System muli, laptop się przegrzewa, mbam wykrywa wirusy

[łysy82]

Witam,
od pewnego czasu mam spore problemy ze swoim laptopem. Mianowicie jak w temacie - system bardzo muli i wolno się włącza, laptop chodzi bardzo głośno i grzeje się mimo, że włączona jest tylko przeglądarka. Dodatkowo, dopiero niedawno spostrzegłem, że przez spory czas nie chronił systemu żaden antywirus . Po szybkim skanowaniu Malwarebytes Anti-Malware wykrył 12 złośliwych plików. Chociaż niedawno po pełnym skanowaniu usunąłem ich 96. Większość podejrzanych plików i procesów w pamięci miała w nazwie coś z Bit Guard.

Dołączam logi i proszę o jego sprawdzenie i pomoc.

[ordynat]

Nie widzę tu żadnej infekcji.

Jest sponsorski śmieć, ale masz zainstalowaną Avirę, a Avira już przeszła na "ciemną stronę mocy", więc współpracuje z tym śmieciem ASK.

Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ, a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ, to kliknij na niego.
Daj z tego raport.

Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
O20:64bit: - AppInit_DLLs: (c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll) - File not found
[2013/10/24 07:27:40 | 000,000,000 | -HSD | C] -- C:\found.000
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.25.2)
[2013/03/12 20:19:36 | 000,006,484 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2013/05/01 13:11:40 | 000,006,487 | ---- | M] () -- C:\Users\mat\AppData\Roaming\mozilla\firefox\profiles\pkpts2ka.default\searchplugins\babylon.xml
[2013/05/01 13:11:40 | 000,006,487 | ---- | M] () -- C:\Users\mat\AppData\Roaming\mozilla\firefox\profiles\pkpts2ka.default\searchplugins\BrowserProtect.xml
[2013/03/12 20:19:45 | 000,001,294 | ---- | M] () -- C:\Users\mat\AppData\Roaming\mozilla\firefox\profiles\pkpts2ka.default\searchplugins\delta.xml

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[-HKEY_USERS\S-1-5-21-3135873756-1747778033-1847798441-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-21-3135873756-1747778033-1847798441-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

[łysy82]

Kod: Zaznacz wszystko

All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll deleted successfully.
C:\found.000\dir0002.chk folder moved successfully.
C:\found.000\dir0001.chk folder moved successfully.
C:\found.000\dir0000.chk folder moved successfully.
C:\found.000 folder moved successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml not found.
File C:\Users\mat\AppData\Roaming\mozilla\firefox\profiles\pkpts2ka.default\searchplugins\babylon.xml not found.
File C:\Users\mat\AppData\Roaming\mozilla\firefox\profiles\pkpts2ka.default\searchplugins\BrowserProtect.xml not found.
File C:\Users\mat\AppData\Roaming\mozilla\firefox\profiles\pkpts2ka.default\searchplugins\delta.xml not found.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3135873756-1747778033-1847798441-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope deleted successfully.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3135873756-1747778033-1847798441-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\"DefaultScope"|"{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Gość
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: mat
->Temp folder emptied: 45488286 bytes
->Temporary Internet Files folder emptied: 310143563 bytes
->Java cache emptied: 98885 bytes
->FireFox cache emptied: 410774598 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 128727 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 261537306 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42304147 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,021.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 11142013_182004

Files\Folders moved on Reboot...
C:\Users\mat\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\mat\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
C:\Users\mat\AppData\Local\Mozilla\Firefox\Profiles\pkpts2ka.default\startupCache\startupCache.4.little moved successfully.
C:\Users\mat\AppData\Local\Mozilla\Firefox\Profiles\pkpts2ka.default\Cache\_CACHE_001_ moved successfully.
C:\Users\mat\AppData\Local\Mozilla\Firefox\Profiles\pkpts2ka.default\Cache\_CACHE_002_ moved successfully.
C:\Users\mat\AppData\Local\Mozilla\Firefox\Profiles\pkpts2ka.default\Cache\_CACHE_003_ moved successfully.
C:\Users\mat\AppData\Local\Mozilla\Firefox\Profiles\pkpts2ka.default\Cache\_CACHE_MAP_ moved successfully.
C:\Users\mat\AppData\Local\Mozilla\Firefox\Profiles\pkpts2ka.default\_CACHE_CLEAN_ moved successfully.
C:\Windows\temp\sqlite_Cx9ZUUSUBVL6bvh moved successfully.
C:\Windows\temp\sqlite_Od7eL2vI49JasGr moved successfully.
C:\Windows\temp\sqlite_Z6nWnVUiKNxygDc moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


[ordynat]

OK, usunięte, co miało być usunięte.
Kończymy:
W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL)
W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną.
.

Autor postu otrzymał pochwałę