Sprawdzenie otl cyberprzestepczosc

[sliwka3 (S Dobiech)]

Witam! Proszę o sprawdzenie plikow. Mam problem z wirusem ‘cyberprzestepczosc…’

OTL

Extras

Windows XP (home edidtion)

[Atis]

Odinstaluj:

Winamp Toolbar

My Global Search Bar

McAfee Security Scan Plus

GamingHarbor Toolbar

Family Toolbar

MediaBar 2.0

Complitly

pdfforge Toolbar

Internet Explorer Toolbar 4.6 by SweetPacks

Pobierz AdwCleaner

Zamknij przeglądarkę internetową.

Uruchom AdwCleaner i kliknij Delete.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\w810obex.sys – (w810obex) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\w810mgmt.sys – (w810mgmt) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\w810mdm.sys – (w810mdm) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\w810mdfl.sys – (w810mdfl) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\w810bus.sys – (w810bus) [2010-02-28 19:05:45 | 000,000,000 | —D | M] (4shared.com Toolbar) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\extensions{09ec805c-cb2e-4d53-b0d3-a75a428b81c7} [2010-03-10 14:45:41 | 000,000,000 | —D | M] (Winamp Toolbar) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2012-03-19 20:40:41 | 000,000,000 | —D | M] (Complitly - Speed up your search with your personal search suggestions tool) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\extensions{33e0daa6-3af3-d8b5-6752-10e949c61516} [2010-12-09 19:33:03 | 000,000,000 | —D | M] (MyAshampoo Toolbar) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\extensions{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2012-09-05 17:15:56 | 000,000,000 | —D | M] (SweetPacks Toolbar for Firefox) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\extensions{EEE6C361-6118-11DC-9C72-001320C79847} [2011-12-08 19:16:53 | 000,000,000 | —D | M] (Babylon) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\extensions\ffxtlbr@babylon.com [2010-12-20 18:52:25 | 000,002,567 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\searchplugins\askcom.xml [2010-01-20 12:19:10 | 000,000,923 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\searchplugins\conduit.xml [2012-09-05 17:25:04 | 000,003,983 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\searchplugins\sweetim.xml [2010-03-10 17:09:24 | 000,001,201 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\s9r1atza.default\searchplugins\winamp-search.xml [2009-09-29 21:13:42 | 000,000,000 | —D | M] (Sukoku) – C:\Program Files\Mozilla Firefox\extensions{7AB6D133-2A14-4C11-B3AD-35B1548D38F9} [2010-11-01 19:32:37 | 000,000,000 | —D | M] (Family Toolbar) – C:\Program Files\Mozilla Firefox\extensions{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} [2010-11-01 19:32:34 | 000,003,803 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\MyHeritage.xml [2009-09-29 21:13:42 | 000,002,381 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\sukoku119.xml O2 - BHO: (TinyBHO Class) - {00e71626-0bef-11dc-8314-0800200c9a66} - C:\Documents and Settings\user\Dane aplikacji\DownloaderGold\ieplug.dll () O2 - BHO: (TinyBHO Class) - {00e71626-0bef-11dc-8314-0864264c9a64} - C:\Documents and Settings\user\Dane aplikacji\DownloaderGold\ieplug.dll () O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found O4 - HKLM…\Run: [NBKeyScan] “C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe” File not found O4 - HKLM…\Run: [ROC_ROC_NT] “C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe” / /PROMPT /CMPID=ROC_NT File not found O4 - HKLM…\Run: [sweetpacks Communicator] C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe File not found O4 - HKCU…\Run: [] File not found O4 - HKCU…\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart File not found O4 - HKCU…\Run: [iVONA Reader] “D:\Program Files\IVONA\IVONA Reader\IVONA Reader.exe.exe” -t -nosplash File not found O4 - HKCU…\Run: [MsnMsgr] ~“C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe” /background File not found O4 - HKCU…\Run: [smileyApp] C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stbapp.exe File not found O4 - Startup: C:\Documents and Settings\user\Menu Start\Programy\Autostart\ctfmon.lnk = C:\Documents and Settings\All Users\Dane aplikacji\lsass.exe (Microsoft Corporation) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Reg Error: Key error.) :Files C:\t* C:\Documents and Settings\All Users\Dane aplikacji\lsass.exe C:\Documents and Settings\user\Menu Start\Programy\Autostart\ctfmon.lnk C:\Documents and Settings\All Users\Dane aplikacji\0tbpw.pad :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

[sliwka3 (S Dobiech)]

OTL:

[Atis]

Nie wklejaj raportów bezpośrednio do posta.

Gdzie jest raport z usuwana OTL?

Skrypt nie został wykonany, więc wykonaj poprzedni skrypt w OTL.

Pokaż raport z usuwania i nowy log.

W razie problemów uruchom system w trybie awaryjnym i wtedy wykonaj skrypt.

Po uruchomieniu komputera naciskaj klawisz F8 i wybierz tryb awaryjny.

https://support.kaspersky.com/pl/faq?SS … 3238595#q1

[sliwka3 (S Dobiech)]

wybacz, rzeczywiście za pierwszym razem skrypt sie nie wykonał. Tylko, że tym razem podczasponownego uruchamiania komputer się zawiesił…

powinnam go zrestartować czy coś? bo szczerze mówiąc pierwszy raz robie coś takiego.

[Atis]

W takim razie zrestartuj.

A logi umieszczaj na http://wklej.org/

[sliwka3 (S Dobiech)]

nie potrafie znaleźć tego raportu…

[Atis]

Kliknij Skanuj i pokaż nowy log.

[sliwka3 (S Dobiech)]

inaczej nie dalam rady:

http://przeklej.net/file_details/28697.html

mam jeszcze cos takiego: http://wklej.org/id/867692/

[Atis]

Odinstaluj Family Toolbar.

Wklej i kliknij Wykonaj skrypt:

:OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page Restore = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page = http://www.iesearch.com/ IE - HKLM…\SearchScopes{BE28C22E-F666-424d-B5FD-125C4AFEE34E}: “URL” = http://search.myheritage.com?orig=ds&q={searchTerms} IE - HKCU…\SearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: “URL” = http://search.bearshare.com/webResults.html?src=ieb&q={searchTerms} IE - HKCU…\SearchScopes{BE28C22E-F666-424d-B5FD-125C4AFEE34E}: “URL” = http://search.myheritage.com?orig=ds&q={searchTerms} FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultenginename: “Search the web (Babylon)” FF - prefs.js…browser.search.defaultthis.engineName: “MyAshampoo Customized Web Search” FF - prefs.js…browser.search.order.1: “Search the web (Babylon)” FF - prefs.js…browser.search.param.yahoo-fr: “chr-greentree_ff&type=827316&ilc=12” FF - prefs.js…browser.startup.homepage: “http://search.babylon.com/?babsrc=HP_Prot” FF - prefs.js…extensions.enabledItems: ffxtlbr@babylon.com:1.2.0 FF - prefs.js…keyword.URL: “http://search.sweetim.com/search.asp?src=2&q=” FF - prefs.js…sweetim.toolbar.previous.browser.search.defaultenginename: “Search the web (Babylon)” FF - prefs.js…sweetim.toolbar.previous.browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}” FF - prefs.js…sweetim.toolbar.previous.browser.search.selectedEngine: “Search the web (Babylon)” FF - prefs.js…browser.startup.homepage: “http://search.babylon.com/home?affID=17425&tt=030912_10ftt_3612_8” FF - prefs.js…sweetim.toolbar.previous.keyword.URL: “http://search.sweetim.com/search.asp?src=2&q=” O2 - BHO: (Media Access Startup) - {25B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Media Access Startup\2.0.0.1050\HPIEAddOn.dll File not found O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll File not found O3 - HKLM…\Toolbar: (GamingHarbor Toolbar) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stb0.dll File not found O3 - HKLM…\Toolbar: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll File not found O3 - HKCU…\Toolbar\WebBrowser: (GamingHarbor Toolbar) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stb0.dll File not found O3 - HKCU…\Toolbar\WebBrowser: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll File not found O4 - HKLM…\Run: [bearShare] “D:\Program Files\BearShare\BearShare.exe” /pause File not found O4 - HKLM…\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr File not found @Alternate Data Stream - 48 bytes -> C:\WINDOWS:AED2F030E4D7F08D [2012-11-10 21:07:01 | 000,000,000 | —D | C] – C:\Documents and Settings\user\Ustawienia lokalne\Dane aplikacji\Winamp Toolbar :Files C:\Documents and Settings\All Users\Dane aplikacji\0tbpw.pad C:\t* :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

Pokaż raport i nowy log.

[sliwka3 (S Dobiech)]

OTL: http://wklej.org/id/867815/

i coś takiego: http://wklej.org/id/867816/

[Atis]

Wklej i kliknij Wykonaj skrypt:

:OTL IE - HKLM…\SearchScopes{A0B271A9-D8AA-8E74-7392-2164D6A1C03C}: “URL” = http://www.iesearch.com/s/?q={searchTerms} IE - HKCU…\URLSearchHook: {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - SOFTWARE\Classes\CLSID{1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48}\InprocServer32 File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\{872A1C39-DF0B-4c8b-AD84-12BA24A3B781}: C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\FFToolbar [2009-09-12 17:21:16 | 000,000,000 | —D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\{2224E955-00E9-4613-A844-CE69FCCAAE91}: C:\Program Files\Internet Saving Optimizer\3.8.1.4690\FF [2009-09-12 17:21:25 | 000,000,000 | —D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\{0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC}: C:\Program Files\Media Access Startup\2.0.0.1050\FF O2 - BHO: (MHTBPos00 Class) - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Family Toolbar\tbcore3.dll File not found O2 - BHO: (CMySite Class) - {D62EC836-BF1E-4CAC-81BE-FB9179835D8E} - C:\Program Files\Family Toolbar\mhxpcomi.dll File not found

Uruchom OTL i kliknij Sprzątanie.

Wyłącz i ponownie włącz przywracanie systemu:

http://support.microsoft.com/kb/310405/pl

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date

Dysk przeskanuj Malwarebytes-AntiMalware

Podczas instalacji usuń zaznaczenie przy Uruchom okres testowy Malwarebytes Anti-Malware PRO.

[sliwka3 (S Dobiech)]

checkup

Results of screen317’s Security Check version 0.99.54 Windows XP Service Pack 3 x86 Internet Explorer 7 Out of date! Antivirus/Firewall Check: avast! Free Antivirus Anti-malware/Other Utilities Check: Ad-Aware Java DB 10.5.3.0 Java 6 Update 32 Java 6 Update 3 Java 6 Update 6 Java 6 Update 7 Java SE Development Kit 6 Update 21 Java version out of Date! Adobe Flash Player 11.3.300.262 Adobe Reader 8 Adobe Reader out of Date! Adobe Reader X KB403742… Adobe Reader out of Date! Mozilla Firefox (3.5.19) Firefox out of Date! Process Check: objlist.exe by Laurent Ad-Aware AAWService.exe Ad-Aware AAWTray.exe AVAST Software Avast AvastSvc.exe AVAST Software Avast avastUI.exe System Health check Total Fragmentation on Drive C:: ````````````````````End of Log``````````````````````

[Atis]

Odinstaluj:

Java DB 10.5.3.0

Java 6 Update 32

Java 6 Update 3

Java 6 Update 6

Java 6 Update 7

Java SE Development Kit 6 Update 21

Adobe Reader 8

Później zainstaluj:

Internet Explorer 8

Adobe Reader

Java

Firefox

[sliwka3 (S Dobiech)]

dziękuję, dziękuję, dziękuję.<3