Odinstaluj:
Update Manager for SweetPacks 1.1
Przed uzyciem combofix problem rowniez wystepowal?
Uzyj AdwCleaner, opcja Scan i Clean:
http://www.bleepingcomputer.com/download/adwcleaner/ Wykonaj skrypt w OTL:
:OTL
SRV - File not found [Auto | Stopped] -- C:\ComboFix\PEV.cfxxe EXEC /i C:\ComboFix\REGT.cfxxe /S C:\ComboFix\CregB.dat -- (PEVSystemStart)
SRV - File not found [Auto | Stopped] -- C:\Documents and Settings\All Users\Dane aplikacji\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe -- (BrowserDefendert)
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" =
http://feed.helperbar.com/?publisher=OPENCAND...dd&affid=111583&searchtype=ds&babsrc=lnkry&q= {searchTerms}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = ${SEARCH_URL}{searchTerms}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" =
http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=18&q= {searchTerms}&barid={770E1D2E-73A7-487F-AAF4-1C9ECEEF8BCC}
IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=PL
IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=PL
IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=PL
IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=PL
IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" =
http://www2.delta-search.com/?q= {searchTerms}&babsrc=SP_ss&mntrId=F823002618CDC7AC&affID=119357&tsp=4997
IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://startsear.ch/?src=sp&aff=51&cf=ceff8472-75fe-11e2-8e9f-002618cdc7ac&q= {searchTerms}
IE - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\SearchScopes\{F845C659-6F13-4196-B818-DA7BBCE75F30}: "URL" =
http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q= {searchTerms}&locale=en_US&apn_ptnrs=U3
FF - prefs.js..browser.search.defaultthis.engineName: "Softonic-Eng7 Customized Web Search"
FF - prefs.js..browser.startup.homepage: "http://www2.delta-search.com/?babsrc=HP_ss&mntrId=F823002618CDC7AC&affID=119357&tsp=4997"
FF - prefs.js..extensions.enabledItems: helperbar(_at_)helperbar.com:1.0
[2013-09-06 13:02:35 | 000,000,000 | ---D | M] (Delta Toolbar) -- C:\Documents and Settings\SZIK\Dane aplikacji\Mozilla\Firefox\Profiles\snh4dpeu.default\extensions\ffxtlbr@delta.com
[2013-04-25 17:34:10 | 000,002,333 | ---- | M] () -- C:\Documents and Settings\SZIK\Dane aplikacji\Mozilla\Firefox\Profiles\snh4dpeu.default\searchplugins\askcom.xml
[2013-07-30 16:21:31 | 000,006,507 | ---- | M] () -- C:\Documents and Settings\SZIK\Dane aplikacji\Mozilla\Firefox\Profiles\snh4dpeu.default\searchplugins\babylon.xml
[2013-06-03 12:54:32 | 000,002,100 | ---- | M] () -- C:\Documents and Settings\SZIK\Dane aplikacji\Mozilla\Firefox\Profiles\snh4dpeu.default\searchplugins\MyStart.xml
[2012-02-02 19:02:21 | 000,002,310 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\Toolbar\WebBrowser: (no name) - {00000000-0000-0000-0000-000000000000} - No CLSID value found.
O3 - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O3 - HKU\S-1-5-21-789336058-484061587-1801674531-1004\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [ROC_roc_ssl_v12] "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12 File not found
[2013-09-06 13:02:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\SZIK\Menu Start\Programy\BrowserDefender
[2013-09-06 13:02:27 | 000,000,000 | ---D | C] -- C:\Program Files\Delta
[2013-09-06 13:02:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\BrowserDefender
[2013-10-11 13:21:00 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2013-10-11 12:44:27 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job
[2013-06-03 12:54:24 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\ImHttpComm.dll
[2012-06-29 15:12:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ask
[2012-02-02 19:01:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Babylon
[2013-09-06 13:26:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\BrowserDefender
[2013-08-01 21:05:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SweetIM
:Commands
[emptytemp]
Daj screen z CrystalDiskInfo:
http://portableapps.com/apps/utilities/crystaldiskinfo_portable oraz z Process Explorer.
