wyczyszczenie logów

Ostatnio miałem straszne problemy z komputerem (powoli chodził i jeszcze problemy z kopiowaniem i wklejaniem ponieważ wyskakiwało "Hello!" zamiast tego co chciałem wkleić) i kolega poradził mi żebym przeskanował programem OTL i wkleił linki na forum

OTL:
http://www.wklej.eu/index.php?id=f6a2034939
Extras:
http://www.wklej.eu/index.php?id=fa7cb9b39d

1. Wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData"="C:\\Users\\Patryk\\AppData\\Roaming"
"Local AppData"="C:\\Users\\Patryk\\AppData\\Local"
"My Video"="C:\\Users\\Patryk\\Videos"
"{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"="C:\\Users\\r\\AppData\\Roaming\\Microsoft\\Windows\\Libraries"
"My Pictures"="C:\\Users\\Patryk\\Pictures"
"Desktop"="C:\\Users\\Patryk\\Desktop"
"History"="C:\\Users\\Patryk\\AppData\\Local\\Microsoft\\Windows\\History"
"NetHood"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts"
"{56784854-C6CB-462B-8169-88E350ACB882}"="C:\\Users\\Patryk\\Contacts"
"Cookies"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Cookies"
"Favorites"="C:\\Users\\Patryk\\Favorites"
"SendTo"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\SendTo"
"Start Menu"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
"My Music"="C:\\Users\\Patryk\\Music"
"Programs"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs"
"Recent"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Recent"
"CD Burning"="C:\\Users\\Patryk\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn"
"PrintHood"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts"
"{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}"="C:\\Users\\Patryk\\Searches"
"{374DE290-123F-4565-9164-39C4925E467B}"="C:\\Users\\Patryk\\Downloads"
"{A520A1A4-1780-4FF6-BD18-167343C5AF16}"="C:\\Users\\Patryk\\AppData\\LocalLow"
"Startup"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
"Administrative Tools"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
"Personal"="C:\\Users\\Patryk\\Documents"
"{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}"="C:\\Users\\Patryk\\Links"
"Cache"="C:\\Users\\Patryk\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files"
"Templates"="C:\\Users\\Patryk\\AppData\\Roaming\\Microsoft\\Windows\\Templates"
"{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}"="C:\\Users\\Patryk\\Saved Games"
"Fonts"="C:\\Windows\\Fonts"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"AppData"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,\
00,6f,00,61,00,6d,00,69,00,6e,00,67,00,00,00
"Cache"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,\
00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,4c,00,\
6f,00,63,00,61,00,6c,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,\
00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,54,00,65,00,\
6d,00,70,00,6f,00,72,00,61,00,72,00,79,00,20,00,49,00,6e,00,74,00,65,00,72,\
00,6e,00,65,00,74,00,20,00,46,00,69,00,6c,00,65,00,73,00,00,00
"Cookies"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,\
00,6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,\
73,00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,\
00,43,00,6f,00,6f,00,6b,00,69,00,65,00,73,00,00,00
"Desktop"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,44,00,65,00,73,00,6b,00,74,00,6f,00,70,00,00,00
"Favorites"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,46,00,61,00,76,00,6f,00,72,00,69,00,74,00,65,00,73,\
00,00,00
"History"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,4c,\
00,6f,00,63,00,61,00,6c,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,\
66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,48,00,69,\
00,73,00,74,00,6f,00,72,00,79,00,00,00
"Local AppData"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,\
49,00,4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,\
00,4c,00,6f,00,63,00,61,00,6c,00,00,00
"My Music"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,4d,00,75,00,73,00,69,00,63,00,00,00
"My Pictures"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,\
00,4c,00,45,00,25,00,5c,00,50,00,69,00,63,00,74,00,75,00,72,00,65,00,73,00,\
00,00
"My Video"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,56,00,69,00,64,00,65,00,6f,00,73,00,00,00
"NetHood"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,\
00,6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,\
73,00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,\
00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,20,00,53,00,68,00,6f,00,72,00,\
74,00,63,00,75,00,74,00,73,00,00,00
"Personal"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,00,73,\
00,00,00
"Programs"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,\
00,6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,\
73,00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,\
00,53,00,74,00,61,00,72,00,74,00,20,00,4d,00,65,00,6e,00,75,00,5c,00,50,00,\
72,00,6f,00,67,00,72,00,61,00,6d,00,73,00,00,00
"Recent"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,\
00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,00,\
6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,\
00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,\
52,00,65,00,63,00,65,00,6e,00,74,00,00,00
"SendTo"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,\
00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,00,\
6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,\
00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,\
53,00,65,00,6e,00,64,00,54,00,6f,00,00,00
"Startup"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,\
00,6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,\
73,00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,\
00,53,00,74,00,61,00,72,00,74,00,20,00,4d,00,65,00,6e,00,75,00,5c,00,50,00,\
72,00,6f,00,67,00,72,00,61,00,6d,00,73,00,5c,00,53,00,74,00,61,00,72,00,74,\
00,75,00,70,00,00,00
"Start Menu"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,\
00,4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,\
52,00,6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,\
00,73,00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,\
5c,00,53,00,74,00,61,00,72,00,74,00,20,00,4d,00,65,00,6e,00,75,00,00,00
"Templates"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,\
00,6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,\
73,00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,\
00,54,00,65,00,6d,00,70,00,6c,00,61,00,74,00,65,00,73,00,00,00
"{374DE290-123F-4565-9164-39C4925E467B}"=hex(2):25,00,55,00,53,00,45,00,52,00,\
50,00,52,00,4f,00,46,00,49,00,4c,00,45,00,25,00,5c,00,44,00,6f,00,77,00,6e,\
00,6c,00,6f,00,61,00,64,00,73,00,00,00
"PrintHood"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,52,\
00,6f,00,61,00,6d,00,69,00,6e,00,67,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,\
73,00,6f,00,66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,\
00,50,00,72,00,69,00,6e,00,74,00,65,00,72,00,20,00,53,00,68,00,6f,00,72,00,\
74,00,63,00,75,00,74,00,73,00,00,00

Plik Zapisz jako Ustaw rozszerzenie z TXT na Wszystkie pliki zapisz pod nazwą FIX.REG uruchom utworzony plik i potwierdź

2. Odinstaluj tuto4pc_pl_32, Akamai NetSession Interface
3. Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\xhunter1.sys -- (xhunter1)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\XDva405.sys -- (XDva405)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\vtany.sys -- (vtany)
DRV - File not found [File_System | On_Demand | Stopped] -- C:\ProgramData\BitRaider\BRDriver.sys -- (BRDriver)
IE - HKU\S-1-5-21-404203660-1120667270-3410496716-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&mntrId=C6EA00064F50DBD3&affID=121828&tsp=4967
IE - HKU\S-1-5-21-404203660-1120667270-3410496716-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&babsrc=SP_ss&mntrId=C6EA00064F50DBD3&affID=121828&tsp=4967
O4 - HKLM..\Run: [tuto4pc_pl_11] File not found
O4 - HKLM..\Run: [tuto4pc_pl_31] File not found
O4 - HKU\S-1-5-21-404203660-1120667270-3410496716-1001..\Run: [zASRockInstantBoot] File not found
O4 - HKLM..\RunOnce: [upt4pc_pl_11.exe] C:\Users\Patryk\AppData\Local\tuto4pc_pl_11\upt4pc_pl_11.exe ()
[2013-11-24 18:24:54 | 000,057,344 | -H-- | C] (gy) -- C:\Program Files\Program Files.exe
[2013-12-28 15:28:02 | 000,057,344 | ---- | M] (gy) -- C:\Windows\System32\GryWINFILE.EXE
[2013-12-28 15:28:00 | 000,057,344 | ---- | M] (gy) -- C:\Windows\System32\vlcWINFILE.EXE
[2013-12-28 15:27:59 | 000,057,344 | ---- | M] (gy) -- C:\Windows\Mstray1.exe
[2013-12-28 15:27:59 | 000,057,344 | ---- | M] (gy) -- C:\Windows\Mstray.exe
[2013-12-28 15:28:02 | 000,057,344 | ---- | M] (gy) -- C:\Windows\MShelp.EXE
[2013-12-08 12:50:08 | 000,000,697 | -HS- | M] () -- C:\Windows\System32\Grycomment.htt
[2013-12-08 12:50:08 | 000,000,697 | -HS- | C] () -- C:\Windows\System32\Grycomment.htt

:Commands
[emptytemp]

Klikasz Wykonaj skrypt. Podajesz log z usuwania + nowe logi OTL + log z Gmer http://forum.instalki.pl/otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967.html#p88736

Kolejność jak podałem.

log z usuwania:
http://wklej.eu/index.php?id=c50e627f04
OTL:
http://wklej.eu/index.php?id=bb879e45d5
Extras:
http://wklej.eu/index.php?id=41c97e0f5b
Gmer:
http://wklej.eu/index.php?id=e68b133143

Wklej w OTL:

:OTL
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Patryk\AppData\Local\Temp\kwrdipog.sys -- (kwrdipog)
O4 - HKLM..\Run: [tuto4pc_pl_32] File not found
[2013-12-28 15:28:03 | 000,057,344 | -H-- | M] (gy) -- C:\Users\Patryk\Documents\Documents.exe
[2013-12-28 15:28:00 | 000,057,344 | -H-- | M] (gy) -- C:\Users\Patryk\Desktop\Desktop.exe
[2013-12-28 14:28:01 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-404203660-1120667270-3410496716-1001Core.job
[2013-12-28 17:28:02 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-404203660-1120667270-3410496716-1001UA.job

Klikasz Wykonaj skrypt i podajesz log z usuwania.

http://wklej.eu/index.php?id=dac04eded4

W OTL Sprzątanie

Przeczyść dysk oraz rejestr CCleaner (zakładka Cleaner i Rejestr)

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport (po uruchomieniu odrzuć okres testowy)

Zainstaluj SP1 http://www.instalki.pl/programy/downloa ... ack_1.html

Zaktualizuj IE do najnowszej wersji (nawet jeśli go nie używasz) http://www.instalki.pl/programy/downloa ... lorer.html

Odinstaluj starą wersję Javy:

Java 7 Update 25

i zainstaluj najnowszą http://www.instalki.pl/programy/downloa ... /Java.html

log po skanowaniu przed usunięciem:
http://wklej.eu/index.php?id=f19e332118

musiałem dwa razy skanować bo za pierwszy razem nie usunęło mi wszystkiego

Rozumiem, że usunąłeś wszystko co znalazł??? Jeśli tak to opróżnij jeszcze kwarantannę.

tak usunąłem wszystko co znalazł i opróżniłem kwarantannę

nie wiem czemu ale nie mogę zainstalować SP1 gdyż jak komputer się uruchamia ponownie i jest konfiguracje dochodzi do 1% i instalacja zakończyła się niepowodzeniem,jak system się odpali to wyskakuje okienko że instalacja się nie powiodła z nieznanym błędem ( Błąd : 0x800f0826 )