Zamulony komputer

wlodi93 · 24 Październik 2012 11:58

Chodzi normalnie pozniej wyskakuje pytanie o skrypt i komputer wolno chodzi. Sądze ze komputer jest zawirusowany. Zamieszczam logi i prosze o pomoc

log otl:http://www.wklej.org/id/853971/

eztras:http://www.wklej.org/id/853974/

Leon1 · 25 Październik 2012 17:23

odinstaluj

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

:OTL IE - HKU\S-1-5-21-4259270730-3687019806-2669523887-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?affID=110000 … 0000000000 IE - HKU\S-1-5-21-4259270730-3687019806-2669523887-1000\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = http://search.babylon.com/?affID=110000 … 0000000000 IE - HKU\S-1-5-21-4259270730-3687019806-2669523887-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=110000 … 0000000000 IE - HKU\S-1-5-21-4259270730-3687019806-2669523887-1000…\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-4259270730-3687019806-2669523887-1000…\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-4259270730-3687019806-2669523887-1000…\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-4259270730-3687019806-2669523887-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=110000&tt=120912_pcp_3712_7&babsrc=SP_ss&mntrId=80b0af9e000000000000000000000000 FF - prefs.js…browser.search.defaultenginename: “Search the web (Babylon)” FF - prefs.js…browser.search.order.1: “Search the web (Babylon)” FF - prefs.js…browser.search.selectedEngine: “Search the web (Babylon)” FF - prefs.js…browser.startup.homepage: “http://search.babylon.com/?affID=110000&tt=120912_pcp_3712_7&babsrc=HP_ss&mntrId=80b0af9e000000000000000000000000” FF - prefs.js…extensions.enabledAddons: ffxtlbr@babylon.com:1.5.0 FF - prefs.js…extensions.enabledAddons: {b64982b1-d112-42b5-b1e4-d3867c4533f8}:2.2.643.41 FF - prefs.js…sweetim.toolbar.previous.browser.search.defaultenginename: “Search the web (Babylon)” [2012-09-17 02:06:15 | 000,000,000 | —D | M] (Babylon) – C:\Users\Szabla\AppData\Roaming\mozilla\Firefox\Profiles\em6629t8.default\extensions\ffxtlbr@babylon.com [2012-09-14 20:08:00 | 000,002,223 | ---- | M] () – C:\Users\Szabla\AppData\Roaming\mozilla\firefox\profiles\em6629t8.default\searchplugins\BabylonMngr.xml [2012-09-14 20:07:41 | 000,002,360 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml CHR - default_search_provider: search_url = https://isearch.avg.com/search?cid={FA4BD14B-9589-47D6-AC73-17576CD7B144}&mid=eca61accd06047d0adaad14a4b543ff8-30daff233dec1833dce41188900e7e3949ff33fa〈=pl&ds=AVG&pr=pr&d=2012-08-04 20:32:56&v=12.1.0.21&sap=dsp&q={searchTerms} O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.6.9.12\bh\BabylonToolbar.dll (Babylon BHO) O3 - HKLM…\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found. O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) PRC - [2012-10-10 13:24:19 | 002,309,656 | ---- | M] () – C:\ProgramData\Browser Manager\2.3.787.43{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe MOD - [2012-10-19 10:36:52 | 000,430,616 | ---- | M] () – C:\ProgramData\Browser Manager\2.3.787.43{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\components\browsemngr-16.0.dll MOD - [2012-10-10 13:24:19 | 002,309,656 | ---- | M] () – C:\ProgramData\Browser Manager\2.3.787.43{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe MOD - [2012-10-10 13:23:16 | 002,068,504 | ---- | M] () – c:\ProgramData\Browser Manager\2.3.787.43{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll SRV - [2012-10-10 13:24:19 | 002,309,656 | ---- | M] () [Auto | Running] – C:\ProgramData\Browser Manager\2.3.787.43{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe – (Browser Manager) O20 - AppInit_DLLs: (c:\progra~2\browse~1\23787~1.43{16cdf~1\browse~1.dll) - c:\ProgramData\Browser Manager\2.3.787.43{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll () O20 - AppInit_DLLs: (c:\progra~2\browse~1\22643~1.41{16cdf~1\browse~1.dll) - File not found [2012-10-24 12:54:05 | 000,001,036 | ---- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012-10-24 12:41:03 | 000,000,930 | ---- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job [2012-10-24 12:16:37 | 000,001,032 | ---- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012-10-24 12:16:35 | 000,000,330 | ---- | M] () – C:\Windows\tasks\DriverScanner.job [2012-09-14 20:07:31 | 000,000,000 | —D | M] – C:\Users\Szabla\AppData\Roaming\Babylon [2012-09-14 20:08:12 | 000,000,000 | —D | M] – C:\Users\Szabla\AppData\Roaming\BabylonToolbar :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp]

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

Pokaż log z usuwania.

potem nowy log OTL robiony opcją Run Scan (Skanuj)