Facebook trojan. Logi (otl i extras) - proszę o sprawdzenie

arcadymode · 22 Sierpień 2011 22:34

Witam,

aż wstyd się przyznać…

mnie również ten trojan się przydarzył i to nie na swoim komputerze. Objawy? nieustanne restartowanie komputera.

Tutaj są logi:

OTL http://wklej.to/fykbk

Extras: http://wklej.to/Q9AUd

bardzo liczę na Waszą pomoc.

Acorus · 23 Sierpień 2011 11:12

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL MOD - [2011-08-23 00:09:13 | 000,155,648 | ---- | M] () – C:\Users\Alicia\AppData\Local\Temp\7c0eccbdb33b4a1393c63d1d9e4d903c\filesys.dll MOD - [2011-08-23 00:09:13 | 000,130,560 | ---- | M] () – C:\Users\Alicia\AppData\Local\Temp\7c0eccbdb33b4a1393c63d1d9e4d903c\http.dll MOD - [2011-08-22 17:52:33 | 000,232,960 | ---- | M] () – C:\Windows\l1rezerv.exe MOD - [2011-08-22 17:31:37 | 000,137,728 | ---- | M] () – C:\Windows\systemup.exe MOD - [2011-08-22 17:29:50 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32_.exe MOD - [2011-08-22 17:29:50 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32.exe MOD - [2011-08-22 17:14:07 | 001,213,440 | -H-- | M] () – C:\Windows\update.tray-15-0\svchost.exe O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM…\Toolbar: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM…\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) O3 - HKU\S-1-5-21-2307258959-2269736320-634555960-1004…\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found. O3 - HKU\S-1-5-21-2307258959-2269736320-634555960-1004…\Toolbar\WebBrowser: (NCH Toolbar) - {C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2307258959-2269736320-634555960-1004…\Toolbar\WebBrowser: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKU\S-1-5-21-2307258959-2269736320-634555960-1004…\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) O4 - HKLM…\Run: [1053388.exe] C:\Windows\Temp\1053388.exe () O4 - HKLM…\Run: [4089778.exe] C:\Windows\Temp\4089778.exe () O4 - HKLM…\Run: [431706.exe] C:\Windows\Temp\431706.exe () O4 - HKLM…\Run: [66424.exe] C:\Windows\Temp\66424.exe () O4 - HKLM…\Run: [99519456-loader2.exe] C:\Windows\Temp\99519456-loader2.exe () O4 - HKLM…\Run: [l1rezerv.exe] C:\Windows\l1rezerv.exe () O4 - HKLM…\Run: [sysdriver32.exe] C:\Windows\sysdriver32.exe () O4 - HKLM…\Run: [sysdriver32_.exe] C:\Windows\sysdriver32_.exe () O4 - HKLM…\Run: [systemup] C:\Windows\systemup.exe () O4 - HKLM…\Run: [tray_ico] File not found O4 - HKLM…\Run: [tray_ico0] C:\Windows\update.tray-15-0\svchost.exe () O4 - HKLM…\Run: [tray_ico1] File not found O4 - HKLM…\Run: [tray_ico2] File not found O4 - HKLM…\Run: [tray_ico3] File not found O4 - HKLM…\Run: [tray_ico4] File not found O4 - HKLM…\Run: [wxpdrv] File not found O4 - HKU\S-1-5-21-2307258959-2269736320-634555960-1004…\Run: [AdobeUpdater] File not found O4 - HKU\S-1-5-21-2307258959-2269736320-634555960-1004…\Run: [MobiLink Lite] File not found [2011-08-22 17:52:15 | 000,000,000 | —D | C] – C:\Windows\ufa [2011-08-22 17:52:15 | 000,000,000 | —D | C] – C:\Windows\rpcminer [2011-08-22 17:52:15 | 000,000,000 | —D | C] – C:\Windows\phoenix [2011-08-22 17:45:33 | 000,000,000 | -H-D | C] – C:\Windows\update.7.1 [2011-08-22 17:45:21 | 000,000,000 | —D | C] – C:\Windows\av_ico [2011-08-22 17:45:16 | 000,000,000 | -H-D | C] – C:\Windows\update.2 [2011-08-22 17:44:49 | 000,000,000 | -H-D | C] – C:\Windows\update.5.0 [2011-08-22 17:27:37 | 000,000,000 | -H-D | C] – C:\Windows\update.1 [2011-08-22 17:27:35 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-15-0-lnk [2011-08-22 17:27:35 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-15-0 [2011-08-22 19:15:18 | 000,000,734 | ---- | M] () – C:\Windows\System32\drivers\etc\hîsts [2011-08-22 17:52:49 | 000,000,199 | ---- | M] () – C:\Windows\info1 [2011-08-22 17:52:33 | 000,232,960 | ---- | M] () – C:\Windows\l1rezerv.exe [2011-08-22 17:52:14 | 005,589,370 | ---- | M] () – C:\Windows\phoenix.rar [2011-08-22 17:52:14 | 000,246,272 | ---- | M] () – C:\Windows\unrar.exe [2011-08-22 17:52:14 | 000,182,617 | ---- | M] () – C:\Windows\ufa.rar [2011-08-22 17:52:12 | 001,075,284 | ---- | M] () – C:\Windows\rpcminer.rar [2011-08-22 17:44:40 | 000,000,000 | ---- | M] () – C:\Windows\loader2.exe_ok [2011-08-22 17:31:37 | 000,137,728 | ---- | M] () – C:\Windows\systemup.exe [2011-08-22 17:31:23 | 000,904,792 | ---- | M] () – C:\Windows\geoiplist.rar [2011-08-22 17:29:50 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32_.exe [2011-08-22 17:29:50 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32.exe :Services ddservice srviecheck srvbtcclient srvsysdriver32 wxpdrivers Akamai :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” :Commands [emptytemp] [resethosts]

Kliknij Wykonaj skrypt…Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.