peszir
22 Styczeń 2010 18:12
#1
Witam ponownie!
Chciałbym ponownie prosić o pomoc w sprawie usunięcia reklamiarza, który niespodziewanie przeżucił się na komputer koleżanki. Chciałbym jej pomóc usunąć, ale sam jestem zmuszony zdać się na Was, forumowiczów. Proszę o pomoc. Oto logi z OTL:
http://www.wklej.org/id/266628/
http://www.wklej.org/id/266631/
Pozdrawiam!
deFco247
22 Styczeń 2010 18:28
#2
W białe dolne okno Custom Scans/Fixes w OTL wklej:
:Processes Explorer.EXE :OTL SRV - [2009-12-09 14:06:42 | 00,046,456 | ---- | M] () [Auto | Stopped] – C:\ProgramData\QuestService\questservice111.exe – (QuestService Service) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.mykeysearch.com FF - prefs.js…browser.startup.homepage: “http://www.theprizeday.com/today.php|www.google.pl ” FF - prefs.js…extensions.enabledItems: {8141440E-08F0-4339-9959-5C31C6A69F23}:4.2.0.5360 FF - prefs.js…extensions.enabledItems: {E889F097-B0BE-471B-89AD-B86B6F04B506}:4.2.0.2050 FF - prefs.js…extensions.enabledItems: {E63605FC-D583-4C81-867F-9457BDB3EA1B}:4.2.0.2150 FF - HKLM\software\mozilla\Firefox\Extensions\{E63605FC-D583-4C81-867F-9457BDB3EA1B}: C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF [2009-12-23 12:12:07 | 00,000,000 | —D | M] FF - HKLM\software\mozilla\Firefox\Extensions\{8141440E-08F0-4339-9959-5C31C6A69F23}: C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF [2009-12-23 12:12:34 | 00,000,000 | —D | M] FF - HKLM\software\mozilla\Firefox\Extensions\{E889F097-B0BE-471B-89AD-B86B6F04B506}: C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF [2009-12-23 12:12:58 | 00,000,000 | —D | M] [2009-12-24 19:30:21 | 00,000,000 | —D | M] (QuestService) – C:\Program Files (x86)\mozilla firefox\extensions{AAF6454A-4000-4015-84C1-6CD844C06B19} [2009-12-24 19:30:22 | 00,002,406 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\questservice111.xml O2 - BHO: (Automated Content Enhancer) - {1D74E9DD-8987-448b-B2CB-67FFF2B8A932} - C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\ACEIEAddOn.dll () O2 - BHO: (Customized Platform Advancer) - {42C7C39F-3128-4a17-BDB7-91C46032B5B9} - C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\CPAIEAddOn.dll () O2 - BHO: (Content Management Wizard) - {B72681C0-A222-4b21-A0E2-53A5A5CA3D41} - C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\CMWIE.dll () O2 - BHO: (Textual Content Provider) - {CAC89FF9-34A9-4431-8CFE-292A47F843BC} - C:\Program Files (x86)\Textual Content Provider\1.2.0.1960\TCPIE.dll () O2 - BHO: (Web Search Operator) - {EB4A577D-BCAD-4b1c-8AF2-9A74B8DD3431} - C:\Program Files (x86)\Web Search Operator\4.2.0.2150\wso.dll () O3 - HKLM…\Toolbar: (GameRaving Toolbar) - {D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} - C:\Program Files (x86)\GameRaving Toolbar\2.2.0.7580\mvb0.dll () O3 - HKCU…\Toolbar\WebBrowser: (GameRaving Toolbar) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - C:\Program Files (x86)\GameRaving Toolbar\2.2.0.7580\mvb0.dll () O8:64bit: - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () [2009-12-29 23:43:05 | 00,000,000 | —D | C] – C:\Users\Ania\AppData\Local\Web Search Operator [2009-12-29 23:43:05 | 00,000,000 | —D | C] – C:\Users\Ania\AppData\Local\Automated Content Enhancer :Files C:\Program Files (x86)\Web Search Operator C:\Program Files (x86)\Automated Content Enhancer C:\Program Files (x86)\Customized Platform Advancer C:\Program Files (x86)\GameRaving Toolbar C:\ProgramData\QuestService :Commands [emptytemp] [start explorer]
Run Fix . Restart, jeśli będzie potrzebny.
Potem log z usuwania oraz nowy log robiony opcją Run Scan .
peszir
22 Styczeń 2010 19:02
#3
deFco247
22 Styczeń 2010 19:06
#4
Log wygląda na czysty.
W OTL kliknij CleanUp .
Wykonaj pełny skan Malwarebytes’ Anti-Malware
Gdy będą wirusy pokaż raport po usuwaniu.
Wyczyść rejestr i dysk CCleaner zbędniki z autostartu (Narzędzia -> Autostart).
peszir
22 Styczeń 2010 23:28
#5
