Problem z windll.exe

xqbax · 5 Lipiec 2012 18:43

Witam. Mam problem z czyms o nazwie windll.exe. Moj prblem polega na tym, iz przy kazdym wlaczeniu komputera pojawia sie okienko z informacja windll.exe przestal dzialac. Na dodatek nie odczytuje mi karty pamieci i mysle ze to jest zwiazane z tym problemem. Prosze Was o pomoc. Jak pozbyc sie tej infekcji z komputera?

– Dodane 05.07.2012 (Cz) 20:51 –

Logi OTL:

OTL.txt: http://wklej.org/id/784973/

Extras.txt: http://wklej.org/id/784978/

Atis · 5 Lipiec 2012 19:22

W panelu sterowania odinstaluj:

SweetPacks Toolbar for Internet Explorer

BabylonObjectInstaller

Yontoo

Babylon toolbar on IE

BrowserCompanion

DealPly

facemoods

Giant Savings

Softonic toolbar on IE and Chrome

uTorrentControl Toolbar

Do okna Własne opcje skanowania / skrypt wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – E:\NTGLM7X.sys – (SetupNTGLM7X) DRV - File not found [Kernel | On_Demand | Stopped] – D:\WINDOWS\system32\PCAMPR5.SYS – (PCAMPR5) DRV - File not found [Kernel | On_Demand | Stopped] – E:\NTACCESS.sys – (NTACCESS) DRV - File not found [Kernel | On_Demand | Stopped] – E:\INSTALL\GMSIPCI.SYS – (GMSIPCI) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={84979107-6FAE-11E1-8621-0021853A69E8} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 IE - HKLM…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={84979107-6FAE-11E1-8621-0021853A69E8} IE - HKCU…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=010712_8&babsrc=SP_ss&mntrId=54f10e230000000000000021853a69e8 IE - HKCU…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={84979107-6FAE-11E1-8621-0021853A69E8} [2012-07-05 17:15:10 | 000,000,000 | —D | M] (Babylon) – D:\Documents and Settings\kasia\Dane aplikacji\Mozilla\Firefox\Profiles\s3d1hm9z.default\extensions\ffxtlbr@babylon.com [2012-05-26 15:22:46 | 000,000,000 | —D | M] (Yontoo) – D:\Documents and Settings\kasia\Dane aplikacji\Mozilla\Firefox\Profiles\s3d1hm9z.default\extensions\plugin@yontoo.com [2010-12-13 14:36:54 | 000,002,035 | ---- | M] () – D:\Program Files\mozilla firefox\searchplugins\fcmdSrchddr.xml [2012-03-16 23:32:51 | 000,002,415 | ---- | M] () – D:\Program Files\mozilla firefox\searchplugins\v9.xml O4 - HKCU…\Run: [Microsoft Windows System] D:\Documents and Settings\kasia\P-7-78-8964-9648-3874\windll.exe () [2012-07-05 15:12:29 | 000,000,000 | —D | C] – D:\Documents and Settings\kasia\P-7-78-8964-9648-3874 [2012-07-05 17:14:07 | 000,005,268 | ---- | M] () – D:\user.js :Files autorun.inf /alldrives :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.