sprawdzenie logów

[nowy00]

Proszę o sprawdzenie logów z OTL.txt Dostępne tylko dla zarejestrowanych użytkowników Extras.txt Dostępne tylko dla zarejestrowanych użytkowników

[kominekl]

"UnityWebPlayer" = Unity Web Player
"TuneUp Utilities 2012_is1" = TuneUp Utilities 2012 wersja 12.0.3600.104
"Purmo C.O. 3.6_is1" = Purmo C.O. - Deinstalacja programu
"MozillaMaintenanceService" = Mozilla Maintenance Service
"InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}" = Samsung AllShare
"facemoods" = facemoods
"ESET Online Scanner" = ESET Online Scanner v3
"100 Beautiful Flowers Vol. 1" = 100 Beautiful Flowers Vol. 1 Screen Saver
"{FE77909E-B782-4554-A92A-4D887CEF0ACC}_is1" = ALLMediaServer
"{434D452D-5637-006A-76A7-A758B70C0600}" = Ask Toolbar

Odinstaluj. Poza tym użyj Dostępne tylko dla zarejestrowanych użytkowników.

Logi.

Uruchom OTL -> w oknie Własne opcje skanowania/skrypt wklej:

:OTL

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2530540236-2178637198-382495563-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Dostępne tylko dla zarejestrowanych użytkowników
IE - HKU\S-1-5-21-2530540236-2178637198-382495563-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2530540236-2178637198-382495563-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2530540236-2178637198-382495563-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&f=4
FF - prefs.js..browser.search.defaultengine: "Ask Search"
FF - prefs.js..browser.search.defaultenginename: "Ask Search"
FF - prefs.js..browser.search.order.1: "Ask Search"
FF - prefs.js..browser.startup.homepage: "http://www.search.ask.com/?p2=%5EB7N%5EYYYYYY%5EYY%5EPL&gct=hp&o=APN11293&apn_ptnrs=%5EB7N&apn_dtid=%5EYYYYYY%5EYY%5EPL&tpid=CME-V7&apn_dbr=ff_23.0&trgb=FF&apn_uid=6BB115BC-19A1-4B09-A10B-44062FFF7823&itbv=12.3.0.861&doi=2013-09-01&psv=barid%253D%257BFEBC57E0%252D1344%252D11E3%252DB380%252D001CC07AD966%257D%2526cargo%253DCME%252DV7%2526spr%253Da"
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Dom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
[2013-09-01 11:41:40 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Dom\AppData\Roaming\mozilla\Firefox\Profiles\wyxjx1as.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011-10-09 12:19:06 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Dom\AppData\Roaming\mozilla\Firefox\Profiles\wyxjx1as.default\extensions\ffxtlbr@Facemoods.com
[2013-04-17 14:59:39 | 000,000,000 | ---D | M] (Iplex to ALLPlayer) -- C:\Users\Dom\AppData\Roaming\mozilla\Firefox\Profiles\wyxjx1as.default\extensions\IplextoALL@ALLPlayer.org
[2011-09-14 19:42:33 | 000,010,043 | ---- | M] () (No name found) -- C:\Users\Dom\AppData\Roaming\mozilla\firefox\profiles\wyxjx1as.default\extensions\IplextoALL@ALLPlayer.org.xpi
[2013-10-31 23:36:55 | 000,479,330 | ---- | M] () (No name found) -- C:\Users\Dom\AppData\Roaming\mozilla\firefox\profiles\wyxjx1as.default\extensions\toolbar_CME-V7@apn.ask.com.xpi
[2013-04-19 10:03:22 | 000,014,676 | ---- | M] () (No name found) -- C:\Users\Dom\AppData\Roaming\mozilla\firefox\profiles\wyxjx1as.default\extensions\YouTubetoALL@ALLPlayer.org.xpi
[2010-10-10 15:46:56 | 000,004,669 | ---- | M] () (No name found) -- C:\Users\Dom\AppData\Roaming\mozilla\firefox\profiles\wyxjx1as.default\extensions\ffxtlbr@Facemoods.com\content\xpiInstallLgc.js
[2013-09-01 21:28:44 | 000,002,652 | ---- | M] () -- C:\Users\Dom\AppData\Roaming\mozilla\firefox\profiles\wyxjx1as.default\searchplugins\ask-search.xml
[2010-12-13 13:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O12 - Plugin for: .spop - C:\Program Files (x86)\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
[2013-10-31 23:08:15 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Dom\Desktop\HijackThis.exe
[2013-10-31 21:20:26 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Dom\Desktop\esetsmartinstaller_plk.exe
[2013-10-15 08:57:33 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013-10-31 23:01:09 | 000,591,536 | ---- | M] () -- C:\Users\Dom\Desktop\HijackThis 2.0.4_isdmgr.exe
[2012-03-07 20:48:40 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\Autodesk
[2012-03-18 20:38:57 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\concept design
[2012-02-27 21:19:33 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\DAEMON Tools Lite
[2011-12-26 15:10:35 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\DScaler4
[2012-02-24 20:26:26 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\EPSON
[2011-08-15 16:51:30 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\ESET
[2011-08-24 20:53:13 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\Foxit Software
[2011-08-15 19:45:19 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\GetRightToGo
[2011-07-02 12:07:19 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\InterTrust
[2012-09-02 20:29:28 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\Nokia
[2011-10-08 21:08:25 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\OpenCandy
[2012-09-02 20:24:36 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\PC Suite
[2012-01-15 11:11:14 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\Samsung
[2011-07-15 19:31:27 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\SpeedSim
[2012-10-27 21:53:37 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\TotalRecorder
[2012-11-04 09:01:03 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\TuneUp Software
[2012-12-10 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\Unity
[2011-08-15 20:58:03 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\WebcamZoneTrigger
[2011-10-09 16:18:02 | 000,000,000 | ---D | M] -- C:\Users\Dom\AppData\Roaming\Xilisoft
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2011-08-15 16:50:50 | 000,000,000 | ---D | M]

:Services
gupdate
gupdatem

:Files
C:\Program Files\ESET
C:\Program Files (x86)\Google\Update
C:\Users\Dom\AppData\LocalLow\Unity
C:\Windows\tasks\*.*

:Reg
[-HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

:Commands
[resethosts]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podaj log z Dostępne tylko dla zarejestrowanych użytkowników (z opcji Scan, a potem Clean) + nowe logi z OTL.

[nowy00]

pomogło ADWCleaner posprzątał i teraz jest spoko