Komputer zablokowany przez policje - wirus

[agatka36]

Witam, dziś Dopadł mnie wirus policja. W załączeniu logi OTL.
Proszę o pomoc

[wojtas]

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL

MOD - [2012-12-10 12:53:15 | 000,200,192 | ---- | M] () -- C:\Users\xxx\AppData\Local\Temp\wlsidten.dll
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosrfusb.sys -- (Tosrfusb)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tosrfsnd.sys -- (TosRfSnd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosrfnds.sys -- (tosrfnds)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Tosrfhid.sys -- (Tosrfhid)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\tosrfcom.sys -- (Tosrfcom)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosrfbd.sys -- (tosrfbd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosporte.sys -- (tosporte)
DRV - File not found [Kernel | Auto | Stopped] -- system32\DRIVERS\rimsptsk.sys -- (rimsptsk)
DRV - File not found [Kernel | Auto | Stopped] -- system32\DRIVERS\rimmptsk.sys -- (rimmptsk)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTo0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}
IE - HKLM\..\SearchScopes\{693120EE-5B37-4BC7-B89B-DE05EDD335BC}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=41154bd0-75e9-11e1-904e-00037a97786b&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20110329112937664&tb_oid=29-03-2011&tb_mrud=29-03-2011
IE - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL Inc.)
IE - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTo0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\InprocServer32 File not found
IE - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000\..\SearchScopes\{693120EE-5B37-4BC7-B89B-DE05EDD335BC}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=41154bd0-75e9-11e1-904e-00037a97786b&q={searchTerms}
IE - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={60C4A349-D803-4307-A47F-2E9DA48504E5}&mid=c6a74dd03e0d47d09dafd14a3c739198-b917ef12210a465735144b69a19c3eb36635eba8&lang=pl&ds=pd011&pr=sa&d=2012-09-26 18:25:05&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://www.bigseekpro.com/search/browser/burn4free/{0C6EC875-9D3F-4F41-8334-981AA21A88DF}?q={searchTerms}
IE - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20110329112937664&tb_oid=29-03-2011&tb_mrud=29-03-2011
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentBar Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "uTorrentBar Customized Web Search"
FF - prefs.js..browser.startup.homepage: "http://www.bigseekpro.com/burn4free/{0C6EC875-9D3F-4F41-8334-981AA21A88DF}"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=2&q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.sweetim.com/search.asp?barid=null&src=2&q="
[2011-09-08 15:59:33 | 000,000,000 | ---D | M] (Burn4Free DB Toolbar) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2012-08-27 11:26:51 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2012-05-06 20:32:49 | 000,002,354 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\bqccmnyq.default\searchplugins\aol-web-search.xml
[2012-08-26 15:01:12 | 000,000,925 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\bqccmnyq.default\searchplugins\conduit.xml
[2012-05-06 20:32:48 | 000,002,376 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\bqccmnyq.default\searchplugins\search.xml
[2012-11-10 21:48:49 | 000,003,574 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
O4 - HKU\S-1-5-21-1240398471-3160799311-2012267444-1000..\Run: [Galileo] C:\Users\xxx\AppData\Local\Galileo\galileo.exe silent File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Search the Web - C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O9 - Extra Button: ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll File not found
O9 - Extra 'Tools' menuitem : ArcaVir >> - {40525A66-DB98-480D-BCF9-7AF88C1AF438} - C:\Program Files\ArcaBit\WebExtensions\ie\ArcaIEExt.dll File not found
[2012-12-10 12:53:30 | 000,000,908 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2012-12-10 13:45:23 | 095,023,320 | ---- | M] () -- C:\ProgramData\netdislw.pad

:Commands
[emptytemp]

Kliknij wykonaj skrypt. I potwierdź reset komputera . ( system powinien zostać odblokowany)

odinstaluj:
SweetPacks Toolbar for Internet Explorer 4.5
"AVG Secure Search" = AVG Security Toolbar
"Browsers Protector" = Browsers Protector
"Burn4Free DB Toolbar" = Burn4Free DB Toolbar
"McAfee Security Scan" = McAfee Security Scan Plus
"StartSearch Toolbar" = StartSearch Toolbar 1.3
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"Winamp Toolbar" = Winamp Toolbar
"Ad-Aware" = Ad-Aware

Użyj AdwCleaner i kliknij w nim Delete (w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator)
Pokaż raport z niego

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzyła się po restarcie).

[agatka36]

Mam nadzieję że wszystko dobrze zrobiłam , w załącznikach wstawiłam raporty
ale przy włączaniu komputera wyskakuje mi okienko "Wystąpił błąd podczas ładowania wlsidten.dll
Nie można odnaleźć określonego modułu"


jeden pilik nie chcial sie wczytac to wklejam go tu :


All processes killed
========== OTL ==========
Releasing module C:\Users\xxx\AppData\Local\Temp\wlsidten.dll
C:\Users\xxx\AppData\Local\Temp\wlsidten.dll moved successfully.
Service Tosrfusb stopped successfully!
Service Tosrfusb deleted successfully!
File system32\DRIVERS\tosrfusb.sys not found.
Service TosRfSnd stopped successfully!
Service TosRfSnd deleted successfully!
File system32\drivers\tosrfsnd.sys not found.
Service tosrfnds stopped successfully!
Service tosrfnds deleted successfully!
File system32\DRIVERS\tosrfnds.sys not found.
Service Tosrfhid stopped successfully!
Service Tosrfhid deleted successfully!
File system32\DRIVERS\Tosrfhid.sys not found.
Service Tosrfcom stopped successfully!
Service Tosrfcom deleted successfully!
File System32\Drivers\tosrfcom.sys not found.
Service tosrfbnp stopped successfully!
Service tosrfbnp deleted successfully!
File System32\Drivers\tosrfbnp.sys not found.
Service tosrfbd stopped successfully!
Service tosrfbd deleted successfully!
File system32\DRIVERS\tosrfbd.sys not found.
Service tosporte stopped successfully!
Service tosporte deleted successfully!
File system32\DRIVERS\tosporte.sys not found.
Service rimsptsk stopped successfully!
Service rimsptsk deleted successfully!
File system32\DRIVERS\rimsptsk.sys not found.
Service rimmptsk stopped successfully!
Service rimmptsk deleted successfully!
File system32\DRIVERS\rimmptsk.sys not found.
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
File system32\DRIVERS\nwlnkfwd.sys not found.
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
File system32\DRIVERS\nwlnkflt.sys not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
File system32\DRIVERS\ipinip.sys not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{57BCA5FA-5DBB-45a2-B558-1755C3F6253B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}\ deleted successfully.
C:\Program Files\Winamp Toolbar\winamptb.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\ deleted successfully.
C:\Program Files\uTorrentBar\prxtbuTo0.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{693120EE-5B37-4BC7-B89B-DE05EDD335BC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{693120EE-5B37-4BC7-B89B-DE05EDD335BC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ not found.
Registry value HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{57BCA5FA-5DBB-45a2-B558-1755C3F6253B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}\ not found.
File C:\Program Files\Winamp Toolbar\winamptb.dll not found.
Registry value HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\ not found.
File C:\Program Files\uTorrentBar\prxtbuTo0.dll not found.
Registry value HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{CA3EB689-8F09-4026-AA10-B9534C691CE0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Internet Explorer\SearchScopes\{693120EE-5B37-4BC7-B89B-DE05EDD335BC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{693120EE-5B37-4BC7-B89B-DE05EDD335BC}\ not found.
Registry key HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Internet Explorer\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}\ not found.
Registry key HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ not found.
Prefs.js: "Web Search" removed from browser.search.defaultenginename
Prefs.js: "uTorrentBar Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Web Search" removed from browser.search.order.1
Prefs.js: "uTorrentBar Customized Web Search" removed from browser.search.selectedEngine
Prefs.js: "http://www.bigseekpro.com/burn4free/{0C6EC875-9D3F-4F41-8334-981AA21A88DF}" removed from browser.startup.homepage
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=2&q=" removed from keyword.URL
Prefs.js: "http://search.sweetim.com/search.asp?barid=null&src=2&q=" removed from sweetim.toolbar.previous.keyword.URL
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC} folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\Plugins folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\modules folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\META-INF folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\chrome folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\bqccmnyq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\bqccmnyq.default\searchplugins\aol-web-search.xml moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\bqccmnyq.default\searchplugins\conduit.xml moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\bqccmnyq.default\searchplugins\search.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml moved successfully.
Registry value HKEY_USERS\S-1-5-21-1240398471-3160799311-2012267444-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Galileo deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Search the Web\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{40525A66-DB98-480D-BCF9-7AF88C1AF438}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40525A66-DB98-480D-BCF9-7AF88C1AF438}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{40525A66-DB98-480D-BCF9-7AF88C1AF438}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40525A66-DB98-480D-BCF9-7AF88C1AF438}\ not found.
C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk moved successfully.
C:\ProgramData\netdislw.pad moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: xxx
->Temp folder emptied: 4270592793 bytes
->Temporary Internet Files folder emptied: 38980295 bytes
->Java cache emptied: 325016 bytes
->FireFox cache emptied: 337251623 bytes
->Flash cache emptied: 141787 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3890576107 bytes
RecycleBin emptied: 6637906024 bytes

Total Files Cleaned = 14 473,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 12102012_181607

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[wojtas]

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
O4 - HKCU..\Run: [DriverScanner] "C:\Program Files\Uniblue\DriverScanner\launcher.exe" delay 20000 File not found
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found
DRV - File not found [File_System | Boot | Stopped] -- system32\DRIVERS\Lbd.sys -- (Lbd)

:Commands
[emptytemp]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

*Uruchom OTL z opcji sprzątanie.
* wykonaj optymalizację Windowsa ( instrukcja dla Windowsa XP, lecz w innych systemach jest podobnie )
* zrób pełny skan Malwarebytes Anti-Malware (zaktualizuj, gdy coś znajdzie pokaż raport, i usuń wszystko to czego nie znasz za pomocą tego programu )
* wykonaj kroki finalizujące temat

to tyle. jak sytuacja

[agatka36]

Póki co po wirusie ani śladu
Wszystko bardzo długo trwa obecnie trwa skanowanie przez Malwarebytes ..
zobaczymy czy ten antywirus coś znajdzie . Oczywiście dam znać
Ale przy włączaniu znów pokazało mi się okno :
"Wystąpił błąd podczas ładowania wlsidten.dll
Nie można odnaleźć określonego modułu" ? to coś poważnego???

Dodano Dzisiaj, 23:02:
hmm.. nie jest tak kolorowo

[wojtas]

usuń co znalazł MBam i daj nowe logi

[agatka36]

logi ?

Dodano Dzisiaj, 23:33:
komputer włączył się bez zarzutu

[wojtas]

to wszystko

[agatka36]

Wielkie dzięki !!!!!
Mam jeszcze pytanko jaki program polecasz na przyszłość aby zapobiec takim infekcjom?

[wojtas]

program tu wiele nie pomoże , aktualizuj na bieżąco Jave, wtyczki do przeglądarek,
dobra strona do Firefoxa:

https://www.mozilla.org/pl/plugincheck/

wskazuje nieaktualne rzeczy

Autor postu otrzymał pochwałę