czapkin

czy to już wszystko, czy należy jeszcze coś zrobić?

załączam log: mbam-log-2012-07-28 (01-25-31).txt

Ok, oto wygenerowane logi. OLT nie chciał się załadować więc zamieszczam bezpośrednio poniżej: All processes killed ========== OTL ========== Prefs.js: pdfforge@mybrowserbar.com:5.6 removed from extensions.enabledItems Prefs.js: wtxpcom@mybrowserbar.com:5.6 removed from extensions.enabledItems Registry value HKEY_USERS\S-1-5-21-220523388-606747145-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\LaunchAp deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Wbutton deleted successfully. File move failed. D:\WINDOWS\TempFile scheduled to be moved on reboot. D:\Documents and Settings\Gość\Dane aplikacji\wtxpcom\temp folder moved successfully. D:\Documents and Settings\Gość\Dane aplikacji\wtxpcom folder moved successfully. D:\Documents and Settings\MATEUSZ\Dane aplikacji\wtxpcom\temp folder moved successfully. D:\Documents and Settings\MATEUSZ\Dane aplikacji\wtxpcom folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 1012265 bytes ->Temporary Internet Files folder emptied: 117688 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 12255808 bytes ->Flash cache emptied: 456 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Gość ->Temp folder emptied: 1269329693 bytes ->Temporary Internet Files folder emptied: 121018556 bytes ->Java cache emptied: 787310 bytes ->FireFox cache emptied: 978929777 bytes ->Flash cache emptied: 51298 bytes User: kaaa ->Temp folder emptied: 752206 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 4309179 bytes User: MATEUSZ ->Temp folder emptied: 169069358 bytes ->Temporary Internet Files folder emptied: 138712581 bytes ->Java cache emptied: 10036470 bytes ->FireFox cache emptied: 103923512 bytes ->Flash cache emptied: 63988 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 36026561 bytes ->Flash cache emptied: 1045 bytes %systemdrive% .tmp files removed: 330495058 bytes %systemroot% .tmp files removed: 2134153 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 7596056 bytes RecycleBin emptied: 151216954 bytes Total Files Cleaned = 3 183,00 mb OTL by OldTimer - Version 3.2.54.0 log created on 07262012_111737 Files\Folders moved on Reboot... File move failed. D:\WINDOWS\TempFile scheduled to be moved on reboot. File\Folder D:\Documents and Settings\Gość\Ustawienia lokalne\Temp\VI sem IN.doc not found! File\Folder D:\Documents and Settings\MATEUSZ\Ustawienia lokalne\Temp\VI sem IN.doc not found! PendingFileRenameOperations files... [2012-07-26 11:29:36 | 008,405,015 | ---- | M] () D:\WINDOWS\TempFile : Unable to obtain MD5 File D:\Documents and Settings\Gość\Ustawienia lokalne\Temp\VI sem IN.doc not found! File D:\Documents and Settings\MATEUSZ\Ustawienia lokalne\Temp\VI sem IN.doc not found! Registry entries deleted on Reboot... FSS.txt

Oto wtgenerowane logi, ponieważ blitzblank.log nie chciał się załadować "Nie masz uprawnień do wysyłania tego typu plików" to wklejam go bezpośrednio: BlitzBlank 1.0.0.32 File/Registry Modification Engine native application MoveDirectoryOnReboot: sourceDirectory = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\@", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\L", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\n", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\U", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\U\00000001.@", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\U\80000000.@", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\windows\installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\U\800000cb.@", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\documents and settings\mateusz\ustawienia lokalne\dane aplikacji\{2277028b-4e1f-cfb9-64a9-300c97d475b5}", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\documents and settings\mateusz\ustawienia lokalne\dane aplikacji\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\@", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\documents and settings\mateusz\ustawienia lokalne\dane aplikacji\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\L", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\documents and settings\mateusz\ustawienia lokalne\dane aplikacji\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\n", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\documents and settings\mateusz\ustawienia lokalne\dane aplikacji\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\U", destinationDirectory = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\documents and settings\gość\dane aplikacji\pricegong", destinationDirectory = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\documents and settings\gość\dane aplikacji\pricegong\Data", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\documents and settings\gość\dane aplikacji\pricegong\Data\mru.xml", destinationFile = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\documents and settings\mateusz\dane aplikacji\pricegong", destinationDirectory = "(null)", replaceWithDummy = 0 MoveDirectoryOnReboot: sourceDirectory = "\??\d:\documents and settings\mateusz\dane aplikacji\pricegong\Data", destinationDirectory = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\documents and settings\mateusz\dane aplikacji\pricegong\Data\mru.xml", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\windows\system32\antiwpa.dll_1528f", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\documents and settings\mateusz\ustawienia lokalne\dane aplikacji\zqnchnofua.exe", destinationFile = "(null)", replaceWithDummy = 0 MoveFileOnReboot: sourceFile = "\??\d:\program files\mozilla firefox\searchplugins\v9.xml", destinationFile = "(null)", replaceWithDummy = 0 LaunchOnReboot: launchName = "\fix.bat", commandLine = "d:\fix.bat" SystemLook 30.07.11 by jpshortstuff Log created at 14:58 on 25/07/2012 by MATEUSZ Administrator - Elevation successful ========== reg ========== [HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] (Unable to open key - key not found) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}] @="Microsoft WBEM New Event Subsystem" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32] @="D:\WINDOWS\system32\wbem\wbemess.dll" "ThreadingModel"="Both" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] @="MruPidlList" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] @="%SystemRoot%\system32\shdocvw.dll" "ThreadingModel"="Apartment" ========== filefind ========== Searching for "services.exe" D:\WINDOWS\$NtServicePackUninstall$\services.exe -----c- 108544 bytes [11:38 14/05/2012] [12:00 04/08/2004] 3DA8D964D2CC12EF8E8C342471A37917 D:\WINDOWS\ServicePackFiles\i386\services.exe ------- 109056 bytes [11:44 14/05/2012] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA D:\WINDOWS\system32\services.exe --a---- 109056 bytes [12:00 04/08/2004] [20:51 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA -= EOF =- OTL.Txt AdwCleanerS1.txt

OK zamieszczam raporty SystemLook 30.07.11 by jpshortstuff Log created at 11:12 on 25/07/2012 by MATEUSZ Administrator - Elevation successful ========== reg ========== [HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] (No values found) [HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32] "ThreadingModel"="Both" @="D:\Documents and Settings\MATEUSZ\Ustawienia lokalne\Dane aplikacji\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\n." [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}] @="Microsoft WBEM New Event Subsystem" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32] @="\\.\globalroot\systemroot\Installer\{2277028b-4e1f-cfb9-64a9-300c97d475b5}\n." "ThreadingModel"="Both" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}] @="MruPidlList" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] @="%SystemRoot%\system32\shdocvw.dll" "ThreadingModel"="Apartment" ========== filefind ========== Searching for "services.exe" FSS.txt

Witam. Od kilku dni mam pewien problem. Mój antywirus (Avira) wyświetla mi komunikat o wykrytym wirusie/niepożądanym oprogramowaniu. Mimo podjęcia próby usunięcia nie udaje mi się ta czynność. Zauważyłwm również brak dostępu do Zapory systemu windows. OTL.Txt Extras.Txt GMER.txt