"UnityWebPlayer" = Unity Web Player
"Windows Searchqu Toolbar" = Windows Searchqu Toolbar
"Vividas Player Plugin_is1" = Vividas Player Plugin v4.1
"Updater Service" = Updater Service
"shareazatoolbarguid" = Search-Results Toolbar
"Softonic" = Softonic toolbar on IE and Chrome
"ALLPlayer V2.3.1_is1" = ALLPlayer V2.3.1
"NFSNationUCSaveEditor" = NFSNation Undercover Save Editor (jeśli nie używasz)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"InstallShield_{C8E60E40-D198-4362-A2D9-4F82A9D110F8}" = TMNT Demo
"DMX5_is1" = DriverMax 7
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"AVG SafeGuard toolbar" = AVG SafeGuard toolbar
"AVG Secure Search" = AVG Security Toolbar
Odinstaluj. Poza tym użyj Dostępne tylko dla zarejestrowanych użytkowników.
Logi.
Uruchom OTL -> w oknie Własne opcje skanowania/skrypt wklej:
:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe -- (vToolbarUpdater14.2.0)
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc -- (gupdatem)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /svc -- (gupdate)
DRV - File not found [File_System | Auto | Stopped] -- -- (StarOpen)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP3a\WNt500x86\Sandra.sys -- (SANDRA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\igxpmp32.sys -- (ialm)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbfake.sys -- (hwusbfake)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (avyu13g5)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (arm7trdt)
DRV - [2013-09-10 21:43:34 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\WINDOWS\system32\drivers\ubixjejj.sys -- (afmnumv)
DRV - [2013-08-14 19:17:00 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Dostępne tylko dla zarejestrowanych użytkowników
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Dostępne tylko dla zarejestrowanych użytkowników
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&SearchSource=4&cc=&mi=3ce807ac000000000000000cf6fdca86&r=359
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&installDate=22/03/2013
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Dostępne tylko dla zarejestrowanych użytkowników
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&installDate=22/03/2013
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&babsrc=SP_ss_Btisdt3&mntrId=3CE8000CF6FDCA86&affID=119357&tsp=4977
IE - HKCU\..\SearchScopes\{DCDBBF03-BC10-457D-911F-EFB0321D22BE}: "URL" = ${SRCH_SCP_URL}
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..extensions.enabledItems: ffxtlbr@delta.com:1.5.0
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@ganymede/CARDS,version=1.0: C:\Program Files\Ganymede\Plugins\CARDS\NPCARDS.dll File not found
FF - HKLM\Software\MozillaPlugins\@ganymede/DARTS,version=1.0: C:\Program Files\Ganymede\Plugins\DARTS\NPDARTS.dll File not found
FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files\Ganymede\Plugins\npganymedenet.dll File not found
FF - HKLM\Software\MozillaPlugins\@ganymede/WORDSSINGLE,version=1.0: C:\Program Files\Ganymede\Plugins\WORDSSINGLE\NPWORDSSINGLE.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll File not found
FF - HKLM\Software\MozillaPlugins\@vividas.com/npVividasPlayer: C:\Program Files\Vividas\Player\npVividasPlayer.dll ( )
FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{77BEC163-D389-42c1-91A4-C758846296A5}: C:\Program Files\Video downloader\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\Documents and Settings\All Users\Dane aplikacji\AVG SafeGuard toolbar\FireFoxExt\15.5.0.2 [2013-08-14 19:17:20 | 000,000,000 | ---D | M]
[2013-08-14 21:32:43 | 000,171,002 | ---- | M] () (No name found) -- C:\Documents and Settings\MA VW\Dane aplikacji\Mozilla\Firefox\Profiles\x1h1jwi5.default\extensions\jid0-irAmugmQgdURBSCIFZAcjR8ZQMg@jetpack.xpi
[2013-06-13 22:23:04 | 000,020,591 | ---- | M] () (No name found) -- C:\Documents and Settings\MA VW\Dane aplikacji\Mozilla\Firefox\Profiles\x1h1jwi5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2013-07-31 19:47:00 | 000,824,302 | ---- | M] () (No name found) -- C:\Documents and Settings\MA VW\Dane aplikacji\Mozilla\Firefox\Profiles\x1h1jwi5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013-08-02 16:17:42 | 000,006,507 | ---- | M] () -- C:\Documents and Settings\MA VW\Dane aplikacji\Mozilla\Firefox\Profiles\x1h1jwi5.default\searchplugins\babylon.xml
[2013-08-02 16:17:42 | 000,006,507 | ---- | M] () -- C:\Documents and Settings\MA VW\Dane aplikacji\Mozilla\Firefox\Profiles\x1h1jwi5.default\searchplugins\BrowserDefender.xml
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0\
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh\1.0.96.0_0\
CHR - Extension: No name found = C:\Documents and Settings\MA VW\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll File not found
O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll File not found
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll File not found
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (Search-Results Toolbar) - {ade92211-31dc-4775-85c0-75659b099dd3} - C:\PROGRA~1\IMESHA~1\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll File not found
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll File not found
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Mateusz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll File not found
O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll File not found
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll File not found
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll File not found
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {ade92211-31dc-4775-85c0-75659b099dd3} - C:\PROGRA~1\IMESHA~1\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll File not found
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll File not found
O4 - HKLM..\Run: [BEWINTERNET-PLSessionManager] "C:\Program Files\OrangeBS\BEWInternet-PL\SessionManager\SessionManager.exe" File not found
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [SIXPACK] SiXPack.exe /minimize File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} Dostępne tylko dla zarejestrowanych użytkowników (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Dostępne tylko dla zarejestrowanych użytkowników (Java Plug-in 10.25.2)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll (AVG Secure Search)
O20 - AppInit_DLLs: (c:\docume~1\alluse~1\daneap~1\wincert\win32c~1.dll) - c:\Documents and Settings\All Users\Dane aplikacji\Wincert\win32cert.dll ()
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - File not found
[2013-08-17 20:24:32 | 071,393,746 | ---- | C] (KTW ) -- C:\Documents and Settings\MA VW\Moje dokumenty\testy2013B-setup.exe
[2010-12-31 01:21:21 | 000,462,112 | ---- | C] (How Inc.) -- C:\Program Files\Common Files\ZugoInstaller.exe
[2013-09-10 12:40:56 | 001,085,952 | ---- | M] () -- C:\Dew.CryptoView.msi
[2013-08-14 19:17:26 | 000,003,725 | ---- | M] () -- C:\Program Files\Mozilla Firefoxsafeguard-secure-search.xml
[2013-08-14 19:17:00 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013-04-25 16:09:00 | 001,154,048 | ---- | C] () -- C:\WINDOWS\is-2GKGN.exe
[2010-12-28 00:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\382CE
[2010-12-17 13:57:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Alwil Software
[2011-02-19 13:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo
[2013-06-19 21:09:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AVG SafeGuard toolbar
[2013-01-23 14:52:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AVG Secure Search
[2013-01-24 15:56:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Babylon
[2013-01-22 14:57:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\boost_interprocess
[2011-02-11 16:05:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Electronic Arts
[2013-01-24 15:56:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\IBUpdaterService
[2011-08-23 16:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\INFO-TECH
[2011-01-26 22:45:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla
[2011-02-03 16:52:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Kazaa Lite
[2010-12-29 20:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI
[2011-11-23 15:43:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
[2010-12-31 01:24:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ReviverSoft
[2011-06-06 19:41:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SRS Labs
[2013-04-25 13:43:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Tarma Installer
[2013-04-25 16:44:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
[2011-10-20 20:04:02 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\UZC
[2013-01-21 23:05:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Wincert
[2013-06-19 21:09:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\AVG SafeGuard toolbar
[2013-06-08 00:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\BabSolution
[2013-05-23 21:27:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\Babylon
[2013-06-03 16:59:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\OpenCandy
[2013-05-09 21:54:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\searchquband
[2013-05-17 13:03:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\searchqutoolbar
[2013-05-09 21:54:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\searchresultstb
[2013-05-09 21:54:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\shareazatoolbarguid
[2013-07-31 22:10:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\Softonic
[2013-07-07 20:44:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MA VW\Dane aplikacji\Unity
[2011-08-18 10:43:12 | 000,000,000 | ---D | M](C:\WINDOWS\System32\U???) -- C:\WINDOWS\System32\Ǜ粑쿣睎
[2011-08-18 10:43:12 | 000,000,000 | ---D | C](C:\WINDOWS\System32\U???) -- C:\WINDOWS\System32\Ǜ粑쿣睎
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:373E1720
:Services
gupdate
gupdatem
:Files
C:\Program Files\Google\Update
C:\Program Files\Yahoo!
C:\Program Files\Vividas
C:\WINDOWS\tasks\*.*
:Reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
:Commands
[resethosts]
[clearallrestorepoints]
[emptytemp]
Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podaj log z Dostępne tylko dla zarejestrowanych użytkowników (z opcji Scan, a potem Clean) + log z Combofix + log z USBFix (z podłączonymi pamięciami przenośnymi z opcji Deletion) + nowe logi z OTL.
.