Witam, czy byłby ktoś w stanie pomóc mi z tym wirusem?
Jak narazie wkleiłem w OTL
:OTL
IE - HKU\S-1-5-21-3624227412-2955519344-4135408192-5462\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=100482&babsrc=SP_ss&mntrId=1e043bac000000000000000000000000
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
[2012-01-15 22:44:39 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
O4 - HKU\S-1-5-21-3624227412-2955519344-4135408192-5462..\Run: [Ebcyuwiqyk] C:\Users\bczyz\AppData\Roaming\Xara\asizk.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-3624227412-2955519344-4135408192-5462..\RunOnce: [7531CC920063BBF20040D79FF875EF60] C:\ProgramData\7531CC920063BBF20040D79FF875EF60\7531CC920063BBF20040D79FF875EF60.exe ()
[2012-07-22 21:17:52 | 000,000,000 | ---D | C] -- C:\Users\bczyz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum
[2012-07-22 21:16:56 | 000,000,000 | ---D | C] -- C:\ProgramData\7531CC920063BBF20040D79FF875EF60
[2012-07-22 21:15:39 | 000,000,000 | ---D | C] -- C:\Users\bczyz\AppData\Roaming\Xara
[2012-07-22 21:15:39 | 000,000,000 | ---D | C] -- C:\Users\bczyz\AppData\Roaming\Qiymg
[2012-07-22 21:15:39 | 000,000,000 | ---D | C] -- C:\Users\bczyz\AppData\Roaming\Dope
[2012-07-10 12:50:25 | 000,110,080 | ---- | M] (Infragistics, Inc.) -- C:\Users\bczyz\AppData\Local\sslcra32.exe
[2012-07-22 21:17:52 | 000,002,024 | ---- | C] () -- C:\Users\bczyz\Desktop\Live Security Platinum.lnk
[2012-06-30 12:17:23 | 000,101,716 | ---- | C] () -- C:\Program Files (x86)\md5.exe
[2012-01-03 23:57:21 | 000,000,032 | RHS- | C] () -- C:\Users\bczyz\AppData\Local\t56.dat
[2012-01-15 22:44:37 | 000,000,000 | ---D | M] -- C:\Users\bczyz\AppData\Roaming\Babylon
:Reg
[-HKEY_USERS\S-1-5-21-3624227412-2955519344-4135408192-5462\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum]
:Commands
[emptytemp]
Czekam na koniec i na wyniki skanu, tak mi sie wydaje.