Analiza logów z OTL. Podejrzenie infekcji

[hnebdg (Hnebedegie)]

Pozdrawiam!

[Leon1 (Leon$)]

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

:OTL IE - HKU\S-1-5-21-3716184545-2541951319-308164104-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=113480 … dae903ce30 IE - HKU\S-1-5-21-3716184545-2541951319-308164104-1001…\SearchScopes,DefaultScope = {A3436C23-74AD-4F9E-9BE6-E95B3F83D97A} IE - HKU\S-1-5-21-3716184545-2541951319-308164104-1001…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=113480&tt=010812_nich_3112_3&babsrc=SP_ss&mntrId=8674950c00000000000014dae903ce30 FF - prefs.js…browser.search.defaultenginename: “Search the web (Babylon)” FF - prefs.js…browser.search.order.1: “Search the web (Babylon)” FF - prefs.js…browser.search.selectedEngine: “Search the web (Babylon)” FF - prefs.js…browser.startup.homepage: “http://search.babylon.com/?affID=113480&tt=010812_nich_3112_3&babsrc=HP_ss&mntrId=8674950c00000000000014dae903ce30” FF - prefs.js…keyword.URL: “http://search.babylon.com/?affID=113480&tt=010812_nich_3112_3&babsrc=KW_ss&mntrId=8674950c00000000000014dae903ce30&q=” O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [KMConfig] “D:\Program Files (x86)\Multimedia Keyboard Driver\V5\StartAutorun.exe” KMConfig.exe File not found O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found [2012-09-12 17:41:02 | 000,001,062 | ---- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3716184545-2541951319-308164104-1001UA.job [2012-09-12 16:03:18 | 000,001,044 | ---- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2012-09-11 21:41:00 | 000,001,010 | ---- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3716184545-2541951319-308164104-1001Core.job [2012-08-04 00:19:48 | 000,000,000 | —D | M] – C:\Users\Patryk\AppData\Roaming\Babylon [2012-06-13 20:35:10 | 000,000,000 | —D | M] – C:\Users\Patryk\AppData\Roaming\EurekaLog :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [RESETHOSTS] [emptytemp]

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

Pokaż log z usuwania.

potem nowy log OTL robiony opcją Run Scan (Skanuj)