Sprawdzenie logów z otl

[avik]

Chcę się pozbyć syfu z komputera. Mam logi wykonane przez OTL. Ponieważ jestem "lajkonikiem" to czy mogę prosić o dalsze wskazówki? Tutaj link do logów.

Dostępne tylko dla zarejestrowanych użytkowników

Z góry serdecznie dziękuję.

-- 26 paź 2012, 08:36 --

A i jeszcze plik extras.

Dostępne tylko dla zarejestrowanych użytkowników

[kominekl]

avik

Każdy ma mieć swój temat, ale tym razem darujemy, bo jesteś nowy, więc wydzielimy twój temat.

"{047B9A6A-21E7-45CF-8825-0A061EEF9B23}" = SweetIM Toolbar for Internet Explorer 4.3

Odinstaluj.

Logi.

Uruchom OTL -> w oknie Własne opcje skanowania/skrypt wklej:

:OTL

IE - HKLM\..\SearchScopes\{3EDAA304-6CF7-8B9F-874B-2F2F3B827566}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\SearchScopes\{3EDAA304-6CF7-8B9F-874B-2F2F3B827566}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\SearchScopes\{4E7804CD-E430-4e44-8030-5A9F140A191C}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&fr=chr-devicevm&type=STDVM
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\SearchScopes\{7E64327E-42EB-4bfb-A1DA-92EAB1C21D28}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&form=SPLBR2&pc=SPLH
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\SearchScopes\{854AF95D-D274-44cb-B4EE-43FBE84366C0}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A4067623346
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\..\SearchScopes\{BEFD0148-2E05-4853-B83C-92BCAF2F4D40}: "URL" = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&AF=100481&babsrc=SP_ss&mntrId=c2f5acf400000000000090e6bad07f8e
IE - HKU\S-1-5-21-379024971-224262061-3938275977-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
FF - prefs.js..browser.search.defaultengine: "Web Search"
FF - prefs.js..browser.search.defaultenginename: "Funmoods"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..extensions.enabledAddons: ffxtlbr@funmoods.com:1.5.1
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)"
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\user\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\user\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
[2011-12-31 16:42:54 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\aoi62n22.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2012-09-15 16:32:52 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\aoi62n22.default\extensions\ffxtlbr@babylon.com
[2012-10-25 22:34:52 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\aoi62n22.default\extensions\ffxtlbr@funmoods.com
[2012-10-10 21:49:22 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\aoi62n22.default\extensions\firebug@software.joehewitt.com.xpi
[2012-10-14 11:07:00 | 000,010,043 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\aoi62n22.default\extensions\IplextoALL@ALLPlayer.org.xpi
[2012-09-15 16:14:14 | 000,002,223 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\aoi62n22.default\searchplugins\BabylonMngr.xml
[2012-10-25 22:34:56 | 000,002,341 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\aoi62n22.default\searchplugins\Funmoods.xml
[2012-09-11 21:22:32 | 000,000,792 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\aoi62n22.default\searchplugins\startsear.xml
[2011-12-31 16:42:51 | 000,003,915 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\aoi62n22.default\searchplugins\sweetim.xml
[2012-10-12 11:37:36 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
CHR - Extension: No name found = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\
CHR - Extension: No name found = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O4:64bit: - HKLM..\Run: [tvncontrol] "C:\Program Files\TightVNC\tvnserver.exe" -controlservice -slave File not found
O4 - HKLM..\Run: [ROC_roc_ssl_v12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12 File not found
O4 - HKU\S-1-5-21-379024971-224262061-3938275977-1000..\Run: [Adobe Acrobat Synchronizer] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe" File not found
O4 - HKU\S-1-5-21-379024971-224262061-3938275977-1000..\Run: [Akamai NetSession Interface] "C:\Users\user\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} Dostępne tylko dla zarejestrowanych użytkowników (Java Plug-in 1.6.0_03)
[2012-09-26 21:15:50 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{44CB24B2-19FC-4B3A-804D-F97B5A55910C}
[2012-09-15 16:30:57 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{08457B8E-577F-4D48-BDAE-DE7D7DB94869}
[2012-08-25 21:13:22 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{F885F29C-40FC-4EDF-833D-CEF25658F207}
[2012-07-30 22:18:19 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{9A276E8B-7E07-4801-936B-AB5259E836CA}
[2012-07-30 22:18:08 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{28AFE82D-489B-43F8-A377-B7181EB22377}
[2012-07-27 21:39:40 | 000,000,000 | ---D | C] -- C:\Users\user\temp
[2012-07-01 18:21:33 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{17248461-EDE5-4C76-A6B4-A2B93F274ADF}
[2012-07-01 18:21:22 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{B7D44F45-C370-4680-B0EC-74B9780BD146}
[2012-06-19 18:50:29 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{2679D615-8E0E-4328-A789-8DC6130F3ED3}
[2012-05-30 20:05:54 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{B3DC50B3-19F9-4BFF-8260-099F4BC39B68}
[2012-02-13 19:30:24 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{B6200F1B-64EE-46E9-8890-E4742376139F}
[2012-02-13 19:30:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{B1052371-10BD-4D8A-A9EB-41A270649C68}
[2012-01-17 23:01:54 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{F796E067-01A6-4826-B415-EB508C071E67}
[2012-01-17 23:01:43 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{D7209154-0A51-48A5-A900-023EFC98FD2D}
[2012-01-06 22:42:41 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{48E3D8FD-FE08-4FE5-8F4F-0AB6505B926E}
[2012-01-06 22:42:31 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{BC46FE16-631F-447A-9724-D72CECC33F08}
[2011-12-28 23:30:11 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{F907DC43-65FD-40B2-B272-F1811A6D9127}
[2011-11-10 20:52:42 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{C8A8C327-1F40-44C8-A1A0-E0E4E1F5E2AD}
[2011-11-10 20:52:32 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\{9CF8DCFF-1034-4D54-ABD7-4EEBAB170D7D}
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:036B9593

:Files
C:\Users\user\AppData\Local\Google\Update
C:\Windows\tasks\*.*
C:\Users\user\AppData\Local\funmoods-speeddial_sf.crx
C:\Users\user\AppData\Local\funmoods.crx
C:\tvnviewer.zip

:Reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

:Commands
[emptyflash]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podaj log z ADWCleaner (z opcji Delete) -> Dostępne tylko dla zarejestrowanych użytkowników + log z TDSSKiller -> http://www.hotfix.pl/instrukcja-obslugi ... r-a341.htm + nowe logi z OTL + log z Autoruns -> http://www.hotfix.pl/optymalizacja-auto ... s-a128.htm.