Facebook virus

Navness · 24 Sierpień 2011 20:35

Witam…

Otóż virus dostał mi się na komputer…

Poszukał tutaj po forum co i jak zrobić…

I zrobiłem skan…

Tutaj skan:

OTL : http://3paste.com/s/2770

Extras : http://wklejto.pl/103802

I proszę o pomoc i dalsze kroki - proszę też o dobre wytłumaczenie:)

Leon1 · 24 Sierpień 2011 21:03

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

:OTL PRC - [2011-08-23 17:09:10 | 000,636,416 | ---- | M] () – C:\WINDOWS\update.2\svchost.exe PRC - [2011-08-23 17:09:10 | 000,636,416 | ---- | M] () – C:\WINDOWS\update.2\svchost.exe PRC - [2011-08-22 15:33:04 | 000,137,728 | ---- | M] () – C:\WINDOWS\systemup.exe PRC - [2011-08-21 21:19:05 | 000,355,840 | ---- | M] () – C:\WINDOWS\update.5.0\svchost.exe PRC - [2011-08-21 21:19:05 | 000,355,840 | ---- | M] () – C:\WINDOWS\update.5.0\svchost.exe PRC - [2011-08-19 22:16:20 | 000,232,960 | ---- | M] () – C:\WINDOWS\l1rezerv.exe PRC - [2011-08-19 22:08:58 | 000,382,464 | ---- | M] () – C:\WINDOWS\update.7.1\svchostdriver.exe PRC - [2011-08-19 22:06:31 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32.exe PRC - [2011-08-19 21:53:36 | 001,215,488 | -H-- | M] () – C:\WINDOWS\update.tray-8-0\svchost.exe PRC - [2011-08-19 21:53:36 | 001,215,488 | -H-- | M] () – C:\WINDOWS\update.tray-7-0\svchost.exe PRC - [2011-08-19 21:53:36 | 001,215,488 | -H-- | M] () – C:\WINDOWS\update.1\svchost.exe PRC - [2011-06-29 12:20:24 | 000,743,936 | ---- | M] (Ufasoft) – C:\WINDOWS\ufa\ufa.exe MOD - [2011-08-23 17:09:10 | 000,636,416 | ---- | M] () – C:\WINDOWS\update.2\svchost.exe MOD - [2011-08-22 15:33:04 | 000,137,728 | ---- | M] () – C:\WINDOWS\systemup.exe MOD - [2011-08-21 21:19:05 | 000,355,840 | ---- | M] () – C:\WINDOWS\update.5.0\svchost.exe MOD - [2011-08-19 22:16:20 | 000,232,960 | ---- | M] () – C:\WINDOWS\l1rezerv.exe MOD - [2011-08-19 22:08:58 | 000,382,464 | ---- | M] () – C:\WINDOWS\update.7.1\svchostdriver.exe MOD - [2011-08-19 22:06:31 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32.exe MOD - [2011-08-19 21:53:36 | 001,215,488 | -H-- | M] () – C:\WINDOWS\update.tray-8-0\svchost.exe MOD - [2011-08-19 21:53:36 | 001,215,488 | -H-- | M] () – C:\WINDOWS\update.tray-7-0\svchost.exe MOD - [2011-08-19 21:53:36 | 001,215,488 | -H-- | M] () – C:\WINDOWS\update.1\svchost.exe SRV - File not found [Auto | Stopped] – -- (D2GS) SRV - [2011-08-23 17:09:10 | 000,636,416 | ---- | M] () [Auto | Running] – C:\WINDOWS\update.2\svchost.exe – (srviecheck) SRV - [2011-08-21 21:19:05 | 000,355,840 | ---- | M] () [Auto | Running] – C:\WINDOWS\update.5.0\svchost.exe – (srvbtcclient) SRV - [2011-08-19 22:08:58 | 000,382,464 | ---- | M] () [Auto | Running] – C:\WINDOWS\update.7.1\svchostdriver.exe – (ddservice) SRV - [2011-08-19 22:06:31 | 000,258,048 | ---- | M] () [Auto | Running] – C:\WINDOWS\sysdriver32.exe – (srvsysdriver32) SRV - [2011-08-19 21:53:36 | 001,215,488 | -H-- | M] () [Auto | Running] – C:\WINDOWS\update.1\svchost.exe – (wxpdrivers) IE - HKU\S-1-5-21-776561741-1220945662-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= … =CT2786678 IE - HKU\S-1-5-21-776561741-1220945662-682003330-1003…\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.) O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.) O3 - HKU.DEFAULT…\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.) O3 - HKU\S-1-5-18…\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-776561741-1220945662-682003330-1003…\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.) O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [2199653.exe] C:\WINDOWS\TEMP\2199653.exe () O4 - HKLM…\Run: [5116139.exe] C:\WINDOWS\TEMP\5116139.exe () O4 - HKLM…\Run: [58837263-loader2.exe] C:\WINDOWS\TEMP\58837263-loader2.exe () O4 - HKLM…\Run: [6621116.exe] C:\WINDOWS\TEMP\6621116.exe () O4 - HKLM…\Run: [7202343.exe] C:\Documents and Settings\Stani\Ustawienia lokalne\Temp\7202343.exe () O4 - HKLM…\Run: [avast5] File not found O4 - HKLM…\Run: [avgnt] File not found O4 - HKLM…\Run: [l1rezerv.exe] C:\WINDOWS\l1rezerv.exe () O4 - HKLM…\Run: [sysdriver32.exe] C:\WINDOWS\sysdriver32.exe () O4 - HKLM…\Run: [sysdriver32_.exe] C:\WINDOWS\sysdriver32_.exe () O4 - HKLM…\Run: [systemup] C:\WINDOWS\systemup.exe () O4 - HKLM…\Run: [tray_ico] File not found O4 - HKLM…\Run: [tray_ico0] C:\WINDOWS\update.tray-7-0\svchost.exe () O4 - HKLM…\Run: [tray_ico1] C:\WINDOWS\update.tray-8-0\svchost.exe () O4 - HKLM…\Run: [tray_ico2] File not found O4 - HKLM…\Run: [tray_ico3] File not found O4 - HKLM…\Run: [tray_ico4] File not found O4 - HKLM…\Run: [wxpdrv] C:\WINDOWS\services32.exe () O4 - HKU\S-1-5-21-776561741-1220945662-682003330-1003…\Run: [ALLUpdate] File not found O4 - HKU\S-1-5-21-776561741-1220945662-682003330-1003…\Run: [ares] File not found O31 - SafeBoot: AlternateShell - services32.exe SafeBootMin: wxpdrivers - C:\WINDOWS\update.1\svchost.exe () SafeBootNet: wxpdrivers - C:\WINDOWS\update.1\svchost.exe () [2011-08-22 10:32:17 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-8-0-lnk [2011-08-22 10:32:17 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-8-0 [2011-08-20 10:43:31 | 000,000,000 | —D | C] – C:\WINDOWS\ufa [2011-08-19 22:20:45 | 000,000,000 | —D | C] – C:\WINDOWS\rpcminer [2011-08-19 22:20:45 | 000,000,000 | —D | C] – C:\WINDOWS\phoenix [2011-08-19 22:14:07 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.5.0 [2011-08-19 22:10:05 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.2 [2011-08-19 22:09:00 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.7.1 [2011-08-19 22:06:22 | 000,000,000 | —D | C] – C:\WINDOWS\av_ico [2011-08-19 22:04:43 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.1 [2011-08-19 22:04:38 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-7-0-lnk [2011-08-19 22:04:38 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-7-0 [2011-08-08 15:00:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Stani\Ustawienia lokalne\Dane aplikacji\ConduitEngine [2011-08-08 15:00:17 | 000,000,000 | —D | C] – C:\Program Files\ConduitEngine [2011-08-08 15:00:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Stani\Ustawienia lokalne\Dane aplikacji\Conduit [2011-08-08 15:00:21 | 000,000,000 | —D | C] – C:\Program Files\Conduit [2011-08-24 11:15:00 | 000,000,201 | ---- | M] () – C:\WINDOWS\info1 [2011-08-22 15:33:04 | 000,137,728 | ---- | M] () – C:\WINDOWS\systemup.exe [2011-08-20 10:43:30 | 005,589,370 | ---- | M] () – C:\WINDOWS\phoenix.rar [2011-08-20 10:43:30 | 000,246,272 | ---- | M] () – C:\WINDOWS\unrar.exe [2011-08-20 10:43:30 | 000,182,617 | ---- | M] () – C:\WINDOWS\ufa.rar [2011-08-20 10:43:29 | 001,075,284 | ---- | M] () – C:\WINDOWS\rpcminer.rar [2011-08-20 09:53:38 | 000,002,645 | ---- | M] () – C:\WINDOWS\System32\CONFIG.NT [2011-08-19 22:16:20 | 000,232,960 | ---- | M] () – C:\WINDOWS\l1rezerv.exe [2011-08-19 22:08:45 | 000,904,792 | ---- | M] () – C:\WINDOWS\geoiplist.rar [2011-08-19 22:07:02 | 000,000,000 | ---- | M] () – C:\WINDOWS\loader2.exe_ok [2011-08-19 22:06:31 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32_.exe [2011-08-19 22:06:31 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32.exe [2011-08-19 21:53:36 | 001,215,488 | ---- | M] () – C:\WINDOWS\services32.exe [2011-08-22 11:42:54 | 000,047,305 | ---- | C] () – C:\WINDOWS\setupapi.old [2011-08-19 22:08:46 | 004,636,907 | ---- | C] () – C:\WINDOWS\geoiplist :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] “C:\Program Files\RelevantKnowledge\rlvknlg.exe”=- “C:\Documents and Settings\Stani\Moje dokumenty\Downloads\Flash-Player.exe”=- “C:\WINDOWS\update.1\svchost.exe”=- “C:\WINDOWS\services32.exe”=- “C:\WINDOWS\update.tray-7-0\svchost.exe”=- “C:\WINDOWS\update.2\svchost.exe”=- :Commands [CLEARALLRESTOREPOINTS] [RESETHOSTS] [emptytemp]

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

Pokaż log z usuwania.

potem nowy log OTL robiony opcją Run Scan (Skanuj)

Navness · 24 Sierpień 2011 21:25

log usuwania: http://3paste.com/s/2771

Nowy LOG OTL : http://3paste.com/s/2772

Leon1 · 25 Sierpień 2011 12:41

Log wygląda na czysty

Pobierz CCleaner http://www.filehippo.com/download_ccleaner/

przeskanuj nim i wyczyść rejestr.

W OTL kilknij CleanUp (Sprzątanie)

przeskanuj

Dr.WEB CureIt! http://www.dobreprogramy.pl/DrWEB-CureI … 12976.html

zainstaluj Internet Explorer 8 http://www.microsoft.com/windows/intern … sites.aspx

Navness · 25 Sierpień 2011 12:54

ale jak wyczyścić rejestr?

Nie mogę tego znaleźć … pomożesz?

drobok · 25 Sierpień 2011 12:56

Ccleaner (link dał Leon$), zakładka rejestr >> skanuj by znaleźć problemy >> napraw

Navness · 25 Sierpień 2011 13:02

Mam przeskanować cclear? czy otl ściągnąć? bo mi usunęło

drobok · 25 Sierpień 2011 13:04

OTL już nie jest potrzebny.

Navness · 25 Sierpień 2011 13:08

Ok, zrobiłem już wszystko, ale musze instalować Explorer 8?

A to mam też pobrać?

drobok · 25 Sierpień 2011 13:20

Tak to jest skaner, warto go użyć, ie8 należy instalować nawet wtedy, gdy się go nie używa. Masz starszą wersję domyślnie zainstalowaną, ma ona wiele dziur.