Długie uruchamianie systemu i niechciane reklamy Facebook

[jendrekc]

Wczoraj wykryłem 2 trojany:

Kaspersky - Trojan.win32.buzus.kkqk

Malwarebytes - Trojan.Agent

ale nadal komputer nie chodzi, tak jak powinien.

Logi:

OTL.txt - http://www.wklejto.pl/144469

Extras.txt - http://www.wklejto.pl/144470

[Acorus]

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\rdvgkmd.sys – (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\system32\Drivers\uti5oduz.sys – (uti5oduz) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\stwrt.sys – (STHDA) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\jendrekc\AppData\Local\Temp\cpuz134\cpuz134_x32.sys – (cpuz134) DRV - File not found [Kernel | On_Demand | Stopped] – C:\cpu.sys – (cpu) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKCU…\SearchScopes{0D7562AE-8EF6-416d-A838-AB665251703A}: “URL” = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKCU…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=113926&tt=3112_4&babsrc=SP_ss&mntrId=2621affb000000000000002268de0729 IE - HKCU…\SearchScopes{267ECF7D-C8AA-48B0-9257-34556DD61E94}: “URL” = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms} IE - HKCU…\SearchScopes{A6CECC18-767C-4295-8CDA-8ED97AD1E1D3}: “URL” = http://websearch.ask.com/redirect?clien … &src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=7CABF43F-659B-4779-802C-56B856001B4F&apn_sauid=21B9A243-DA18-4155-92BA-BD15508CA692 IE - HKCU…\SearchScopes{C5806CC9-0F9F-4853-B72C-B1936E5426F2}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultenginename: “Ask.com” FF - prefs.js…browser.search.defaultthis.engineName: “uTorrentControl2 Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.order.1: “Ask.com” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=” [2012-11-07 11:36:14 | 000,000,000 | —D | M] (uTorrentControl2 Community Toolbar) – C:\Users\jendrekc\AppData\Roaming\mozilla\Firefox\Profiles\orxp9slh.default\extensions{687578b9-7132-4a7a-80e4-30ee31099e03} [2012-07-25 22:00:12 | 000,002,299 | ---- | M] () – C:\Users\jendrekc\AppData\Roaming\mozilla\firefox\profiles\orxp9slh.default\searchplugins\askcom.xml [2012-11-21 16:43:55 | 000,001,048 | ---- | M] () – C:\Users\jendrekc\AppData\Roaming\mozilla\firefox\profiles\orxp9slh.default\searchplugins\icy-tower-customized-web-search.xml [2012-11-29 16:36:26 | 000,002,212 | ---- | M] () – C:\Users\jendrekc\AppData\Roaming\mozilla\firefox\profiles\orxp9slh.default\searchplugins\Reimage Search.xml O3 - HKLM…\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {687578B9-7132-4A7A-80E4-30EE31099E03} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKCU…\Run: [Facebook Update] C:\Users\jendrekc\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) [2013-01-04 14:34:01 | 000,000,918 | ---- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-42793946-1553169398-1148229777-1000Core.job [2013-01-05 08:34:05 | 000,000,940 | ---- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-42793946-1553169398-1148229777-1000UA.job :Commands [emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.

Odinstaluj resztki Avasta http://www.avast.com/uninstall-utility

[jendrekc]

Sprawa reklam załatwiona - dzięki , ale komp nadal bardzo się muli przy uruchamianiu , przez kilka minut nie można pracować.

Nowe logi z OTL:

OTL.txt - http://www.wklejto.pl/144534

Extras.txt - http://www.wklejto.pl/144535

[Acorus]

Sprawdź po odinstalowaniu Kasperskiego.

[jendrekc]

OK! Dzięki! To Kaspersky tak muli.