Usuń to co wykrył Mbam.
Użyj AdwCleaner, opcja Scan i Clean/Szukaj i Usuń:
http://www.bleepingcomputer.com/download/adwcleaner/
Odinstaluj:
ArcaVirMicroScan
Wykonaj skrypt w OTL:
:OTL
PRC - [2013-11-27 13:19:10 | 003,154,416 | ---- | M] () -- C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\fst_pl_14\upfst_pl_14.exe
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://search.babylon.com/?affID=119357&tt=gc_&babsrc=HP_ss_gin2g&mntrId=F818001A9227BBDD
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore =
http://home.mywebsearch.com/index.jhtml?n=77D...869D2D-72A0-4B4D-B891-91C1800E38DF&si=maps4pc
IE - HKCU\..\SearchScopes,DefaultScope = {0388404D-6072-4CEB-B521-8F090FEAEE57}
IE - HKCU\..\SearchScopes\{0388404D-6072-4CEB-B521-8F090FEAEE57}: "URL" =
http://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" =
http://www1.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=F818001A9227BBDD
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" =
http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1098640
FF - prefs.js..browser.search.defaultthis.engineName: "free-downloads.net Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=15627"
FF - prefs.js..extensions.enabledAddons: %7BD394D188-BAC7-4e03-8FAF-389A4D7EC6F4%7D:1.0
[2013-06-30 13:44:04 | 000,233,016 | ---- | M] () (No name found) -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\Mozilla\Firefox\Profiles\ovyb4ty3.default\extensions\hdvc3@hdvidcodec.com.xpi
[2013-12-13 11:17:50 | 000,013,570 | ---- | M] () (No name found) -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\Mozilla\Firefox\Profiles\ovyb4ty3.default\extensions\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi
[2010-01-20 11:16:28 | 000,000,939 | ---- | M] () -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\Mozilla\Firefox\Profiles\ovyb4ty3.default\searchplugins\conduit.xml
[2013-10-01 18:05:04 | 000,001,304 | ---- | M] () -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\Mozilla\Firefox\Profiles\ovyb4ty3.default\searchplugins\dalesearch.xml
[2013-05-20 20:18:18 | 000,001,294 | ---- | M] () -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\Mozilla\Firefox\Profiles\ovyb4ty3.default\searchplugins\delta.xml
[2013-10-22 19:07:29 | 000,001,702 | ---- | M] () -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\Mozilla\Firefox\Profiles\ovyb4ty3.default\searchplugins\nation-secure-search.xml
[2012-10-12 14:57:09 | 000,001,390 | ---- | M] () -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\Mozilla\Firefox\Profiles\ovyb4ty3.default\searchplugins\yahoo-zugo.xml
[2010-11-18 09:02:24 | 000,002,226 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O2 - BHO: (StartNow Toolbar Helper) - {6E13D095-45C3-4271-9475-F3B48227DD9F} - Reg Error: Value error. File not found
O4 - HKLM..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" File not found
O4 - HKLM..\Run: [fst_pl_14] File not found
O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files\Mobogenie\DaemonProcess.exe File not found
O4 - HKLM..\Run: [upfst_pl_14.exe] C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\fst_pl_14\upfst_pl_14.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 10.21.2)
[2013-12-13 11:31:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\freeSOFTtoday
[2013-12-13 11:17:50 | 000,000,000 | ---D | C] -- C:\Program Files\Shopping Suggestion
[2013-12-13 11:12:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\fst_pl_14
[2013-12-13 11:12:10 | 000,000,000 | ---D | C] -- C:\Program Files\fst_pl_14
[2013-12-13 11:12:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\.android
[2013-12-13 11:11:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\cache
[2013-12-13 11:11:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\newnext.me
[2013-12-13 11:11:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\genienext
[2013-12-13 11:11:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Ustawienia lokalne\Dane aplikacji\Mobogenie
[2013-12-13 11:11:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Moje dokumenty\Mobogenie
[2013-12-13 11:11:36 | 000,000,000 | ---D | C] -- C:\Program Files\Mobogenie
[2013-12-13 11:07:20 | 000,017,280 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\WINDOWS\System32\roboot.exe
[2013-12-13 11:07:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\systweak
[2013-12-11 16:51:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\ArcaVirMicroScan
[2013-12-15 19:00:04 | 000,001,030 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-746137067-1085031214-299502267-1004UA.job
[2013-12-11 22:00:02 | 000,001,008 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-746137067-1085031214-299502267-1004Core.job
[2013-10-19 17:56:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\APN
[2012-12-28 18:41:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ArcaBit
[2013-05-20 20:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Babylon
[2013-12-06 11:38:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Spyware Terminator
[2013-12-12 07:34:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\ArcaVirMicroScan
[2010-11-19 09:53:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\BabylonToolbar
[2013-05-20 20:17:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\DSite
[2013-12-13 20:25:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ola i Jurcyś\Dane aplikacji\newnext.me
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:DF0609D84EB73ED0