Prosze o interpretacje logow

[iwonatje]

raporty ze skanu

[ordynat]

Kosmetyka:
Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\zd1211Bu.sys -- (ZD1211BU(Atheros)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_juextctrl.sys -- (huawei_ext_ctrl)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jucdcecm.sys -- (huawei_cdcecm)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jucdcacm.sys -- (huawei_cdcacm)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_usbenumfilter.sys -- (ew_usbenumfilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - File not found [File_System | Auto | Stopped] -- system32\DRIVERS\avgntflt.sys -- (avgntflt)
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Dane aplikacji\Browser Manager\2.3.787.43\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension
[2013-07-11 18:37:01 | 000,006,507 | ---- | M] () -- C:\Documents and Settings\ivona\Dane aplikacji\Mozilla\Firefox\Profiles\ewm2ey17.default\searchplugins\babylon.xml
[2013-07-11 18:37:01 | 000,006,507 | ---- | M] () -- C:\Documents and Settings\ivona\Dane aplikacji\Mozilla\Firefox\Profiles\ewm2ey17.default\searchplugins\BrowserDefender.xml
[2013-07-11 18:39:27 | 000,001,294 | ---- | M] () -- C:\Documents and Settings\ivona\Dane aplikacji\Mozilla\Firefox\Profiles\ewm2ey17.default\searchplugins\delta.xml
[2012-09-23 18:10:07 | 000,002,360 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-1715567821-764733703-1202660629-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-1715567821-764733703-1202660629-1001\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O20 - HKLM Winlogon: UserInit - (C:\Program Files\VAWTgNjJýÓcŽÍewkyxetq.exe\ewkyxetq.exe) - File not found
[2012-09-11 09:01:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Babylon
[2012-11-07 11:35:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\~Browser Manager
[2012-09-11 09:01:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ivona\Dane aplikacji\Babylon
[2013-08-28 19:14:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Tarma Installer

:Files
C:\Documents and Settings\All Users\Dane aplikacji\Browser Manager
RECYCLER /alldrives

:Reg
[HKEY_USERS\S-1-5-21-1715567821-764733703-1202660629-1001\SOFTWARE\Microsoft\Internet Explorer\Main]
"BrowserMngr Start Page"=-
[HKEY_USERS\S-1-5-21-1715567821-764733703-1202660629-1001\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com/"
[HKEY_USERS\S-1-5-21-1715567821-764733703-1202660629-1001\Software\Microsoft\Internet Explorer\SearchScopes]
"BrowserMngrDefaultScope"=-
[HKEY_USERS\S-1-5-21-1715567821-764733703-1202660629-1001\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[-HKEY_USERS\S-1-5-21-1715567821-764733703-1202660629-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

O20 - HKLM Winlogon: UserInit - (C:\Program Files\VAWTgNjJýÓcŽÍewkyxetq.exe\ewkyxetq.exe)

To mi wygląda na wirusa RAMNIT/NIMNUL.
Sprawdzimy to, a jeśli to okaże się prawdą, to konieczne będzie sformatowanie dysku i wgranie Systemu od nowa, bo usuwanie tego wirusa trwałoby przez kilka miesięcy., a nawet lat.
Użyj >http://www.programosy.pl/program,dr-web-cureit.html
Napisz, co wykrył.

Są też ślady infekcji pendrivowej.