Win32/ponmocup.aa w pamięci operacyjnej

[ankad]

Komunikat Noda: Pamięć operacyjna>>rundll32.exe(3180) prawdopodobnie Win32/Ponmocup.AA, nie można usunąć. Nie widzę jakichś specjalnych problemów w działaniu komputera niemniej jednak chciałabym pozbyć się tego czegoś.
System Windows 7 Home Premium 64bit
Dodaję wymagane pliki mam nadzieję, że poprawnie. Proszę o pomoc.

[defacto19]

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt)wklej

:OTL
MOD - [2012-07-22 12:31:33 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEME37B.tmp
MOD - [2012-07-22 12:31:32 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMDF9C.tmp
MOD - [2012-07-22 12:31:32 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEME232.tmp
MOD - [2012-07-22 12:31:32 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEME1F1.tmp
MOD - [2012-07-22 12:31:32 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEME1D0.tmp
MOD - [2012-07-22 12:31:31 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMDDE3.tmp
MOD - [2012-07-22 12:31:31 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMDD45.tmp
MOD - [2012-07-22 12:31:31 | 000,033,792 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\YTMP7MC8AA\TAADECF.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD9D9.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD95A.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD8CC.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD86C.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD82C.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD7CC.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD77C.tmp
MOD - [2012-07-22 12:31:30 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD70D.tmp
MOD - [2012-07-22 12:31:29 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD650.tmp
MOD - [2012-07-22 12:31:29 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD5A2.tmp
MOD - [2012-07-22 12:31:29 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD533.tmp
MOD - [2012-07-22 12:31:29 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD495.tmp
MOD - [2012-07-22 12:31:29 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD3E7.tmp
MOD - [2012-07-22 12:31:29 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD388.tmp
MOD - [2012-07-22 12:31:29 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD338.tmp
MOD - [2012-07-22 12:31:28 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD2D8.tmp
MOD - [2012-07-22 12:31:28 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD297.tmp
MOD - [2012-07-22 12:31:28 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD0A1.tmp
MOD - [2012-07-22 12:31:28 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD051.tmp
MOD - [2012-07-22 12:31:28 | 000,072,704 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD1B6.tmp
MOD - [2012-07-22 12:31:28 | 000,072,192 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD228.tmp
MOD - [2012-07-22 12:31:28 | 000,072,192 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD1F7.tmp
MOD - [2012-07-22 12:31:28 | 000,072,192 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD186.tmp
MOD - [2012-07-22 12:31:28 | 000,064,000 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD103.tmp
MOD - [2012-07-22 12:31:28 | 000,057,344 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD155.tmp
MOD - [2012-07-22 12:31:28 | 000,056,320 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD001.tmp
MOD - [2012-07-22 12:31:28 | 000,053,760 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD143.tmp
MOD - [2012-07-22 12:31:28 | 000,053,760 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD0B3.tmp
MOD - [2012-07-22 12:31:27 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMCD51.tmp
MOD - [2012-07-22 12:31:27 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMCD10.tmp
MOD - [2012-07-22 12:31:27 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMCC92.tmp
MOD - [2012-07-22 12:31:27 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMCC11.tmp
MOD - [2012-07-22 12:31:27 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMCB92.tmp
MOD - [2012-07-22 12:31:27 | 000,056,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMCC61.tmp
MOD - [2012-07-22 12:31:26 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMCA77.tmp
MOD - [2012-07-22 12:31:26 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMC7FF.tmp
MOD - [2012-07-22 12:31:26 | 000,068,608 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMC94D.tmp
MOD - [2012-07-22 12:31:26 | 000,056,320 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMC820.tmp
MOD - [2012-07-22 12:31:26 | 000,055,296 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMC890.tmp
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-1038552694-1835066606-1673583278-1000..\Run: [Ojosee] C:\Users\Ania\AppData\Roaming\dspropl.dll ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O33 - MountPoints2\{764a5e4a-cbf0-11e1-a49f-c0f8dac5c3c4}\Shell - "" = AutoRun
O33 - MountPoints2\{764a5e4a-cbf0-11e1-a49f-c0f8dac5c3c4}\Shell\AutoRun\command - "" = H:\SISetup.exe
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
[2012-07-01 16:45:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ania\AppData\Roaming\mozilla\Firefox\Profiles\sgjvvqhz.default\extensions
[2012-02-03 12:56:56 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Ania\AppData\Roaming\mozilla\Firefox\Profiles\sgjvvqhz.default\extensions\battlefieldheroespatcher@ea.com
[2012-06-21 19:33:34 | 000,135,168 | RHS- | C] () -- C:\Users\Ania\AppData\Roaming\dspropl.dll
[2012-06-25 16:06:16 | 000,002,328 | ---- | M] () -- C:\Users\Ania\AppData\Roaming\Mozilla\Firefox\Profiles\sgjvvqhz.default\searchplugins\askcom.xml

:Commands
[emptytemp]

Kliknij Wykonaj skrypt.Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, i kliknij skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania

[ankad]

Pierwszym razem OTL się zawiesił drugim razem poszło.

Dodano Dzisiaj, 16:41:
Przegapiłam raport z usuwania?
Czy gdzieś go znajdę?

[defacto19]

Raport znajduję się na dysku C _OTL

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt)wklej:

:OTL
MOD - [2012-07-23 16:19:53 | 000,033,792 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\YTMP7MC8AA\TAA2CC4.tmp
MOD - [2012-07-23 16:19:50 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1F09.tmp
MOD - [2012-07-23 16:19:50 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM21C0.tmp
MOD - [2012-07-23 16:19:50 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM2190.tmp
MOD - [2012-07-23 16:19:50 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM20D2.tmp
MOD - [2012-07-23 16:19:50 | 000,085,504 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM2063.tmp
MOD - [2012-07-23 16:19:49 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1D52.tmp
MOD - [2012-07-23 16:19:49 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1C85.tmp
MOD - [2012-07-23 16:19:49 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1ACF.tmp
MOD - [2012-07-23 16:19:48 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1A02.tmp
MOD - [2012-07-23 16:19:48 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1954.tmp
MOD - [2012-07-23 16:19:48 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM17AD.tmp
MOD - [2012-07-23 16:19:48 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1615.tmp
MOD - [2012-07-23 16:19:47 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM148D.tmp
MOD - [2012-07-23 16:19:47 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1373.tmp
MOD - [2012-07-23 16:19:46 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMF84.tmp
MOD - [2012-07-23 16:19:46 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1248.tmp
MOD - [2012-07-23 16:19:46 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM112D.tmp
MOD - [2012-07-23 16:19:46 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM1051.tmp
MOD - [2012-07-23 16:19:45 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMEA8.tmp
MOD - [2012-07-23 16:19:45 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMD4F.tmp
MOD - [2012-07-23 16:19:45 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMC15.tmp
MOD - [2012-07-23 16:19:45 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMB96.tmp
MOD - [2012-07-23 16:19:44 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMAD9.tmp
MOD - [2012-07-23 16:19:44 | 000,120,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM9EC.tmp
MOD - [2012-07-23 16:19:44 | 000,072,704 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM831.tmp
MOD - [2012-07-23 16:19:44 | 000,072,192 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM95D.tmp
MOD - [2012-07-23 16:19:44 | 000,072,192 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM8CF.tmp
MOD - [2012-07-23 16:19:44 | 000,072,192 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM81F.tmp
MOD - [2012-07-23 16:19:43 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM393.tmp
MOD - [2012-07-23 16:19:43 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM333.tmp
MOD - [2012-07-23 16:19:43 | 000,064,000 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM4B0.tmp
MOD - [2012-07-23 16:19:43 | 000,057,344 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM6B6.tmp
MOD - [2012-07-23 16:19:43 | 000,053,760 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM5AB.tmp
MOD - [2012-07-23 16:19:43 | 000,053,760 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM460.tmp
MOD - [2012-07-23 16:19:42 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFF76.tmp
MOD - [2012-07-23 16:19:42 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMB0.tmp
MOD - [2012-07-23 16:19:42 | 000,056,320 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEM100.tmp
MOD - [2012-07-23 16:19:41 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFDBF.tmp
MOD - [2012-07-23 16:19:41 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFD1F.tmp
MOD - [2012-07-23 16:19:41 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFD0D.tmp
MOD - [2012-07-23 16:19:41 | 000,056,832 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFD50.tmp
MOD - [2012-07-23 16:19:40 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFB47.tmp
MOD - [2012-07-23 16:19:40 | 000,075,776 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMF94C.tmp
MOD - [2012-07-23 16:19:40 | 000,068,608 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFA99.tmp
MOD - [2012-07-23 16:19:40 | 000,056,320 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFA66.tmp
MOD - [2012-07-23 16:19:40 | 000,055,296 | ---- | M] () -- C:\Users\Ania\AppData\Local\Temp\XTMP1MC3VE\DEMFA88.tmp

:Commands
[emptytemp]

Reszta bez zmian. Tym razem zapisz raport, z usuwania i pokaż go na forum.

[ankad]

Proszę o dalsze instrukcje

[defacto19]

Czy miałaś uruchomione jakieś programy podczas wykonywania skryptu ?

Wykonaj jeszcze raz ten sam skrypt tym razem w trybie awaryjnym.
http://windows.microsoft.com/pl-PL/windows7/Start-your-computer-in-safe-mode
Raport z usuwania pokaż na forum.

[ankad]

Możliwe że coś było uruchomione.

[defacto19]

Usuń ręcznie wszystkie pliki z folderu Temp
C:\Users\Ania\AppData\Local\Temp

Wykonaj pełne skanowanie programem Malwarebytes Anti-Malware (Przed skanowanie wykonaj ręczną aktualizację)
http://www.malwarebytes.org/

Wykonaj również pełne skanowanie programem Dr.WEB CureIt
http://www.freedrweb.com/cureit/?lng=en
Raporty które powstaną po skanowaniu przedstaw na forum.

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt)wklej:

:Files
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1038552694-1835066606-1673583278-1000UA.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1038552694-1835066606-1673583278-1000Core.job
C:\windows\SysNative\mvusbews.dll
C:\Users\Ania\AppData\Roaming\default.rss
C:\*.tmp
C:\Windows\*.tmp

:Commands
[emptytemp]

Kliknij Wykonaj skrypt.Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie, i pokaż go na forum.