logo elektroda
logo elektroda
X
logo elektroda
REKLAMA
REKLAMA
Adblock/uBlockOrigin/AdGuard mogą powodować znikanie niektórych postów z powodu nowej reguły.

Przeglądarka przekierowuje na dziwne strony - analiza logów OTL

wisla6 27 Gru 2011 20:21 1456 3
REKLAMA
  • #1 10310438
    wisla6
    Poziom 2  
    Posty: 2
    Przeglądarka przekierowuje mnie na dziwne strony. Podaję logi z OTL:
    Załączniki:
    • OTL.Txt (81.2 KB) Musisz być zalogowany, aby pobrać ten załącznik.
  • REKLAMA
  • Pomocny post
    #2 10310496
    Kolobos
    Spec od komputerów
    Posty: 85178
    Pomógł: 17171
    Ocena: 10454
    OTL tworzy DWA logi, dlaczego dales tylko otl.txt, a extras.txt juz nie?

    Zrob skan przy pomocy mbam oraz cureit.

    Adobe Reader 9.0, zmien na 10.
    Java rowniez do aktualizacji -> www.java.com

    Odinstaluj:
    Babylon Toolbar
    DAEMON Tools Toolbar

    Wykonaj skrypt w OTL:

    :OTL
    SRV - File not found [Auto | Stopped] -- -- (wukrzlsb)
    SRV - File not found [On_Demand | Stopped] -- -- (gupdatem) Usługa Google Update (gupdatem)
    SRV - File not found [Auto | Stopped] -- -- (gupdate) Usługa Google Update (gupdate)
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?AF=100480&babsrc=HP_ss&mntrId=a005e84b000000000000001e682321b1
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://startsear.ch/?aff=1
    FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll File not found
    [2011-12-27 19:01:40 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\dll5lkfo.default\extensions\ffxtlbr@babylon.com
    [2011-12-27 18:50:09 | 000,002,310 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
    O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
    O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
    O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
    O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
    O4 - HKCU..\Run: [programtv] D:\pliki pobrane\programtv\programtv\Program TV.exe File not found
    O4 - HKCU..\Run: [Wru] C:\Program Files\Wru\Wru.exe File not found
    O20 - Winlogon\Notify\cryptnet32: DllName - (cryptnet32.dll) - File not found
    O33 - MountPoints2\{87cb3cda-f6be-11de-87d6-001e682321b1}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL WinJoke.exe
    O34 - HKLM BootExecute: (autocheck autochk /r \??\J:)
    [2011-12-27 18:53:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\BabylonToolbar
    [2011-12-27 18:50:25 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
    [2011-12-27 18:50:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Babylon
    [2011-12-27 18:50:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Babylon
    [2011-12-27 18:50:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Babylon
    [2011-12-27 19:41:50 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\RegistryBooster.job
    [2011-12-27 19:41:47 | 000,000,304 | -HS- | M] () -- C:\WINDOWS\tasks\Heoxcswf.job
    [2011-12-27 18:50:08 | 000,002,531 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Babylon.lnk

    :Commands
    [emptytemp]


    Po wykonaniu daj nowy log oraz brakujacy extras.txt
  • REKLAMA
  • #3 10311802
    wisla6
    Poziom 2  
    Posty: 2
    Dzięki!
    Już nie przekierowuje stron

    nowy log:

    All processes killed
    ========== OTL ==========
    Error: No service named wukrzlsb was found to stop!
    Service\Driver key wukrzlsb not found.
    Error: No service named gupdatem) Usługa Google Update (gupdatem was found to stop!
    Service\Driver key gupdatem) Usługa Google Update (gupdatem not found.
    Error: No service named gupdate) Usługa Google Update (gupdate was found to stop!
    Service\Driver key gupdate) Usługa Google Update (gupdate not found.
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Restore| /E : value set successfully!
    Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pandasecurity.com/activescan\ not found.
    Folder C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\dll5lkfo.default\extensions\ffxtlbr@babylon.com\ not found.
    File C:\Program Files\mozilla firefox\searchplugins\babylon.xml not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
    File C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
    File C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ not found.
    File C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
    File C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\programtv not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Wru not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet32\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{87cb3cda-f6be-11de-87d6-001e682321b1}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87cb3cda-f6be-11de-87d6-001e682321b1}\ not found.
    File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL WinJoke.exe not found.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute deleted successfully.
    File not found.
    Folder C:\Documents and Settings\x\Dane aplikacji\BabylonToolbar\ not found.
    Folder C:\Program Files\BabylonToolbar\ not found.
    C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Babylon\Setup\HtmlScreens folder moved successfully.
    C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Babylon\Setup folder moved successfully.
    C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Babylon folder moved successfully.
    C:\Documents and Settings\x\Dane aplikacji\Babylon folder moved successfully.
    C:\Documents and Settings\All Users\Dane aplikacji\Babylon folder moved successfully.
    C:\WINDOWS\tasks\RegistryBooster.job moved successfully.
    C:\WINDOWS\tasks\Heoxcswf.job moved successfully.
    C:\Documents and Settings\All Users\Pulpit\Babylon.lnk moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: x
    ->Temp folder emptied: 96089777 bytes
    ->Temporary Internet Files folder emptied: 87885 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 40534751 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 883 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 15856446 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 146,00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 12272011_233007

    Files\Folders moved on Reboot...
    C:\Documents and Settings\x\Ustawienia lokalne\Temp\WCESLog.log moved successfully.

    Registry entries deleted on Reboot...
    Załączniki:
    • Extras.Txt (36.14 KB) Musisz być zalogowany, aby pobrać ten załącznik.
  • #4 10313791
    Kolobos
    Spec od komputerów
    Posty: 85178
    Pomógł: 17171
    Ocena: 10454
    W takim razie wybierz Sprzatanie w OTL i to wszystko.
REKLAMA