Wirus odłączający internet?

[PaBlO]

Witam. Od jakiegos czasu zmagam sie z nastepujacym problemem.

Polaczenie sieciowe raz dziala , raz nie. Czasem wlaczy sie na kilka minut , lecz potem zanika , jak juz jest , to internet chodzi bardzo wolno. Polaczenie uzyskuje poprzez router + wifi wkladane do usb. Sprawdzilem na drugim komputerze sprzet , i wszystko ok , nic nie rozlacza , predkosc internetu takze ok , wiec nie bede podawal dokladnych modeli , gdyz to raczej nie w tym problem. Podejrzewam wirusa. Zgodnie ze wskazowkami z tematu "Zasady.. " przeskanowalem komputer programami Cure it , oraz Malwarebytes , oba wykryly zlosliwe pliki , ktore usunalem , lecz problem dalej wystepuje. 

Zamieszczam logi z OTL , oraz GMER : 

 

OTL : http://wklej.org/id/1128335/

 

GMER : http://wklej.org/id/1128336/

Edytowane 12 Września 2013 przez PaBlO

[Kolobos]

Odinstaluj:
mksvir/arcavir i nigdy nie instaluj wiecej niz jednego programu antywirusowego.
browserdefender
RegClean Pro

 

Uzyj AdwCleaner, opcja Scan i Clean:
http://www.bleepingcomputer.com/download/adwcleaner/

 

Wykonaj skrypt w OTL:

:OTL
PRC - [2013-07-26 12:11:20 | 002,847,696 | ---- | M] () -- C:ProgramDataBrowserDefender2.6.1519.190{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}BrowserDefender.exe
SRV - [2013-07-26 12:11:20 | 002,847,696 | ---- | M] () [Auto | Running] -- C:ProgramDataBrowserDefender2.6.1519.190{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}BrowserDefender.exe -- (BrowserDefendert)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (atjseynj)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (aqc76qss)
IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://startsear.ch/?aff=1
IE - HKLM..SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,bProtector Start Page = http://www.delta-search.com/?babsrc=HP_ss&mntrId=E6C0DE5D4C9361DF&affID=120692&tsp=4931
IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.delta-search.com/?babsrc=HP_ss&mntrId=E6C0DE5D4C9361DF&affID=120692&tsp=4931
IE - HKCU..SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU..SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU..SearchScopes{043C5167-00BB-4324-AF7E-62013FAEDACF}: "URL" = http://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp
IE - HKCU..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://startsear.ch/?aff=1&q={searchTerms}
IE - HKCU..SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=E6C0DE5D4C9361DF&affID=120692&tsp=4931
IE - HKCU..SearchScopes{B2742FB9-D031-470B-BDD9-41C23BC54C37}: "URL" = http://search.aol.pl/aol/search?s_it=tb50winamp&q={searchTerms}
[2012-10-21 11:04:06 | 000,000,000 | ---D | M] (DealPly) -- C:UsersIwonaAppDataRoamingmozillaFirefoxProfiles9pk9ey1q.defaultextensions{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
[2013-07-02 18:30:08 | 000,006,505 | ---- | M] () -- C:UsersIwonaAppDataRoamingmozillafirefoxprofiles9pk9ey1q.defaultsearchpluginsbabylon.xml
[2013-07-02 18:30:24 | 000,001,294 | ---- | M] () -- C:UsersIwonaAppDataRoamingmozillafirefoxprofiles9pk9ey1q.defaultsearchpluginsdelta.xml
[2011-07-11 20:04:02 | 000,000,633 | ---- | M] () -- C:UsersIwonaAppDataRoamingmozillafirefoxprofiles9pk9ey1q.defaultsearchpluginsstartsear.xml
O2 - BHO: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:Program FilesvSharevshare_toolbar.dll ()
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:Program FilesBitComettoolsBitCometBHO_1.5.4.11.dll (BitComet)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:Program FilesStartSearch pluginssBarLcher.dll (StartSearch Inc.)
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:Program FilesDealPlyDealPlyIE.dll (DealPly Technologies Ltd)
O3 - HKLM..Toolbar: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:Program FilesvSharevshare_toolbar.dll ()
O3 - HKLM..Toolbar: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:Program FilesStartSearch pluginssBarLcher.dll (StartSearch Inc.)
O3 - HKLM..Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKCU..ToolbarWebBrowser: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:Program FilesStartSearch pluginssBarLcher.dll (StartSearch Inc.)
O4 - HKCU..Run: [AdobeBridge] File not found
O4 - HKCU..Run: [Komunikator] C:Program FilesTlen.pltlen.exe File not found
O4 - HKCU..Run: [PCSpeedUp] C:Program FilesPrzyspiesz KomputerPCSpeedUp.lnk ()
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: 3212083974 = 50 4B 03 04 C2 39 B7 F8 06 83 74 BF B5 11 00 00 00 40 00 00 E2 69 F6
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.17.2)
O18 - ProtocolHandlervsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:Program FilesvSharevshare_toolbar.dll ()
O20 - AppInit_DLLs: (c:progra~2browse~2261519~1.190{c16c1~1browse~1.dll) - c:ProgramDataBrowserDefender2.6.1519.190{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}BrowserDefender.dll ()
[2013-07-02 18:30:53 | 000,000,000 | ---D | C] -- C:ProgramDataMicrosoftWindowsStart MenuProgramsRegClean Pro
[2013-07-02 18:30:53 | 000,000,000 | ---D | C] -- C:Program FilesRegClean Pro
[2013-07-02 18:30:52 | 000,000,000 | ---D | C] -- C:UsersIwonaAppDataRoamingsystweak
[2013-07-02 18:30:26 | 000,000,000 | ---D | C] -- C:ProgramDataBrowserDefender
[2013-07-02 18:30:22 | 000,000,000 | ---D | C] -- C:UsersIwonaAppDataRoamingBabSolution
[2013-07-02 18:30:25 | 000,000,000 | ---D | M] -- C:UsersIwonaAppDataRoamingBabSolution
[2012-10-24 18:17:33 | 000,000,000 | ---D | M] -- C:UsersIwonaAppDataRoamingBabylon
[2013-02-10 16:20:18 | 000,000,000 | ---D | M] -- C:UsersIwonaAppDataRoamingDealPly
[2013-06-20 21:42:01 | 000,000,000 | ---D | M] -- C:UsersIwonaAppDataRoamingFile Scout
[2011-08-20 21:14:22 | 000,000,000 | ---D | M] -- C:UsersIwonaAppDataRoamingOpenCandy

:Commands
[emptytemp]
 

 

Java do aktualizacji http://ninite.com/java/

 

Po wykonaniu daj nowy log z OTL.

[PaBlO]

Problem nie ustąpił. http://wklej.org/id/1129587/

[Kolobos]

Problem nie ma zwiazku z infekcja.