Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:
:OTL
SRV - [2011-09-16 00:08:00 | 000,948,775 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=knos={searchTerms}f=4
O3:64bit: - HKLM\..\Toolbar: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [SpywareTerminator] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKCU..\Run: [ares] "C:\Program Files (x86)\Ares\Ares.exe" -h File not found
O4 - HKCU..\Run: [AVG-Secure-Search-Update_JUNE2013_TB] "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB File not found
O4 - HKCU..\Run: [SpywareTerminatorUpdate] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
[2014-04-09 21:58:48 | 000,000,000 | ---D | C] -- C:\ComboFix
[2014-04-08 03:14:48 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014-04-08 03:14:48 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014-04-08 03:14:48 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014-04-08 03:08:46 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014-04-16 01:07:19 | 000,000,431 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2014-03-21 23:25:12 | 000,049,952 | ---- | M] (AVG Technologies) -- C:\Windows\SysNative\drivers\avgtpx64.sys
[2014-04-08 03:14:48 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014-04-08 03:14:48 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014-04-08 03:14:48 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014-04-08 03:14:48 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014-04-08 03:14:48 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
:Commands
[emptytemp]
Kliknij Wykonaj skrypt.Po restarcie uruchom OTL i użyj opcji Sprzątanie.
Przeskanuj programem Malwarebytes Anti-Malware http://data-cdn.mbamupdates.com/v2/mbam/consumer/data/mbam-setup-2.0.0.1000.exe