
OTL: http://wklej.org/id/371450/
Extras: http://wklej.org/id/371452/
GMER: http://wklej.org/id/371454/
:Processes
explorer.exe
:OTL
PRC - [2013-11-24 14:24:54 | 000,053,765 | ---- | M] (gy) -- C:\WINDOWS\Fonts\VTT.exe
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKU\S-1-5-21-343818398-842925246-854245398-1003\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKU\S-1-5-21-343818398-842925246-854245398-1003\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [RavTimeXP] C:\WINDOWS\Fonts\VTT.exe (gy)
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm ()
:Files
C:\WINDOWS\Fonts\VTT.exe
C:\Documents and Settings\123\Dane aplikacji\Mozilla\Firefox\Profiles\28j8pht3.default\searchplugins\winamp-search.xml
C:\Documents and Settings\123\Dane aplikacji\Mozilla\Firefox\Profiles\28j8pht3.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
C:\Program Files\Winamp Toolbar
C:\Program Files\Program Files.exe
C:\Documents and Settings\All Users\Dokumenty\Dokumenty.exe
C:\WINFILE.EXE
C:\Documents and Settings\123\SMSWINFILE.EXE
C:\WINDOWS\MShelp.EXE
C:\Documents and Settings\123\SMSdesktop.ini
C:\Documents and Settings\123\SMScomment.htt
C:\comment.htt
:Commands
[emptytemp]
[start explorer]
[Reboot]
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 7 gości