.wklej.eu/index.php?id=1df142b422

[mateo8898]

W OTL wklej:

:OTL
O4 - HKLM..\RunOnce: [DeleteDir[CD8] Fast Browser Search] File not found
O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus] File not found
O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus Updater] File not found
O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus Updater1] File not found
O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus1] File not found
O4 - HKLM..\RunOnce: [DeleteDir[CD8] SGPSA] File not found
O3 - HKLM\..\Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Fast Browser Search"
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
IE - HKU\S-1-5-21-1985691364-2989655083-2128092292-1000\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL File not found
IE - HKU\S-1-5-21-1985691364-2989655083-2128092292-1000\..\URLSearchHook: {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - Reg Error: Key error. File not found
O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll (Make The Web Better, LLC)

:Files
C:\Program Files\SGPSA

Klikasz Wykonaj skrypt, później Sprzątanie

Przeczyść dysk oraz rejestr CCleaner

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport

Odinstaluj starą wersję Avasta tym narzędziem http://www.pro-av.pl/index.php/strony/12 i zainstaluj najnowszą http://www.instalki.pl/programy/downloa ... virus.html

Odinstaluj stare wersje Javy:

Java(TM) 6 Update 7
Java(TM) 6 Update 14

i zainstaluj najnowszą http://www.instalki.pl/programy/downloa ... %29_6.html

[k4m]

http://www.wklej.eu/index.php?id=b11d62b766

[mateo8898]

To co znalazł Malwarebytes to resztki po Adware i to co było w kwarantannie OTL (nie wybrałeś w nim opcji Sprzątanie).
W takim razie kliknij w OTL Sprzątanie i możesz jeszcze opróżnić kwarantannę Malwarebytes.

[k4m]

zrobilem sprzątanie i mi usunelo OTL
oproznilem kwarantanne malwarebytes
jeszcze raz dzieki
pozdro

[kominekl]

Usunięcie jest także funkcją sprzątania i o to chodziło.