Live security platinum - problem

[niunia815]

Bardzo proszę o pomoc. Zamieszczam loga:

http://www.wklej.org/id/809129/

[Atis]

Pokaż drugi log:

analiza-dezynfekcja-zestaw-nieingerencyjnych-narzedzi-t485632.html#p3059741

[niunia815]

Drugi log: http://www.wklej.org/id/809225/

[Atis]

1. Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKU\S-1-5-21-995155576-2234300397-1597466958-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?AF=109130&ba … 1f3b7d705d IE - HKU\S-1-5-21-995155576-2234300397-1597466958-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&AF=109130&babsrc=SP_ss&mntrId=033ef52a000000000000001f3b7d705d FF - prefs.js…browser.search.defaultenginename: “Search the web (Babylon)” FF - prefs.js…browser.search.order.1: “Search the web (Babylon)” FF - prefs.js…browser.search.selectedEngine: “Search the web (Babylon)” FF - prefs.js…browser.startup.homepage: “http://search.babylon.com/?babsrc=HP_Prot” FF - prefs.js…extensions.enabledItems: ffxtlbr@babylon.com:1.2.0 FF - prefs.js…keyword.URL: “http://search.babylon.com/?AF=109130&babsrc=adbartrp&mntrId=033ef52a000000000000001f3b7d705d&q=” [2012-02-11 16:33:01 | 000,000,000 | —D | M] (Babylon) – C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com [2012-02-11 16:37:01 | 000,002,310 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found. O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [TaskTray] File not found O4 - HKU\S-1-5-21-995155576-2234300397-1597466958-1000…\RunOnce: [036DFF61000C7413D9B6B1532F3B707C] C:\ProgramData\036DFF61000C7413D9B6B1532F3B707C\036DFF61000C7413D9B6B1532F3B707C.exe () [2012-08-11 22:22:18 | 000,000,000 | —D | C] – C:\Users\olek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum [2012-08-11 23:08:14 | 000,002,000 | ---- | M] () – C:\Users\olek\Desktop\Live Security Platinum.lnk [2012-08-11 21:49:12 | 000,011,830 | ---- | M] () – C:\Users\olek\AppData\Roaming\wklnhst.dat [2012-07-22 10:20:21 | 000,311,296 | ---- | M] () – C:\Users\olek\AppData\Local\bzhnwgkpl.exe [2012-02-11 16:32:49 | 000,000,000 | —D | M] – C:\Users\olek\AppData\Roaming\Babylon :Files C:\Users\olek\AppData\Local\Temp*.html C:\ProgramData\036DFF61000C7413D9B6B1532F3B707C :Reg [-HKEY_USERS\S-1-5-21-995155576-2234300397-1597466958-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum] :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.

2. Wklej do OTL i kliknij Skanuj:

HKEY_CURRENT_USER\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s /md5start services.exe /md5stop

Pokaż ten log.

[niunia815]

raport z usuwania:

All processes killed

========== OTL ==========

HKU\S-1-5-21-995155576-2234300397-1597466958-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-995155576-2234300397-1597466958-1000\Software\Microsoft\Internet Explorer\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

Prefs.js: “Search the web (Babylon)” removed from browser.search.defaultenginename

Prefs.js: “Search the web (Babylon)” removed from browser.search.order.1

Prefs.js: “Search the web (Babylon)” removed from browser.search.selectedEngine

Prefs.js: “http://search.babylon.com/?babsrc=HP_Prot” removed from browser.startup.homepage

Prefs.js: ffxtlbr@babylon.com:1.2.0 removed from extensions.enabledItems

Prefs.js: “http://search.babylon.com/?AF=109130&babsrc=adbartrp&mntrId=033ef52a000000000000001f3b7d705d&q=” removed from keyword.URL

C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com\defaults\preferences folder moved successfully.

C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com\defaults folder moved successfully.

C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully.

C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully.

C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com\content folder moved successfully.

C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com\components folder moved successfully.

C:\Users\olek\AppData\Roaming\mozilla\Firefox\Profiles\vkqy71u4.default\extensions\ffxtlbr@babylon.com folder moved successfully.

C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\TaskTray deleted successfully.

Registry value HKEY_USERS\S-1-5-21-995155576-2234300397-1597466958-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\036DFF61000C7413D9B6B1532F3B707C deleted successfully.

C:\ProgramData\036DFF61000C7413D9B6B1532F3B707C\036DFF61000C7413D9B6B1532F3B707C.exe moved successfully.

C:\Users\olek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum folder moved successfully.

File C:\Users\olek\Desktop\Live Security Platinum.lnk not found.

C:\Users\olek\AppData\Roaming\wklnhst.dat moved successfully.

C:\Users\olek\AppData\Local\bzhnwgkpl.exe moved successfully.

C:\Users\olek\AppData\Roaming\Babylon folder moved successfully.

========== FILES ==========

C:\Users\olek\AppData\Local\TempYx4024.html moved successfully.

C:\ProgramData\036DFF61000C7413D9B6B1532F3B707C folder moved successfully.

========== REGISTRY ==========

Registry key HKEY_USERS\S-1-5-21-995155576-2234300397-1597466958-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum\ deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: olek

->Temp folder emptied: 152393928 bytes

->Temporary Internet Files folder emptied: 169379918 bytes

->Java cache emptied: 2938227 bytes

->FireFox cache emptied: 68010983 bytes

->Google Chrome cache emptied: 402206968 bytes

->Apple Safari cache emptied: 48550912 bytes

->Flash cache emptied: 3136728 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 128136652 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 930,00 mb

OTL by OldTimer - Version 3.2.57.0 log created on 08122012_113747

Files\Folders moved on Reboot…

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

– Dodane 12.08.2012 (N) 11:54 –

log: http://www.wklej.org/id/809267/

[Atis]

Wklej i kliknij Wykonaj skrypt:

:Files C:\Users\olek\AppData\Local\Temp*.html :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

Odinstaluj starą wersję programu:

Java 6 Update 24

Java 6 Update 2

Adobe Flash Player 10 ActiveX

Adobe Shockwave Player

Adobe Reader 8.1.0

Później zainstaluj:

Adobe Reader

Flash Player

Java

Adobe Shockwave Player

Uruchom OTL i kliknij Sprzątanie.

Usuń stare punkty przywracania:

http://windows.microsoft.com/pl-PL/wind … tore-point

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date

[niunia815]

Results of screen317’s Security Check version 0.99.43 Windows Vista Service Pack 2 x86 (UAC is disabled!) Internet Explorer 9 Antivirus/Firewall Check: Windows Security Center service is not running! This report may not be accurate! Norton 360 WMI entry may not exist for antivirus; attempting automatic update. Anti-malware/Other Utilities Check: CCleaner Java 7 Update 5 Adobe Reader X (10.1.0) Mozilla Firefox (3.6.28) Firefox out of Date! Google Chrome 12.0.742.100 Process Check: objlist.exe by Laurent Norton ccSvcHst.exe System Health check Total Fragmentation on Drive C: % ````````````````````End of Log``````````````````````

– Dodane 12.08.2012 (N) 13:16 –

Dziękuję bardzo za pomoc!!

[Atis]

Aktualizuj Firefox i to wszystko.