Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:
:OTL
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ag42ax68)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?barid={EBF14DC9-67B2-11E1-87CD-001617419A9D}
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=10&q={searchTerms}&barid={EBF14DC9-67B2-11E1-87CD-001617419A9D}
IE - HKLM\..\SearchScopes\ほ䔴䑃㐶ⴸ㠷㥆㐭㤷ⵂ䉁㜰䘭䉂ㅅ㔱㌲ㅄ紱: "URL" = http://sciagnij.toggle.com/pl/index.php?rvs=google
IE - HKLM\..\SearchScopes\ㅻ㐳㡅䉃ⴴ㘴㤲㐭〷ⴷ㕂㔹㈭㕅䌷〵䑂䑄紶: "URL" = http://sciagnij.toggle.com/pl/index.php?rvs=google
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=060612_8_&babsrc=SP_ss&mntrId=ec8ab5d5000000000000005345000000
IE - HKCU\..\SearchScopes\{682A7216-FA6A-48CC-8D8D-793CFBB02877}: "URL" = http://searchya.com/?chnl=fxtb-01&s=1&cr=1754935264&cd=2XzutAtN2Y1L1QzutN0D0TzutBtDtCtBtDtCtByB&q={searchTerms}
IE - HKCU\..\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: "URL" = http://home.speedbit.com/search.aspx?s=C91a206&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=10&q={searchTerms}&barid={EBF14DC9-67B2-11E1-87CD-001617419A9D}
IE - HKCU\..\SearchScopes\ほ䔴䑃㐶ⴸ㠷㥆㐭㤷ⵂ䉁㜰䘭䉂ㅅ㔱㌲ㅄ紱: "URL" = http://sciagnij.toggle.com/pl/index.php?rvs=google
IE - HKCU\..\SearchScopes\ㅻ㐳㡅䉃ⴴ㘴㤲㐭〷ⴷ㕂㔹㈭㕅䌷〵䑂䑄紶: "URL" = http://sciagnij.toggle.com/pl/index.php?rvs=google
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3031817&SearchSource=3&q={searchTerms}"
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\DOCUME~1\artur\USTAWI~1\Temp\Rar$EX64.875\Foxit PDF Editor & PDF Reader Pro 2011\App\FoxitReader\plugins\npFoxitReaderPlugin.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No CLSID value found.
[2011-04-13 06:38:38 | 000,000,000 | ---D | M](C:\WINDOWS\System32\?z??????U???) -- C:\WINDOWS\System32\z粐Ǡ粑Ǜ粑쿣睎
[2011-04-13 06:38:38 | 000,000,000 | ---D | C](C:\WINDOWS\System32\?z??????U???) -- C:\WINDOWS\System32\z粐Ǡ粑Ǜ粑쿣睎
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\artur\Moje dokumenty\Discoplex A4 sala disco dance 08.04.2012.aac:SummaryInformation
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\artur\Moje dokumenty\65678ac6002d1d6249732047:SummaryInformation
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:63238B95
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:56E2E879
:Commands
[emptytemp]
Kliknij Wykonaj skrypt i zatwierdź restart.
Pokaż raport z usuwania i nowy log Skanuj.
Użyj AdwCleaner http://www.dobreprogramy.pl/AdwCleaner,Blog,33490.html z funkcji Delete
Przeskanuj komputer http://www.dobreprogramy.pl/Dr.WEB-Cure ... 12976.html
Pokaż dwa logi z Gmer'a wykonane przy takich ustawieniach:
Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
