Brontok.A

matius525 · 23 Sierpień 2012 16:49

WItam, mam problem z robalem Brontok.A

wklejam Log z OTL:

http://wklej.org/id/816943/

Prosze o szybka pomoc, gdyz jest to komputer do pracy

Dolaczam extras:

http://wklej.org/id/816945/

Atis · 23 Sierpień 2012 17:03

Odinstaluj jeden program antywirusowy, bo masz zainstalowany Trend Micro i Avast

Odinstaluj SweetPacks Toolbar for Internet Explorer.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000.10005’ O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM…\Run: [setwallpaper] c:\programdata\SetWallpaper.cmd File not found O4 - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001…\Run: [Microsoft® Windows® Operating System] C:\Users\matius\AppData\Roaming\Microsoft\Windows\Templates\typeperf.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001…\Run: [Tok-Cirrhatus] File not found O4 - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001…\Run: [Tok-Cirrhatus-2322] “C:\Users\matius\AppData\Local\smss.exe” File not found O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\matius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsvcs.exe () [2012-08-23 03:42:51 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-23 [2012-08-22 00:28:25 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-22 [2012-08-21 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-21 [2012-08-20 00:00:01 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-20 [2012-08-19 12:46:40 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-19 [2012-08-18 01:42:31 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-18 [2012-08-17 03:50:58 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-17 [2012-08-16 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-16 [2012-08-15 00:00:01 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-15 [2012-08-14 00:00:02 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-14 [2012-08-13 12:47:55 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-13 [2012-08-12 03:05:35 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-12 [2012-08-11 01:07:16 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-11 [2012-08-10 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-10 [2012-08-09 00:00:01 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-9 [2012-08-08 01:42:54 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-8 [2012-08-07 00:39:11 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-7 [2012-08-06 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-6 [2012-08-05 13:45:43 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-5 [2012-08-04 01:54:37 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-4 [2012-08-03 01:58:39 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-3 [2012-08-02 01:05:40 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-2 [2012-08-01 16:13:43 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Loc.Mail.Bron.Tok [2012-08-01 16:13:10 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Ok-SendMail-Bron-tok [2012-08-01 16:07:41 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-1 :Files C:\Users\matius\AppData\Local*.exe :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

matius525 · 23 Sierpień 2012 17:26

usuwanie: http://wklej.org/id/816968/

– Dodane 23.08.2012 (Cz) 19:40 –

i LOG:

http://wklej.org/id/816974/

Atis · 23 Sierpień 2012 17:57

Uruchom system w trybie awaryjnym i wtedy wykonaj skrypt.

Po uruchomieniu komputera naciskaj klawisz F8 i wybierz tryb awaryjny.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL [2012-05-20 14:34:03 | 000,003,915 | ---- | M] () – C:\Users\matius\AppData\Roaming\Mozilla\Firefox\Profiles\02d6vhtv.default\searchplugins\sweetim.xml O4 - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001…\Run: [Microsoft® Windows® Operating System] C:\Users\matius\AppData\Roaming\Microsoft\Windows\Templates\typeperf.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001…\Run: [Mobile Partner] C:\Program Files (x86)\WEB Partner\WEB Partner File not found O4 - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001…\Run: [Tok-Cirrhatus] File not found O4 - HKU\S-1-5-21-3664602573-4278558552-2845135927-1001…\Run: [Tok-Cirrhatus-2322] C:\Users\matius\AppData\Local\smss.exe () O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\matius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif () O4 - Startup: C:\Users\matius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsvcs.exe () [2012-08-23 03:42:51 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-23 [2012-08-22 00:28:25 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-22 [2012-08-21 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-21 [2012-08-20 00:00:01 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-20 [2012-08-19 12:46:40 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-19 [2012-08-18 01:42:31 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-18 [2012-08-17 03:50:58 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-17 [2012-08-16 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-16 [2012-08-15 00:00:01 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-15 [2012-08-14 00:00:02 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-14 [2012-08-13 12:47:55 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-13 [2012-08-12 03:05:35 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-12 [2012-08-11 01:07:16 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-11 [2012-08-10 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-10 [2012-08-09 00:00:01 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-9 [2012-08-08 01:42:54 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-8 [2012-08-07 00:39:11 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-7 [2012-08-06 00:00:00 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-6 [2012-08-05 13:45:43 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-5 [2012-08-04 01:54:37 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-4 [2012-08-03 01:58:39 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-3 [2012-08-02 01:05:40 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Bron.tok-15-2 [2012-08-01 16:13:43 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Loc.Mail.Bron.Tok [2012-08-01 16:13:10 | 000,000,000 | —D | C] – C:\Users\matius\AppData\Local\Ok-SendMail-Bron-tok [2012-08-23 19:36:31 | 000,012,393 | ---- | M] () – C:\Users\matius\AppData\Local\Bron.tok.A15.em.bin [2012-08-23 19:36:31 | 000,000,824 | ---- | M] () – C:\Windows\SysNative\drivers\etc\tmvsthfud.bin [2012-08-23 19:36:28 | 000,012,393 | ---- | M] () – C:\Users\matius\AppData\Local\Update.15.Bron.Tok.bin [2012-08-23 19:36:27 | 000,000,824 | ---- | M] () – C:\Windows\SysNative\drivers\etc\tmvsthfss.bin [2012-08-02 14:27:39 | 000,043,476 | ---- | M] () – C:\Users\matius\Documents\Documents.exe [2012-04-01 00:12:06 | 000,000,000 | —D | M] – C:\Users\matius\AppData\Roaming\1334 :Files C:\Users\matius\AppData\Local*.exe :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.