Facebook wirus

Sinyo51 · 2 Wrzesień 2011 16:41

Witam

Jakiś tydzień lub dwa tygodnie temu złapałem wirusa przez Facebooka, który bardzo zamula internet. Antywirus go wykrywa ale mimo tego ze go usunę co jakiś czas pojawia się znowu.

Podaję raporty z OTL.

OTL.txt

http://wklej.to/609lw

Extras.txt

http://wklej.to/BpuiI

Acorus · 2 Wrzesień 2011 17:14

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL MOD - [2011-08-28 15:58:48 | 000,130,560 | ---- | M] () – C:\Windows\systemup.exe MOD - [2011-08-19 17:14:07 | 000,232,960 | ---- | M] () – C:\Windows\l1rezerv.exe MOD - [2011-08-19 17:10:27 | 000,273,920 | ---- | M] () – C:\Windows\update.3\svchost.exe MOD - [2011-08-19 17:05:36 | 001,215,488 | -H-- | M] () – C:\Windows\update.tray-9-0\svchost.exe MOD - [2011-08-19 17:05:36 | 001,215,488 | -H-- | M] () – C:\Windows\update.tray-12-0\svchost.exe IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1 FF - prefs.js…browser.search.defaultengine: “Web Search” FF - prefs.js…browser.search.defaultenginename: “Web Search” FF - prefs.js…browser.search.order.1: “Web Search” FF - prefs.js…keyword.URL: “http://startsear.ch/?aff=1&q=” O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM…\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKLM…\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU.DEFAULT…\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKU.DEFAULT…\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU\S-1-5-18…\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKU\S-1-5-18…\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4 - HKLM…\Run: [1362719.exe] File not found O4 - HKLM…\Run: [1659152.exe] C:\Windows\Temp\1659152.exe () O4 - HKLM…\Run: [2688339.exe] File not found O4 - HKLM…\Run: [38335873-loader2.exe] C:\Windows\Temp\38335873-loader2.exe () O4 - HKLM…\Run: [4837339.exe] C:\Users\Krystian\AppData\Local\Temp\4837339.exe () O4 - HKLM…\Run: [8225156.exe] C:\Windows\Temp\8225156.exe () O4 - HKLM…\Run: [8830992.exe] C:\Windows\Temp\8830992.exe () O4 - HKLM…\Run: [l1rezerv.exe] C:\Windows\l1rezerv.exe () O4 - HKLM…\Run: [sysdriver32.exe] File not found O4 - HKLM…\Run: [sysdriver32_.exe] File not found O4 - HKLM…\Run: [systemup] C:\Windows\systemup.exe () O4 - HKLM…\Run: [tray_ico] File not found O4 - HKLM…\Run: [tray_ico0] C:\Windows\update.tray-12-0\svchost.exe () O4 - HKLM…\Run: [tray_ico1] C:\Windows\update.tray-9-0\svchost.exe () O4 - HKLM…\Run: [tray_ico2] File not found O4 - HKLM…\Run: [tray_ico3] File not found O4 - HKLM…\Run: [tray_ico4] File not found O4 - HKLM…\Run: [w_distrib.exe] C:\Windows\update.3\svchost.exe () O4 - HKLM…\Run: [wxpdrv] C:\Windows\services32.exe () [2011-09-02 17:38:39 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-9-0-lnk [2011-09-02 17:38:39 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-9-0 [2011-08-31 11:20:01 | 000,000,000 | —D | C] – C:\Windows\av_ico [2011-08-31 11:15:26 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-12-0-lnk [2011-08-31 11:15:26 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-12-0 [2011-08-19 17:13:56 | 000,000,000 | —D | C] – C:\Windows\ufa [2011-08-19 17:13:56 | 000,000,000 | —D | C] – C:\Windows\rpcminer [2011-08-19 17:13:56 | 000,000,000 | —D | C] – C:\Windows\phoenix [2011-08-19 17:11:16 | 000,000,000 | -H-D | C] – C:\Windows\update.5.0 [2011-08-19 17:10:28 | 000,000,000 | -H-D | C] – C:\Windows\update.3 [2011-08-19 17:09:38 | 000,000,000 | -H-D | C] – C:\Windows\update.2 [2011-08-19 17:08:11 | 000,000,000 | -H-D | C] – C:\Windows\update.7.1 [2011-08-19 17:06:52 | 000,000,000 | -H-D | C] – C:\Windows\update.1 [2011-09-02 17:54:16 | 005,589,370 | ---- | M] () – C:\Windows\phoenix.rar [2011-09-02 17:54:16 | 001,075,284 | ---- | M] () – C:\Windows\rpcminer.rar [2011-09-02 17:54:16 | 000,246,272 | ---- | M] () – C:\Windows\unrar.exe [2011-09-02 17:54:16 | 000,182,617 | ---- | M] () – C:\Windows\ufa.rar [2011-08-29 15:08:44 | 000,000,247 | ---- | M] () – C:\Windows\info1 [2011-08-28 15:58:48 | 000,130,560 | ---- | M] () – C:\Windows\systemup.exe [2011-08-19 17:14:07 | 000,232,960 | ---- | M] () – C:\Windows\l1rezerv.exe [2011-08-19 17:09:36 | 000,904,792 | ---- | M] () – C:\Windows\geoiplist.rar [2011-08-19 17:07:42 | 000,000,000 | ---- | M] () – C:\Windows\loader2.exe_ok [2011-08-19 17:05:36 | 001,215,488 | ---- | M] () – C:\Windows\services32.exe [2011-08-31 03:03:43 | 000,000,000 | —D | M] – C:\Users\Patryk\AppData\Roaming\EurekaLog :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” :Commands [emptytemp] [resethosts]

Kliknij Wykonaj skrypt .Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.

Odinstaluj DAEMON Tools Toolbar,vShare.tv plugin 1.3.