Zmulony komp, możliwość infekcji

[anon47952867]

Witam! Ostatnio mój komputer jest zmulony, zanim jakiś program się uruchomi mija 1-2 min zazwyczaj uruchamiało się natychmiastowo.

OTL http://wklej.to/SuQqg

Extras http://wklej.to/2LQYZ

[Acorus]

Odinstaluj McAfee Security Scan Plus,Softonic toolbar on IE and Chrome,Winamp Toolbar.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\rdvgkmd.sys – (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] – system32\drivers\tsusbhub.sys – (tsusbhub) DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\synth3dvsc.sys – (Synth3dVsc) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\EagleXNt.sys – (EagleXNt) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\EagleNT.sys – (EagleNT) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Edi\AppData\Local\Temp\catchme.sys – (catchme) IE - HKLM…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.) IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\URLSearchHook: {0F3DC9E0-C459-4a40-BCF8-747BD9322E10} - C:\Program Files\Splashtop\Splashtop Connect IE\AddressBarSearch.dll (Splashtop Inc.) IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.) IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=111855&babsrc=SP_ss&mntrId=8e769405000000000000000000000000 IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\SearchScopes{9290F064-E5FE-4AA2-A09F-6E430A99A249}: “URL” = http://search.softonic.com/MON00084/tb_v1?q={searchTerms}&SearchSource=4&cc= IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\SearchScopes{95B7759C-8C7F-4BF1-B163-73684A933233}: “URL” = http://isearch.avg.com/search?cid={0F4C2AA0-582E-48B6-8BD9-DD8DC9A5A15D}&mid=a4fbc701157c47d185cf81ac0fd8d5d1-5805f112f326a68ed0f2605856b4a4ddd33b2c03〈=pl&ds=AVG&pr=fr&d=2012-06-02 18:24:56&v=11.1.0.7&sap=dsp&q={searchTerms} IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\SearchScopes{C6C94987-71E3-4a4a-897D-B6186C96A4DC}: “URL” = http://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/red … 685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120111201709251&tb_oid=11-01-2012&tb_mrud=11-01-2012 IE - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\SearchScopes{F412A1E2-0DA4-48D4-A5E6-E11FAE0A5EDE}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=en_NL&apn_ptnrs=U3&apn_dtid=OSJ000YYNL&apn_uid=423149FC-105B-4FC3-8157-6B62ED10F72F&apn_sauid=9408B589-9A93-4692-8EF6-95FD78514ECD FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultenginename: “AVG Secure Search” FF - prefs.js…browser.search.order.1: “Ask.com” FF - prefs.js…browser.search.selectedEngine: “AVG Secure Search” FF - prefs.js…extensions.enabledAddons: ffxtlbra@softonic.com:1.6.0 FF - prefs.js…extensions.enabledAddons: avg@toolbar:11.1.0.12 FF - prefs.js…keyword.URL: “http://isearch.avg.com/search?cid={1b9119ab-b2fd-4698-b1dc-d245e0477857}&mid=a4fbc701157c47d185cf81ac0fd8d5d1-5805f112f326a68ed0f2605856b4a4ddd33b2c03&ds=AVG&v=11.1.0.12〈=pl&pr=fr&d=2012-06-02%2018%3A24%3A56&sap=ku&q=” [2012-05-15 13:36:20 | 000,000,000 | —D | M] (Winamp Toolbar) – C:\Users\Edi\AppData\Roaming\mozilla\Firefox\Profiles\c4q7n6qh.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2012-05-15 15:22:10 | 000,000,000 | —D | M] (softonic.com) – C:\Users\Edi\AppData\Roaming\mozilla\Firefox\Profiles\c4q7n6qh.default\extensions\ffxtlbra@softonic.com [2012-08-09 23:15:00 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Users\Edi\AppData\Roaming\mozilla\Firefox\Profiles\c4q7n6qh.default\extensions\toolbar@ask.com [2012-08-09 23:15:00 | 000,002,299 | ---- | M] () – C:\Users\Edi\AppData\Roaming\mozilla\firefox\profiles\c4q7n6qh.default\searchplugins\askcom.xml [2012-05-14 07:57:33 | 000,002,060 | ---- | M] () – C:\Users\Edi\AppData\Roaming\mozilla\firefox\profiles\c4q7n6qh.default\searchplugins\softonic.xml O3 - HKLM…\Toolbar: (Bing Bar) - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) O3 - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\S-1-5-21-4189110737-4248160625-3405457846-1000…\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.) O4 - HKLM…\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) :Commands [emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.

Użyj AdwCleaner http://general-changelog-team.fr/outils/289-adwcleaner z funkcji Delete(w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator).

Przeskanuj progr.Malwarebytes Anti-Malware http://www.malwarebytes.org/products/malwarebytes_free

Przed skanowaniem wykonaj RĘCZNĄ AKTUALIZACJĘ BAZY SYGNATUR WIRUSÓW Malwarebytesa “Uruchom Malwarebytes, przejdź do zakładki Aktualizacja, Sprawdź aktualizacje.”

[anon47952867]

Zrobiłem już to wszystko, co teraz?