- Kod: Zaznacz wszystko
All processes killed
========== PROCESSES ==========
========== OTL ==========
Prefs.js: "Web Search" removed from browser.search.defaultengine
Prefs.js: "Web Search" removed from browser.search.defaultenginename
Prefs.js: "Web Search" removed from browser.search.order.1
Prefs.js: "http://search.bearshare.com/web?src=ffb&systemid=2&q=" removed from keyword.URL
C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\BearShareWebSearch.xml moved successfully.
C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\iMeshWebSearch.xml moved successfully.
C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\startsear.xml moved successfully.
C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\web-search.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{28387537-e3f9-4ed7-860c-11e69af4a8a0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\conhost deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\DOCUME~1\adm\USTAWI~1\Temp\csrss.exe deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Abami deleted successfully.
C:\WINDOWS.0\qademsn.dll moved successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS.0\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Documents and Settings\adm\Dane aplikacji\dwm.exe deleted successfully.
C:\WINDOWS.0\system32\secustat.dat moved successfully.
File C:\WINDOWS.0\System32\secushr.da not found.
C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 moved successfully.
C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 moved successfully.
File C:\WINDOWS.0\System32\secustat.dat not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: adm
->Temp folder emptied: 955317012 bytes
->Temporary Internet Files folder emptied: 69380786 bytes
->Java cache emptied: 6804869 bytes
->FireFox cache emptied: 114507368 bytes
->Flash cache emptied: 173019 bytes
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Administrator.MAK-65D94A4DB45
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 85615 bytes
->Google Chrome cache emptied: 6181837 bytes
User: All Users
User: All Users.WINDOWS.0
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User.WINDOWS.0
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService.ZARZĄDZANIE NT
->Temp folder emptied: 66097 bytes
->Temporary Internet Files folder emptied: 1629669 bytes
->Flash cache emptied: 456 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService.ZARZĄDZANIE NT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: user
->Temp folder emptied: 801375441 bytes
->Temporary Internet Files folder emptied: 47010536 bytes
->Java cache emptied: 3370344 bytes
->FireFox cache emptied: 287754039 bytes
->Flash cache emptied: 3010798 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2352022 bytes
%systemroot%\System32 .tmp files removed: 2596 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 27327247 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 2 219,00 mb
[EMPTYFLASH]
User: adm
->Flash cache emptied: 0 bytes
User: Administrator
User: Administrator.MAK-65D94A4DB45
User: All Users
User: All Users.WINDOWS.0
User: Default User
User: Default User.WINDOWS.0
User: LocalService
User: LocalService.ZARZĄDZANIE NT
->Flash cache emptied: 0 bytes
User: NetworkService
User: NetworkService.ZARZĄDZANIE NT
User: user
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0,00 mb
OTL by OldTimer - Version 3.2.26.5 log created on 08282011_200108
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Malwarebytes Anti-Malware:
- Kod: Zaznacz wszystko
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Wersja bazy: 7593
Windows 5.1.2600 Dodatek Service Pack 3
Internet Explorer 7.0.5730.13
2011-08-29 14:22:55
mbam-log-2011-08-29 (14-22-55).txt
Typ skanowania: Pełne skanowanie (C:\|)
Przeskanowano obiektów: 397851
Upłynęło: 1 godzin(y), 44 minut(y), 46 sekund(y)
Zainfekowanych procesów w pamięci: 0
Zainfekowanych modułów w pamięci: 0
Zainfekowanych kluczy rejestru: 2
Zainfekowanych wartości rejestru: 2
Zainfekowane informacje rejestru systemowego: 4
Zainfekowanych folderów: 0
Zainfekowanych plików: 12
Zainfekowanych procesów w pamięci:
(Nie znaleziono zagrożeń)
Zainfekowanych modułów w pamięci:
(Nie znaleziono zagrożeń)
Zainfekowanych kluczy rejestru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\betway (PUP.Casino.Gen) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INSTALL.EXE (PUP.Casino.Gen) -> Not selected for removal.
Zainfekowanych wartości rejestru:
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.
Zainfekowane informacje rejestru systemowego:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\fot.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Zainfekowanych folderów:
(Nie znaleziono zagrożeń)
Zainfekowanych plików:
c:\documents and settings\adm\dane aplikacji\Adobe\plugs\mmc28606421.txt (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\adm\moje dokumenty\pobieranie\betway(2).exe (PUP.Casino.Gen) -> Not selected for removal.
c:\documents and settings\adm\moje dokumenty\pobieranie\betway.exe (PUP.Casino.Gen) -> Not selected for removal.
c:\program files\counter-strike\cstrike\models\admin.cmd (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\program files\counter-strike\platform\Admin\adminserver.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\microgaming\Casino\Betway\install.exe (PUP.Casino.Gen) -> Not selected for removal.
c:\system volume information\_restore{2783a4ac-a7d5-4e39-b5e3-b514f459e962}\RP208\A0057791.cmd (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\program files\rld.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\program files\rldata.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\documents and settings\adm\dane aplikacji\Adobe\shed\thr1.chm (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\adm\dane aplikacji\Adobe\plugs\mmc153.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\adm\dane aplikacji\Adobe\plugs\mmc63.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
tak jak pisze w logu nie usuwałem kluczy rejestru bo nie wiem czy mozna czy cos od tego sie nei zepsuje (usunalem to co bylo podrazu po skanowaniu zaznaczone do usuniecia).
Z kompem robi sie chyba coraz lepiej bo przy starcie nie wyskakuja mi juz jakies komunikaty etc jednak Internet nadal mi nie działa.
