Logi - FlashPlayerUpdateService.exe

Witam

Mam problem z tym plikiem FlashPlayerUpdateService.exe

Kaspersky wykrywa go jako trojana, ale nie może go usunąć.

Prosiłbym także o przejrzenie całych plików z OTLa, ponieważ komputer kilka razy się wyłączył, twierdząc że się przegrzał, gdzie temperatura procesora nie przekraczała 55 stopni.

Czasami występują problemy z drukowaniem, znikają sterowniki od drukarki.

Proszę o pomoc

BrowserProtect
AVG Security Toolbar
DefaultTab
Delta toolbar 
Delta Chrome Toolbar
 

:OTL
IE - HKU\S-1-5-21-2164051375-2234648544-3662109228-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?affID=110823&tt=3612_3&babsrc=HP_ss&mntrId=a42df3b8000000000000582c80139263
IE - HKU\S-1-5-21-2164051375-2234648544-3662109228-1000\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = http://search.babylon.com/?affID=110823&tt=3612_3&babsrc=HP_ss&mntrId=a42df3b8000000000000582c80139263
IE - HKU\S-1-5-21-2164051375-2234648544-3662109228-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=119370&babsrc=SP_ss_bay2g&mntrId=A42D1C659D84FE2A
IE - HKU\S-1-5-21-2164051375-2234648544-3662109228-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={338F6F63-4709-4324-83CA-70084B56A809}&mid=30fc079c2f3847d0ac37ed03d4e42217-44c1c3d0a202c5cb50e110d41271d376f9af2082&lang=pl&ds=xn011&pr=sa&d=2012-11-21 19:39:45&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-2164051375-2234648544-3662109228-1000\..\SearchScopes\{C95ED6CF-85A4-4A51-A062-A07CEF1129C0}: "URL" = http://www.mysearchresults.com/search?&c=2653&t=03&q={searchTerms}
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
 
:Files
C:\Windows\SysWow64\C8DDA9E1A3.sys
C:\Users\dekpol\AppData\Roaming\Babylon
C:\Users\dekpol\AppData\Roaming\BabMaint.exe
 
:Commands
[emptytemp]
 

Użytkownik pawel315 edytował ten post 06 08 2013 - 11:36

Programy odinstalowane.

Log z usuwania:

All processes killed
========== OTL ==========
HKU\S-1-5-21-2164051375-2234648544-3662109228-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\bProtector Start Page| /E : value set successfully!
HKU\S-1-5-21-2164051375-2234648544-3662109228-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\BrowserMngr Start Page| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-2164051375-2234648544-3662109228-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-2164051375-2234648544-3662109228-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_USERS\S-1-5-21-2164051375-2234648544-3662109228-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C95ED6CF-85A4-4A51-A062-A07CEF1129C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C95ED6CF-85A4-4A51-A062-A07CEF1129C0}\ not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
========== FILES ==========
C:\Windows\SysWow64\C8DDA9E1A3.sys moved successfully.
C:\Users\dekpol\AppData\Roaming\Babylon folder moved successfully.
File\Folder C:\Users\dekpol\AppData\Roaming\BabMaint.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: dekpol
->Temp folder emptied: 329954413 bytes
->Temporary Internet Files folder emptied: 36782796 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 187142352 bytes
->Flash cache emptied: 519 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 9487539 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 104404 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes
RecycleBin emptied: 10710664 bytes
 
Total Files Cleaned = 548,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 08062013_132526

Files\Folders moved on Reboot...
C:\Users\dekpol\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Nowe logi z OTL w załączniku

Wrzuciłem plik na virustotal.com ale nie wiem czy on jest zły czy dobry. Próbuję załączyć stronę zapisaną przez Chroma:

http://www.sendspace.com/file/oh0xze

Raport jest dobry

Uruchom OTL i w oknie własne opcje saknowania skrypt wklej:

:Files
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 
:Commands
[reboot]

kliknij wykonaj skrypt 

i to chyba wszystko