Facebook- WIRUS

asjia · 18 Wrzesień 2011 06:31

Witam. Od kilku dni mam problem z wirusem na facebooku. Nie moge sie zalogować i stoje na 3 etapie.

Tu jest mój scan :

Co dalej ?

Acorus · 18 Wrzesień 2011 07:44

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL MOD - [2011-09-13 18:50:19 | 000,081,920 | ---- | M] () – C:\WINDOWS\system32\ny196643.dll MOD - [2011-09-13 18:50:19 | 000,035,346 | ---- | M] () – C:\WINDOWS\system32\temp1.exe IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo … TbId=66022 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ppcb&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=ppcb IE - HKCU…\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - Reg Error: No CLSID value found. File not found IE - HKCU…\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - Reg Error: No CLSID value found. File not found IE - HKCU…\URLSearchHook: {ce18769b-c7fa-42d2-860d-17c4662c70ad} - SOFTWARE\Classes\CLSID{ce18769b-c7fa-42d2-860d-17c4662c70ad}\InprocServer32 File not found FF - prefs.js…browser.search.defaultthis.engineName: “Babylon-EnglishBB Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2720081&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.selectedEngine: “Babylon-EnglishBB Customized Web Search” FF - prefs.js…extensions.enabledItems: engine@conduit.com:3.2.1.3 FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2720081&SearchSource=2&q=” [2011-08-04 19:51:56 | 000,000,000 | —D | M] (Softonic-Eng7 Community Toolbar) – C:\Documents and Settings\Asia\Dane aplikacji\Mozilla\Firefox\Profiles\0e7sn33j.default\extensions{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} [2011-08-04 19:51:57 | 000,000,000 | —D | M] (Babylon-EnglishBB Community Toolbar) – C:\Documents and Settings\Asia\Dane aplikacji\Mozilla\Firefox\Profiles\0e7sn33j.default\extensions{ce18769b-c7fa-42d2-860d-17c4662c70ad} [2011-04-03 13:17:16 | 000,000,000 | —D | M] (Conduit Engine) – C:\Documents and Settings\Asia\Dane aplikacji\Mozilla\Firefox\Profiles\0e7sn33j.default\extensions\engine@conduit.com [2011-07-07 16:48:32 | 000,000,937 | ---- | M] () – C:\Documents and Settings\Asia\Dane aplikacji\Mozilla\Firefox\Profiles\0e7sn33j.default\searchplugins\conduit.xml [2009-06-21 16:50:30 | 000,001,196 | ---- | M] () – C:\Documents and Settings\Asia\Dane aplikacji\Mozilla\Firefox\Profiles\0e7sn33j.default\searchplugins\winamp-search.xml [2010-03-28 18:56:18 | 000,002,035 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrchFxt.xml [2010-10-26 17:57:38 | 000,002,036 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrchppcb.xml O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.1\bh\facemoods.dll File not found O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found O2 - BHO: (Babylon-English Toolbar) - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - C:\Program Files\Babylon-English\tbBaby.dll File not found O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O3 - HKLM…\Toolbar: (Babylon-English Toolbar) - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - C:\Program Files\Babylon-English\tbBaby.dll File not found O3: - HKCU…\Toolbar\WebBrowser - No CLSID value found. O3: - HKCU…\Toolbar\WebBrowser - No CLSID value found. O3: - HKCU…\Toolbar\WebBrowser - No CLSID value found. O4 - HKLM…\Run: [lxdxamon] “C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe” File not found O4 - HKLM…\Run: [lxdxmon.exe] “C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe” File not found O4 - HKLM…\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe File not found O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE File not found O4 - HKCU…\Run: [MaxUp Video Downloader] E:\Program Files\MaxUp Video Downloader\maxup.exe File not found O4 - HKCU…\Run: [Nowe Gadu-Gadu] “C:\Program Files\Nowe Gadu-Gadu\gg.exe” File not found O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized File not found F3 - HKCU WinNT: Load - (C:\WINDOWS\svchost.exe) -C:\WINDOWS\svchost.exe () [2011-09-13 18:50:28 | 000,005,077 | ---- | M] () – C:\WINDOWS\System32\drivers\mkmnq.sys [2011-09-13 18:50:20 | 000,002,085 | ---- | M] () – C:\WINDOWS\System32\temp2.exe [2011-09-13 18:50:19 | 000,081,920 | ---- | M] () – C:\WINDOWS\System32\vx196643.dll [2011-09-13 18:50:19 | 000,081,920 | ---- | M] () – C:\WINDOWS\System32\ny196643.dll [2011-09-13 18:50:19 | 000,044,748 | -H-- | M] () – C:\WINDOWS\System32\vx196643.dl_ [2011-09-13 18:50:19 | 000,044,748 | -H-- | M] () – C:\WINDOWS\System32\ny196643.dl_ [2011-09-13 18:50:19 | 000,035,346 | ---- | M] () – C:\WINDOWS\System32\temp1.exe [2011-09-03 16:10:55 | 000,000,560 | -H-- | M] () – C:\WINDOWS\tasks\Norton Security Scan for Wojtek.job [2011-08-18 21:40:12 | 000,000,000 | ---- | M] () – C:\WINDOWS\System32\temp3.exe [2009-07-28 12:30:03 | 000,115,899 | RHS- | C] () – C:\WINDOWS\xcopy.exe [2009-07-28 12:30:03 | 000,070,207 | RHS- | C] () – C:\WINDOWS\svchost.exe [2009-07-28 12:30:03 | 000,035,346 | ---- | C] () – C:\WINDOWS\System32\temp1.exe [2009-07-28 12:30:03 | 000,002,085 | ---- | C] () – C:\WINDOWS\System32\temp2.exe :Commands [emptytemp]

Kliknij Wykonaj skrypt .Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.