ewelynka

Malwarebytes Anti-Malware nic nie wykrył, więc chyba jest już wszystko w porządku dziękuję bardzo za pomoc bo sama sobie bym z tym napewno nie poradziła.

zrobione OTL.Txt

ale ja nawet nie mam zainstalowanej Mozilli Firefox :/ kiedyś miałam, znalazłam tylko jakiś jeden folder, który może został po tytm i go usunęłam. Google Chrome odinstalowałam w ogóle i pozostała tylko Opera. All processes killed ========== OTL ========== Prefs.js: radiobar@toolbar:1.0.0 removed from extensions.enabledItems Prefs.js: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 removed from extensions.enabledItems Prefs.js: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=" removed from keyword.URL Prefs.js: "http://start.funmoods.com/?f=1&a=down" removed from browser.startup.homepage Prefs.js: "Search" removed from browser.search.selectedEngine Prefs.js: "Search" removed from browser.search.defaultenginename Prefs.js: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" removed from browser.search.defaulturl Registry key HKEY_USERS\S-1-5-21-1836913075-3883909762-3358614920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C225F8CE-719A-41F5-8B08-823A394B5B5B}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C225F8CE-719A-41F5-8B08-823A394B5B5B}\ not found. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found. 64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00e71626-0bef-11dc-8314-0864264c9a64}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00e71626-0bef-11dc-8314-0864264c9a64}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00e71626-0bef-11dc-8314-0800200c9a66}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00e71626-0bef-11dc-8314-0800200c9a66}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HF_G_Jul deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ROC_roc_dec12 deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\vProt deleted successfully. ========== FILES ========== C:\Users\user\AppData\Roaming\Babylon folder moved successfully. C:\Users\user\AppData\Roaming\Media Finder\Temp folder moved successfully. C:\Users\user\AppData\Roaming\Media Finder\Extensions folder moved successfully. C:\Users\user\AppData\Roaming\Media Finder folder moved successfully. C:\Users\user\AppData\Roaming\OpenCandy\OpenCandy_AB9E161204A54654B0D732D285F0231C folder moved successfully. C:\Users\user\AppData\Roaming\OpenCandy\AB9E161204A54654B0D732D285F0231C folder moved successfully. C:\Users\user\AppData\Roaming\OpenCandy folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\META-INF folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\chrome folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\ffxtlbr@babylon.com\defaults\preferences folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\ffxtlbr@babylon.com\defaults folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\ffxtlbr@babylon.com\content folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\ffxtlbr@babylon.com\components folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\ffxtlbr@babylon.com folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\radiobar@toolbar\META-INF folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\radiobar@toolbar\components folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\radiobar@toolbar\chrome folder moved successfully. C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\4c2nsc85.default\extensions\radiobar@toolbar folder moved successfully. C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4c2nsc85.default\searchplugins\daemon-search.xml moved successfully. C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4c2nsc85.default\searchplugins\funmoods.xml moved successfully. C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4c2nsc85.default\searchplugins\web-search.xml moved successfully. C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\4c2nsc85.default\searchplugins\winamp-search.xml moved successfully. ========== REGISTRY ========== HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\\"DefaultScope"|"{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\"DefaultScope"|"{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: user ->Temp folder emptied: 2683073 bytes ->Temporary Internet Files folder emptied: 377544 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 6985705 bytes ->Opera cache emptied: 62567205 bytes ->Flash cache emptied: 1124 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 10233 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 787731 bytes Total Files Cleaned = 70,00 mb OTL by OldTimer - Version 3.2.59.1 log created on 08272012_160305 Files\Folders moved on Reboot... C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... OTL.Txt

a oto co otrzymałam po wskazówkach: OTL.Txt AdwCleanerS1.txt

myśle, że wykonałam wszystko zgodnie z poleceniem All processes killed ========== FILES ========== c:\users\user\AppData\Local\Microsoft\Windows\2575 folder moved successfully. c:\users\user\AppData\Roaming\hellomoto folder moved successfully. c:\users\user\AppData\Roaming\DownloaderGold\temporary folder moved successfully. c:\users\user\AppData\Roaming\DownloaderGold\downloads folder moved successfully. c:\users\user\AppData\Roaming\DownloaderGold folder moved successfully. c:\program files (x86)\Funmoods\funmoods\1.5.11.16\bh folder moved successfully. c:\program files (x86)\Funmoods\funmoods\1.5.11.16 folder moved successfully. c:\program files (x86)\Funmoods\funmoods folder moved successfully. c:\program files (x86)\Funmoods folder moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder\ deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\"Start Page"|"about:blank" /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\\"Start Page"|"about:blank" /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00e71626-0bef-11dc-8314-0864264c9a64}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00e71626-0bef-11dc-8314-0864264c9a64}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 56475 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: user ->Temp folder emptied: 292094 bytes ->Temporary Internet Files folder emptied: 281492676 bytes ->Java cache emptied: 19076267 bytes ->FireFox cache emptied: 89773069 bytes ->Google Chrome cache emptied: 342630495 bytes ->Opera cache emptied: 53765274 bytes ->Flash cache emptied: 84150 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 17118 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46374437 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 795,00 mb OTL by OldTimer - Version 3.2.59.1 log created on 08272012_110125 Files\Folders moved on Reboot... C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... ale plik nie chciał mi się załączyć :/ Extras1.Txt OTL.Txt

na początku chciałabym zaznaczyć, że nie znam się na komputerach i ich dolegliwościach stąd mój strach gdy na ekranie wyskoczyła mi dziwna informacja o blokadzie całego komputera... poczytałam o tym co nie co i okazało się, że jest to poprostu wirus, postępowałam zgodnie ze wskazówkami, zaistalowałam Combofix, otrzymałam raport skanowania, a teraz proszę o pomoc w dalszym leczeniu mojego koputera ewewe.txt