Proszę o sprawdzenie logów OTL (możliwa infekcja)

[Wbij Tu]

Tak jak wyzej

 

Tutaj macie linki

 

http://www40.zippyshare.com/v/52588161/file.html

 

http://www40.zippyshare.com/v/22369346/file.html

 

Jesli to zly dzial prosze o przeniesienie

[Fr3shMak3r]

Uruchom OTL i w Oknie Własne Opcje Skanowania :

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\WINDOWS\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - D:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - D:\Program Files\Winamp Toolbar\winamptb.dll File not found
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - D:\Program Files\Winamp Toolbar\winamptb.dll File not found
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - D:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll File not found
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe File not found

:Files
D:\Documents and Settings\All Users\Dane aplikacji\Babylon

:Commands
[emptytemp]
[reboot]

 

I klik na wykonaj skrypt .

I pokazujesz log z usuwania.

[Wbij Tu]

All processes killed
========== OTL ==========
Service EagleXNt stopped successfully!
Service EagleXNt deleted successfully!
File D:\WINDOWS\system32\drivers\EagleXNt.sys not found.
Service EagleNT stopped successfully!
Service EagleNT deleted successfully!
File D:\WINDOWS\system32\drivers\EagleNT.sys not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB5F1910-F110-11d2-BB9E-00C04F795683}\ not found.
========== FILES ==========
D:\Documents and Settings\All Users\Dane aplikacji\Babylon folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 167738 bytes
->Temporary Internet Files folder emptied: 143681 bytes

User: All Users

User: daniel
->Temp folder emptied: 10157248521 bytes
->Temporary Internet Files folder emptied: 40834184 bytes
->Java cache emptied: 76916 bytes
->FireFox cache emptied: 97882971 bytes
->Google Chrome cache emptied: 104239452 bytes
->Flash cache emptied: 8017 bytes

User: daniel.JSW-1CA63377701

User: daniel.JSW-1CA63377701.000
->Temp folder emptied: 241572863 bytes
->Temporary Internet Files folder emptied: 15864544 bytes
->FireFox cache emptied: 69730661 bytes
->Google Chrome cache emptied: 95819148 bytes
->Flash cache emptied: 12545 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 82513 bytes
->Temporary Internet Files folder emptied: 33438 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: pulpet

User: TEMP

%systemdrive% .tmp files removed: 1344422 bytes
%systemroot% .tmp files removed: 2134153 bytes
%systemroot%\System32 .tmp files removed: 2431084 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 90098332 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 10 414,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 01212013_222200

Files\Folders moved on Reboot...
File move failed. D:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

 

Tada

[Fr3shMak3r]

usuwanie przebiegło pomyślnie .

Dlaczego uważasz że możliwa infekcja .

Ja w logach nic nie widzę + do tego widzę zainstalowany Avast .

[TrueFaith]

Wywaliło mu 10GB śmieci, to mówi samo za siebie ;p Sam mu się dysk zapełniał z tego co mi pisał bo miał 15-17 mb wolnego

[Fr3shMak3r]

Komenda emptytemp czyli czyszczenie plików tymczasowych

[Wbij Tu]

Ok dziekie Fresh temat do zamkniecia