Personal Shield Pro - kolejna ofiara

[mka (1resyl)]

Witam.

Wczoraj wieczorem uaktywnił się na moim laptopie Personal Shield Pro. Proszę o pomoc w zwalczeniu.

Logi z OTL: http://wklej.org/id/581607/ i http://wklej.org/id/581614/ oraz z UsbFix: http://wklej.org/id/581615/

[Leon1 (Leon$)]

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

:OTL PRC - [2011-01-14 19:31:43 | 000,151,552 | ---- | M] () – C:\Windows\KMService.exe PRC - [2011-01-14 19:31:43 | 000,008,192 | ---- | M] () – C:\Windows\System32\srvany.exe SRV - [2011-01-14 19:31:43 | 000,008,192 | ---- | M] () [Auto | Running] – C:\Windows\System32\srvany.exe – (KMService) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - File not found O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM…\Run: [] File not found O4 - HKU\S-1-5-21-196931066-2618462160-3552708504-1006…\Run: [iqegoluqo] C:\Users\RESYL\AppData\Local\dbtarary.dll (NETGEAR Corporation.) O4 - HKLM…\RunOnce: [] File not found O4 - HKU\S-1-5-21-196931066-2618462160-3552708504-1006…\RunOnce: [cJ13602DbNcA13602] C:\ProgramData\cJ13602DbNcA13602\cJ13602DbNcA13602.exe () O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} http://www.photodex.com/pxplay.cab (Reg Error: Key error.) MsConfig - StartUpReg: FlashPlayerUpdate - hkey= - key= - File not found MsConfig - StartUpReg: HotKeysCmds - hkey= - key= - File not found MsConfig - StartUpReg: IgfxTray - hkey= - key= - File not found MsConfig - StartUpReg: Persistence - hkey= - key= - File not found MsConfig - StartUpReg: QlbCtrl - hkey= - key= - File not found [2011-08-21 20:54:03 | 000,000,000 | —D | C] – C:\ProgramData\cJ13602DbNcA13602 [2011-01-14 19:32:58 | 000,151,552 | ---- | C] () – C:\Windows\KMService.exe [2011-01-14 19:32:58 | 000,008,192 | ---- | C] () – C:\Windows\System32\srvany.exe :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [CLEARALLRESTOREPOINTS] [RESETHOSTS] [emptytemp]

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

Pokaż log z usuwania.

potem nowy log OTL robiony opcją Run Scan (Skanuj)